Location of the hosts file. Hosts - what should be there? Hosts File. Use of the hosts file by virus writers

Recently I needed to fix the hosts file, and where to find the hosts file, I didn't know, so I had to comb for the answer I needed. Fortunately, there was a lot of information, but just in case, I still decided to leave the answer to my question on the pages of the Computer Malfunctions blog.

Where is the hosts file located in Windows XP?

The HOSTS file is located in Windows XP at:

C:\WINDOWS\system32\drivers\etc\

Open hosts file You can use any text editor, for example, Windows Notepad.

What does the hosts file look like?

If your task is hosts file recovery, then you can copy the typical contents of the hosts file for Windows XP below. In fact, the contents of the hosts file can be limited to just one line "127.0.0.1 localhost". Everything else is just explanatory commentary. On Windows XP the hosts file looks like So:

# (C) Microsoft Corp., 1993-1999
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains mappings of IP addresses to hostnames.
# Each element must be on a separate line. The IP address must
# should be in the first column and must be followed by the appropriate name.
# The IP address and hostname must be separated by at least one space.
#
# Additionally, some lines may contain comments
# (such as this line), they must follow the node name and be separated
# from it with the symbol "#".
#
# For example:
#
# 102.54.94.97 rhino.acme.com # origin server
# 38.25.63.10 x.acme.com # client node x
127.0.0.1 localhost

And finally, if your system is not Windows XP, then I recommend that you read the article on restoring the hosts file for Windows 7, Windows Vista, Windows Server 2008, Windows Server 2003 on the official Microsoft support website: http://support.microsoft.com /kb/972034/ru.

The Windows operating system (OS) (like other OSes) has the ability to speed up the transition to the IP address you typed into the site without accessing the DNS domain name system - DomainNameSystem. To do this, a special operating system file called hosts is used (used without any extension). The question arises: "The hosts file - what should be there?"

What is the hosts file for and what does it contain?

If this file contains a correspondence between the site name and its actual IP address, then redirection occurs without contacting your provider's DNS service. Hosts file is a regular text file that can be opened by anyone, such as Notepad (but requires administrator rights). By default, the file contains several lines of explanations (comments) in English or Russian and a single executable line that redirects calls to the localhost name to the IP address of the computer itself.

Where is the hosts file located?

Typically the hosts file can be found:

in Windows OS versions 95/98/ME - in the WINDOWS directory;
in Windows OS versions NT/2000 - to the address WINNT\system32\drivers\etc;
hosts file Windows 7 (and versions of Windows XP/2003/Vista/8) - in the WINDOWS\system32\drivers\etc directory.

Other operating systems also have a hosts file with similar functions. Where the hosts file is located in these OSes needs to be considered separately.

Why is the virus protection file important?

The importance of resolving the issue of hosts, what should be there, is that some people use the special properties of this file to protect against antivirus programs and to block the call of certain files. After all, if you write in the hosts file to redirect anti-virus programs to a false IP address, then the computer will not be able to run these programs, and, for example, anti-virus databases simply will not be updated.

Therefore, if your computer has problems with the operation of antivirus programs, one of the reasons may be unauthorized modification of the hosts file of your computer.

What can the hosts file be used for?

Some users use it to prevent the use of certain sites, such as pornographic or annoying social networking sites. To implement this task, you can simply enter one line like: 127.0.0.1 “site name” at the end of the file for each site. In this case, sites whose names users on this computer are trying to navigate to will simply not be called.
You can do the following trick: redirect those trying to call an unwanted site to a site, for example, the Mashkov library, by entering the line: 81.176.66.163 “site name”.

Excluding advertisements

Also, the question about hosts, what should be there, is important because by making some additions to it, you can avoid the display of annoying contextual and/or banner advertising, which on some sites is added not only around the perimeter of the information content of the pages, but also interspersed in the middle of the texts articles. To do this, you need to redirect sites that host these types of advertising to 127.0.0.1, as indicated above. And these are sites such as, for example, Google’s contextual advertising AdSense. To exclude its display, enter the following lines into the hosts file:

127.0.0.1 pagead.googlesyndication.com;
127.0.0.1 pagead2.googlesyndication.com.

On the Internet you can find ready-made texts for inserting into the hosts file, containing many such lines that exclude the display of unnecessary ones. In addition, there are ready-made texts for setting up faster work with some search engines, for example, Google hosts. However, such materials must be used carefully. It is not advisable for the hosts file to exceed 10 KB in size. Otherwise, it itself will slow down the system. Although many similar redirect lines can fit into these 10 KB.

Possible difficulties

First, you need to make sure whether the file you want to edit is correct. The fact is that some cunning creators of virus programs disguise the hosts file used by the system, placing it in a place other than where it is registered by default. The system accesses the Windows 7 hosts file, the path of which is registered in the registry in the DataBasePath parameter, located at the address: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Tcpip\Parameters\.

The correct path value looks like: %SystemRoot%\system32\drivers\etc\hosts. You can check this by calling the registry editor regedit.exe from the START menu - run.

If the specified variable contains a different value, you must restore the value that should be.

Another trick of malware is to place another file with a similar name, for example host, in the etc directory along with the hosts file. Be careful to make sure that you are checking and editing the exact file that is being used by the system.

The third trick is to hide the file from view. They simply state that it is hidden. In this case, it is simply not visible in the catalog, although it is present there. To be able to view it, you must first set the “Show hidden files” option. In Windows XP, this option is set in the "View" tab of the "Properties" panel of the "Control Panel" menu folder. After this, viewing hidden files will be possible, and you can reset the “hidden” flag in the properties of this file. At the same time, check whether the “Read Only” flag is set for this file. If installed, you will not be able to edit it. You need to uncheck the corresponding box in the file properties panel.

The next trick might be to use a proxy. If manual proxy settings are installed, then the hosts file does not work. To resolve this issue, check your browser settings. For example, for Firefox you need to open “Settings”, then “Advanced”, then in the “Network” tab select “Customize”. In the menu that appears, if you selected the “Use system proxy settings” option, you should select the “Without proxy” option and save the settings. But if “Manually setting up a proxy service” was selected, and you did not install this, then you need to do more work. First, you need to remember the set proxy server address, set the “No proxy” option, and save the settings. Then you need to open the registry editor, call the search, insert the remembered address and perform the search, deleting the value of your address assigned to them in the found keys.

Simple protection

By the way, to prevent malware from changing the settings of your computer’s hosts file, it is useful to set the “Read Only” attribute in its properties (after all your changes to it).

Thus, in this article we dealt with the question of Hosts, what should be there, and found out what kind of file it is, where it is located, what functions it performs, how it can harm a computer under the influence of malware, and how to use it in your purposes.

Hi all! Yesterday I spent the whole evening on Skype, helping a friend solve the problem of why VKontakte would not open for him. The answer was practically on the surface, but as usually happens in such cases, we stubbornly did not notice it. The trick was that a friend, working on his website in Denver, opened Contact (with Denver running, respectively), and then turned off the computer without turning off Denver. And as a result, in the VKontakte hosts file I entered it with a local IP. Therefore, today, taking a moment, I decided to write another post, devoting it to the hosts file. In this article we will talk about what the hosts file does, what it is for, how to find it, how to edit and save it. Also, at the very bottom of the article, you can download the hosts file. I will try to describe everything in simple human language, so that even an amateur who is not particularly versed in computers can understand.

What's happenedhosts? The hosts file is a text file on your device with Internet access (computer, smartphone, etc.). The hosts file contains a database of domain names. Every time you write this or that website address in your browser, a request is initially made to the hosts file, and then only a request is made to the DNS (external servers located on the Internet). And if you block this or that address in the hosts file, then it will no longer be possible to access it from this computer. That's probably all the hosts file does.

How to find a filehosts? The hosts file is located in different places in different operating systems. Below is a table of how it can be found in the most popular OS

Everything below, until the next paragraph, is dedicated to those who do not know what to do with this table. And so, if for you this is Filka’s letter written in Chinese, then most likely you have Windows. Here, based on this OS, I will explain how to find the hosts file.

Go to My Computer. Click on the address bar (see screenshot) and paste this phrase there: C:\Windows\system32\drivers\etc. This is the path to the hosts file. Then press Enter.

We get to the system folder. Find the hosts file. All! You can congratulate yourself, you are a Computer Genius! 😉

If you have any problems, or you have a different axis, and you don’t know what or how to do, then write in the comments, I will be happy to answer. And we move on.

How to open a filehosts? Since we have found the hosts file, now we need to open it somehow. There is nothing complicated about this. Opens hosts with any text editor. I use Notepad++, but you can open it with any other one. Even with regular Notepad, built into Windows by default.

What should be in the hosts file? Nothing extra. But seriously, a clean hosts file should look like this:

# Copyright (c) 1993-2009 Microsoft Corp. # # This is a sample HOSTS file used by Microsoft TCP/IP for Windows. # # This file contains the mappings of IP addresses to host names. Each # entry should be kept on an individual line. The IP address should # be placed in the first column followed by the corresponding host name. # The IP address and the host name should be separated by at least one # space. # # Additionally, comments (such as these) may be inserted on individual # lines or following the machine name denoted by a "#" symbol. # # For example: # # 102.54.94.97 rhino.acme.com # source server # 38.25.63.10 x.acme.com # x client host # localhost name resolution is handled within DNS itself. # 127.0.0.1 localhost # ::1 localhost

If you write in English, then, as you can see, the file itself describes in detail what the hosts file does, what should be in it and how to change it. I also want to remind you that at the end of the article you can download the hosts file, so there is no need to copy it from here.

But it is unlikely that you will see exactly such a file. Most likely, there will be other lines in your hosts file. For example, if you use Adobe products, then at the end you will find something like:

127.0.0.1 adobe-dns.adobe.com 127.0.0.1 adobe-dns-2.adobe.com 127.0.0.1 adobe-dns-3.adobe.com

Now let's get to the fun part:

Editinghosts. And so, now we will learn how to change the hosts file. First, let's understand what certain symbols mean in it. It’s very easy, at the first grade level (my student goes to the second grade and edits this file once or twice).

Everything marked with a “#” is a comment. We don't take them into account. Those. you can put "#" and write whatever you want. This will not be taken into account by the computer. But, as soon as you move to a new line, if you don’t put “#” again, the computer will start taking your line into account. Let's say it again, the line with “#” is a comment and is not taken into account by the computer.

In the desert, lines in hosts are ignored. You need to put them only for your convenience, so as not to get confused later.

The numbers 127.0.0.1 are the local IP address. What are IP addresses, this is a whole article to write. Therefore, now the main thing for us to remember is that any Internet address after 127.0.0.1 will be ignored, and you will not be able to access it on the Internet.

For example, having a line like:

127.0.0.1 google.ru

You will not be able to access the Google search engine. Thus, you can deny access to any site by simply entering the url of the unwanted site after the local IP address.

These lines must be entered at the end of the file. Each new site address must start on a new line.

Sometimes it happens that some programs change this file, mainly Virtual Servers or viruses. But, if virtual servers return hosts to their original state after they are closed, then viruses maliciously edit hosts. In any case, the result is the same: you cannot get to this or that site. Therefore, if you cannot access any site, check the hosts file, perhaps access is denied in it.

Now I will reveal one terrible secret. Social networks and some other sites are often blocked at work. Often, ISPs block users using the method described above. But you already know how to change the hosts file 😉

By the way, if you want to prevent your child from accessing certain sites, then you can easily edit the hosts file, indicating the addresses of unwanted resources in it. As a result, your hosts file will look like this:

That's it, after we have edited the hosts file, we can safely save it.

Hello, dear readers of the blog site. Today I want to talk about something quite simple in its design, like Hosts file.

What is noteworthy is that it lives on almost all operating systems (and therefore all computers of Internet users), from Linux to Windows 7. Another distinctive property of it is that it does not have an extension, but this is due precisely to the fact that it works it should be in any OS, which means it must be universal.

But this is not the main thing. Although he is a relic of the past, there are still a lot of ways to use Hosts both for good purposes and not so good. For example, viruses and virus writers love it very much and often use it either to replace official sites with their phishing duplicates, or to block the ability to update your antivirus program.

However, network equipment needs IP-based devices and nothing else. Therefore, a list of correspondence between the host name and its IP address () was manually generated. Such a list was called Hosts and was sent to all nodes of the local network. Everything was great until the moment when it was no longer possible to use this method due to the huge number of records contained in this file. Sending it out has become problematic.

In this regard, we decided to approach this issue differently, namely, to place on the Internet an entire (domain name system) that would store all these correspondence tables and user computers would contact the nearest one with the question of what kind of IP-ish corresponds to the Vasya.ru domain.

At the same time, everyone happily forgot about the Hosts file, but it still existed in all operating systems, except that its content was extremely meager. Usually there was and is still present only one entry:

127.0.0.1 localhost

For some reason, this IP address (more precisely the range 127.0.0.1 - 127.255.255.255) was chosen to designate the local host (private IP), i.e. the very computer you are sitting at (literally localhost - “this computer”). But, really, this is all for the old IPv4 (fourth version).

And in IPv6, which is now coming into use (due to the fact that the number of addresses included in the previous version is no longer enough for everyone), such an entry will look a little different:

::1 localhost

But the essence is the same. Because Now both standards for specifying an IP address are still used or can be used, then in the Hosts file Usually both of these lines are present. True, there can be any kind of billboard written above them (depending on the OS used), but all those lines contain at the beginning the hash symbol # (hash), which means that these lines are comments and should not be taken into account.

On my old Windows Vista, the Hosts file now looks like this:

# Copyright (c) 1993-1999 Microsoft Corp. # # This is a sample HOSTS file used by Microsoft TCP/IP for Windows. # # This file contains the mappings of IP addresses to host names. Each # entry should be kept on an individual line. The IP address should # be placed in the first column followed by the corresponding host name. # The IP address and the host name should be separated by at least one # space. # # Additionally, comments (such as these) may be inserted on individual # lines or following the machine name denoted by a "#" symbol. # # For example: # # 102.54.94.97 rhino.acme.com # source server # 38.25.63.10 x.acme.com # x client host # This HOSTS file created by Dr.Web Anti-rootkit API 127.0.0.1 localhost:: 1 localhost

Recording syntax very simple - first indicate the IP address, and then, through any number of spaces (tab characters), enter the name of the host (computer, node or domain). A separate line is used for each entry of this kind.

Here the main question arises: what place does Hosts currently take in the process of establishing a correspondence between the domain names entered in the browser and the IP addresses that are hidden behind these domains? Well, as it turned out, it occupies a very important place, namely the first one. But first things first.

So, you enter Url address () into the address bar of your browser, or follow a link from your browser bookmarks, or from any web page open in it. In any case, the browser receives from you the path to the document you want to see.

In any case, the URL will contain the domain name of the site on which the document you are interested in is located (the site in our example). However, this domain corresponds to a very specific server (maybe virtual) where this very site is hosted. And this server must have must be an IP address, so that it is visible on the network and can be accessed.

Your browser cannot know which IP corresponds to the domain name contained in the Url (well, unless you have enabled caching of DNS records in this very browser and you have previously visited this node). Therefore he addresses first For clarification, refer specifically to the Hosts file on your computer.

If this domain is not found there (and the corresponding IP), then the browser will begin to torture DNS record caching service from Windows. If you previously accessed this domain and not much time has passed since then, then the DNS cache will give the browser this same IP address. The browser will receive it and open the document you requested.

If there are no records for this domain in the cache, then the browser will send a request to the nearest DNS server (most likely it will be your server) and receive the required information from it. True, in this case there may be a slight delay in opening the web page you requested, but with modern Internet speeds this will be practically unnoticeable.

And this happens with absolutely any request to open a document from the Internet from your computer. Do you get it? Empty Hosts does not create any problems, but if you fill it out, and even with malicious intent, it may turn out that you enter the password for your Yandex wallet not on the official website of this payment system, but on a phishing resource with a similar design (see) .

How can this be? Well, no one is safe from virus infection (), and a virus can easily add the IP address of a phishing resource to Hosts and assign it the domain name money.yandex.ru, for example. This is where the danger lies.

On a fake social networking site, they may intercept the passwords you enter, they may require a fee for entry, or something else more creative. The saddest thing is that it is impossible to notice the substitution, because the correct domain name will appear in the address bar of the browser.

Where is the Hosts file located and how can I remove virus entries from it?

On the other side remove changes made by the virus even an absolute noob in computers can use the Host file. Usually the problem is to find where this file is located.

In older versions of Windows, such as XP or 2000, it was open to everyone and lived in the system folders at the following address:

Windows\System32\drivers\etc\

You won’t believe it, but he lives at the same address in both Windows 7 and Vista, but everything is somewhat more complicated there, because following the path:

C:\Windows\System32\drivers\

You won't find the etc folders there. The developers decided that ordinary mortals should not touch this file to avoid problems.

However, the hosts file in windows 7 and vista still exists, you just need to look for it, having received Administrator rights. Personally, I never even tried to figure out all this nonsense with rights, but I found a very simple way for myself to get around this limitation.

So, go to the “Start” button menu - “All Programs” and find the “Accessories” folder there. There are shortcuts inside it, among which it’s easy to see “Notepad”. Right-click on it and select from the context menu that appears "Run as Administrator":

Well, actually, half the battle is done. Now in notepad, select “File” - “Open” from the top menu. In a standard Windows Explorer window, find the desired folder etc (inside the Windows\System32\drivers\ directory), select “All files” from the drop-down list in the lower right corner and watch with happy eyes the appearance of this top-secret file:

It will be exactly without expansion, and the rest will be rubbish, it seems hosts.txt, viruses are very often created to distract your attention and ultimately confuse you. For a real file, they set the “Hidden” attribute, which can be checked or unchecked by simply right-clicking on the file and selecting the bottom “Properties” item:

And because in Windows, by default, extensions are not displayed for registered file types (that’s why they did this - I don’t understand), then the user finds hosts.txt without seeing either its extension, or the fact that there is another hosts in the same folder, but it is hidden from his eyes.

Making changes to the fake, he still achieves nothing, begins to tear out his hair, wring his hands and goes to the store to buy a new laptop in order to finally get into his favorite Contact, which the virus blocked on the old computer. Ahhh, horror.

Although, of course, the user may be advanced and enable the display of hidden and system files in the settings. In Windows Vista, to do this, go to “Control Panel” - “Folder Options” - “View” tab and move the checkbox to the “Show hidden folders and files” line. By the way, it would be better to uncheck the “Hide extensions...” line above:

Eat a very simple way to open this file. It will be enough to press the Win + R key combination on your keyboard (or select “Run” from the “Start” button menu), then enter the following line in the window that opens and press Enter:

Notepad %windir%\system32\drivers\etc\hosts

But that's not the point. We still found where this secret (for Windows 7 and vista) file is located, and we must carefully examine it for possible abuse. If the initial examination of the patient does not reveal any pathologies, then look to the page scroll area in Notepad.

Sometimes the virus makes its entries after several hundred empty lines, thereby reducing the risk of your detection. If there is no scroll bar, then everything is great, but if there is, then use it and bring your Hosts to the form it should have from birth, i.e. It will be enough to have just two lines in it (no one needs comments):

127.0.0.1 localhost::1 localhost

Well, if spoofing addresses in this file it is quite simple to represent, for example it might look like this:

127.0.0.1 localhost::1 localhost 77.88.21.3 site

How, in this case, is it carried out? blocking certain sites through Hosts? Well, just assign the private IP address 127.0.0.1 to the domain that needs to be blocked, for example, like this:

127.0.0.1 localhost::1 localhost 127.0.0.1 vk.com 127.0.0.1 odnoklassniki.ru

The smart browser finds this match and tries to get the desired document (web page) from your own computer, which, naturally, it fails and about which it will immediately inform you. By the way, this is a good way to block your children’s access to sites that you think they should not visit. Of course, you will still need to create a list of such sites or get them from somewhere, but if you wish, you can try.

As I already mentioned, in ancient times, when the Internet was still slow for most users, to speed up the opening of sites, they registered their IP names in Hosts. Another thing is that these same resources periodically changed hosting and, along with it, IP addresses. And the user, having forgotten about what he did six months ago to speed up the Internet, tries in vain to understand why his favorite resources are not available to him.

How to use Hosts when moving a website to a new hosting?

Well, and finally, I would like to talk about how, by making changes to the Hosts file, you can work with a site that has moved to a new hosting even before a new record is registered on all DNS servers (corresponding to your domain with a new IP address ). The method is very simple but effective.

So, you change hoster. Naturally, the IP address of your site also changes. How will people find out about this on the Internet? Everything is correct, using a network of DNS servers. By the way, you will take the first and most important step yourself by going to the control panel of your registrar and registering there the addresses of the NS servers of your new hoster.

It is from them that the new DNS will spread throughout the Internet. But this process is lengthy and in the worst case scenario it can take a couple of days. During this time, the site should be available on both the new and old hosting, so that users from all over the world would not be deprived of the opportunity to view it.

However, you yourself will be interested to know how your resource actually feels with the new hoster? Check the operation of all plugins and other things. Do you really have to wait from several hours to two days? After all, this is unbearable.

Firstly, you can try resetting the DNS cache on your own computer, because it may prevent you from seeing your resource on the new hosting if external DNS servers have already received a new record. How to do this? Again, everything is very simple. Press the Win+R key combination on your keyboard (or select “Run” from the Start button menu), then enter in the window that opens:

A very scary window called Command Prompt will open, where you will need to paste this command:

Ipconfig /flushdns

The regular paste buttons in the Command Prompt window don't work, so just right-click in the Command Prompt window and select Paste.

After that, click on “Enter”, the DNS cache will be cleared on your computer and you can try to open your site again. By the way, there may be a DNS cache in the browser itself, so clear it, or refresh the window while holding down the Shift button on the keyboard.

By the way, if you are interested, you can view the contents of the DNS cache by entering the following command into the command line:

Ipconfig /displaydns

Does the site still open on the old hosting? No problem. We find the Hosts file using the method described just above and add just one line to it:

109.120.169.66 website

Where 109.120.169.66 - it will be IP address of your new hosting, and then the domain name of your site will follow. All. While the rest of the world is admiring your resource on the old hosting, you have the opportunity to correct possible problems on the engine that has already been transferred to the new hosting. The thing is wonderful and I always use it.

Good luck to you! See you soon on the pages of the blog site

Where is the hosts file located in Windows 7?

So, let's look at where hosts is located in Windows 7. You can find it in the Windows system folder. It is located on drive C, that is, where the system is installed. Next, find the “System 32” folder, go to “Drivers” and, finally, to “Etc”. The file we need is saved in this folder.

It also happens that you did not find the hosts file; most likely it is simply hidden and the “Do not show hidden files, folders and drives” option is indicated in the settings. In this case, you need to open the “Computer” folder and press “Alt”, an additional menu will appear at the top of the window, in it select “Tools” and “Folder Options”.
In the new window, select the “View” tab and find the “Show hidden files, folders and drives” item, put a checkmark on it. We accept the changes by clicking the “Ok” button. Now go to the “Etc” folder, the hosts file should be displayed.

Now let's look at how you can change the hosts file. Let's proceed as follows:

Where is the hosts file in Windows 10?

The hosts file in the Windows 10 operating system is located in the same place as in Windows 7, that is, on the system drive. In the “Windows” folder, then go to the “System 32” folder, go to “Drivers” and, finally, to “Etc”.

To change a file in Windows 10, you must:

Double-click on the hosts file;
In the window that appears we find “Open with”;
We find among the proposed programs “Notepad”;
Click “Ok”;
Make changes and save them.

If you are a layman in this matter, then it is better not to do anything, but ask for help from a qualified specialist.
If something prompts you to make changes yourself, then first make a copy of the file and move it to another folder. If something doesn’t work out for you, you will return a copy of the file.
If you did not copy this file and have already made changes, and then your computer starts acting up, then the Internet will help you. Download a similar file from the site and replace yours.
Before you change something, think about whether you really need to do it and how important it is for you.