C windows system32 drivers etc directory is missing. The contents of the hosts file. Viruses and the hosts file
What is the Hosts file for?
The purpose of this system file- Assignment to certain addresses of sites of a certain IP.
This file is very fond of all kinds of viruses and malware in order to write their data into it or simply replace it.
The result of these actions may be signs of "inserting" the site into browsers, which will ask to send SMS when the browser is opened, or blocking various sites, at the discretion of the creators of the virus.
Where is the hosts file in windows?
For different versions of Windows, the location of the hosts file is slightly different:
Windows 95/98/ME: WINDOWS\hosts
Windows NT/2000: WINNT\system32\drivers\etc\hosts
Windows XP/2003/Vista/Seven(7)/8: WINDOWS\system32\drivers\etc\hosts
And the ending hosts, this is already the target file, not the folder. He doesn't have .
What should the correct hosts file look like?
The "content" of the hosts file is also slightly different for different windows versions, but not much. It is "written" in English for what it is needed and how to make exceptions with one example. All lines that begin with a # sign mean that they are commented out and do not affect the file.
The contents of the original hosts file for Windows XP:
#
#
#space.
#
#
# For example:
#
127.0.0.1 localhost
The contents of the original hosts file for Windows Vista:
# Copyright (c) 1993-2006 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
#space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a "#" symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host
127.0.0.1 localhost::1 localhost
The contents of the original hosts file for Windows 7:
# Copyright (c) 1993-2009 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
#space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a "#" symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host
# localhost name resolution is handled within DNS itself.
# 127.0.0.1localhost
# ::1 localhost
The contents of the original hosts file for Windows 8:
# Copyright (c) 1993-2009 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
#space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a "#" symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host
# localhost name resolution is handled within DNS itself.
# 127.0.0.1localhost
# ::1 localhost
As you can see, there are no special differences in the content of the host file for different versions of windows.
How to open and edit the hosts file?
The hosts file can be found in standard Windows Notepad.
This is probably the most interesting part of the article.
First of all, you need to understand why change this file at all? Yes, in order to deny access to certain sites. Thus, by changing this file and writing the site address into it, the user will not be able to access it through any .
In order to change the hosts file, it is advisable to open it as an administrator () by right-clicking on the file and selecting "Run as administrator". Or open Notepad in this way and open the file in it.
For quick action, you can simply click the Start button and select Run ( win+r) () and enter in the line:
notepad %windir%\system32\drivers\etc\hosts
This will open the file in Notepad.
In order to block access to the site(suppose it will be test.ru ), you just need to add a line with this site to the very bottom:
127.0.0.1 test.ru
As a result, the file will have the following content:
# Copyright (c) 1993-1999 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
#space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a "#" symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host
# This HOSTS file created by Dr.Web Anti-rootkit API
# 127.0.0.1localhost
# ::1 localhost
127.0.0.1 test.ru
Each new site that you want to block, you need to start on a new line and write, not forgetting the local IP address 127.0.0.1
Also, to edit the hosts file, there is a program HOSTS EDITOR, which you can download and read the description from.
The principle of her work is that she helps to edit the hosts file.
From the screen below, the principle of its operation is clear, everything is done in a couple of clicks. Adding is done by clicking on + .
After editing, do not forget to click on the save button (2 "Save changes" button to the left of the "+" button).
You can also change this file for good purposes, for example speed up website loading.
How it works?
When you enter the site, you see its domain name, which has letters. But all sites on the Internet have an IP address, and the names are already assigned using DNS. I will not go into the details of this process, the article is not about that. But here you need to know that the hosts file has priority when accessing sites, and only after it is a DNS request.
In order to speed up the loading of the site, you need to know its IP address and domain.
The IP address of a site can be found using various services, for example, or.
Domain is the name of the site.
For example, let's speed up the loading of this site on which you are reading an article by explicitly specifying the IP address and domain for the file.
Then the added line will be:
91.218.228.14 site
This speeds up the loading of the page in a couple of seconds, and sometimes it can give access if you cannot access the site using standard means.
More with possible redirect to another site using the hosts file.
To do this, you need to know the IP address of the site and its domain (as in the case described above), then the added line will be like this:
91.218.228.14 test.ru
And now, after entering the site test.ru into the address bar of the browser, you will be redirected to the site specified in the IP address..
If you want to clean hosts file, then you can do this by simply deleting the content and inserting the original text into it, from the description above (under the spoilers).
Some nuances in the hosts file:
Thus, you can easily and free of charge block access to sites in Windows by editing the hosts file.
File hosts establishes a correspondence between the server IP and the site domain. Requests to this file take precedence over requests to DNS servers. Unlike DNS, the content of the file is controlled by the computer's administrator.
To date, a large number malware use file hosts to block access to websites of popular portals or social networks. Often, instead of blocking sites, malware redirects the user to pages that look like popular resources (social networks, mail services, etc.), where an inattentive user enters credentials, which thus get to attackers. It is also possible to block access to the websites of anti-virus software companies.
hosts file location
Default file hosts located here C:\Windows\System32\drivers\etc The file has no extension, but it can be opened with notepad. To change the contents of a file in notepad, you must have administrator rights.
To view a file hosts open the menu Start, select an item Run, enter the command
and press the button OK
This is what the file should look like hosts default.
If the file contains entries like 127.0.0.1 odnoklassniki.ru 127.0.0.1 vkontakte.ru or the addresses of your sites that you cannot access, then first check your computer for "malware", and then restore the file hosts
Restoring the contents of the hosts file to default
- Open the menu Start, select an item Run, enter the command
%systemroot%\system32\drivers\etc
and press the button OK.
- Rename the hosts file to hosts.old.
- Create a new file hosts default. To do this, follow the steps below.
- Click right click mouse in an empty space in a folder %WinDir%\system32\drivers\etc, select an item Create, click an element Text Document , Enter your name hosts and press the key ENTER.
- Click the button Yes to confirm that the filename will not have an extension TXT.
- Open a new file hosts in a text editor. For example, open the file in the program " Notebook".
- Copy the text below into a file.
# Copyright (c) 1993-2009 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
#space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a "#" symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host# localhost name resolution is handled within DNS itself.
# 127.0.0.1localhost
# ::1 localhost
Save and close the file.
You can edit the file hosts and in Notepad, delete unnecessary lines, or add your own. To do this, you need to run Notebook in mode administrator.
How to run standard Windows programs see
Hello, friends!
In some situations, it is necessary to change or restore the hosts file.
In this article I will tell you what it is for and how to edit it correctly. I will give an example of how you can speed up, redirect or block access to some sites using the hosts file.
The hosts file is a special system text file that is responsible for converting symbolic domain names to their corresponding IP addresses and vice versa. A website, in addition to the usual address, also has an IP address.
For example, social network Odnoklassniki has an address of the form www.ok.ru and IP address 217.20.147.94 . By the way, you can enter these numbers into the address bar of your browser and go, but you will be redirected to www.ok.ru.
It should be noted that such domain addresses (www.ok.ru and others) were invented solely for the sake of convenience. Agree, it is much easier to remember the symbolic name (domain) ok.ru than its IP address 217.20.147.94.
However, the server (dedicated computer) on which the ok.ru site is located does not accept such symbolic access. To resolve a hostname to an IP address, the hosts file and a special domain name system (DNS for short) are used. Moreover, the hosts file takes precedence over DNS.
When you enter an address, your hosts file is looked up first, and only then the DNS server is contacted. Unlike DNS, the hosts file can be edited directly.
I believe that now you understand the importance of the hosts file and understand why most malware seeks to gain access to it.
Using the hosts file
By managing the hosts file, you can speed up access to some sites or, conversely, restrict access to them. You can organize a redirect from one page to another site. For example, when accessing some prohibited resources, a redirect to the website of the Ministry of Internal Affairs will occur.
But the biggest danger is malware. software, which, having gained access to the hosts file, will use it for its malicious purposes. For example, block access to websites, social networks, or websites of antivirus software companies.
Where is the hosts file located?
As a rule, if it is an operating Windows system(NT, 2000, XP, 2003, Vista, 7, 8), the hosts file is located in the system partition on drive C. The full address looks like this: C:\Windows\System32\drivers\etc\hosts.
There are more fast way get to the host file. To do this, press the key combination: Win + R or "Start" → "Run". A command window will open. We enter the following command:
- notepad %windir%\system32\drivers\etc\hosts
And here is the host file itself, which by default looks like this:
If there is no hosts file in this folder, then most likely the virus has changed its location in the registry key. Below is the registry key, which specifies the path to the folder with the host file:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Tcpip\Parameters \DataBasePathIn addition, the hosts file can be hidden. In this case, go to "Folder Options" → "View" and set the value to "Show hidden folders files and disks.
How to edit the hosts file?
The hosts file can be edited with any text editor. For example, in a standard Windows notepad.
Let's look at the editing options and for starters block access to the sites mentioned above: vk.com and ok.ru.
The site or sites to which you want to block access are written on a new line, first the local IP address is indicated at the beginning of the line - 127.0.0.1 .
In our case, the entry looks like this:
127.0.0.1 vk.com
127.0.0.1 ok.ru
We save the changes. Now we open the browser and try to go to vk.com or ok.ru. As you can see, the hosts file did its job, and the attempt to connect to these sites failed.
You can also redirect(make a redirect) to another site. To do this, you need to know the IP address of the site where the redirect will be made, and next to it, with a space, indicate the domain from which the redirect is being made.
The example below shows that at first I registered the IP address of the site yandex.ru (213.180.204.3), and after a space I indicated the vk.com domain.
This means that when you try to access the vk.com website, you will be redirected to yandex.ru (213.180.204.3).
To speed up the loading of the site, you need to know its IP address and domain. This data is written in the hosts file.
It would seem that everything is simple: you need to register the necessary changes in the hosts file and click "Save". But the system swears and does not allow you to save the desired changes. More precisely, it offers to save to a separate text file.
This is due to the tightening of security rules in the latest OS versions, and this makes sense, since many viruses try to write their lines here. In this case, changes are made by us, and this is done purposefully.
You need to do the following. Return to the location of the hosts file and right-click to call up the context menu, where select "Properties".
Go to the "Security" tab and select the user under whose name you work.
Agree with the security downgrade warning. Go back and save changes.
There is an easier way to edit the hosts file - using command line. You can read.
To restore the default hosts file settings, simply copy and paste the following text:
# Copyright (c) 1993-2009 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
#space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host127.0.0.1 localhost
It's so easy and simple by editing the hosts file, you can block access to sites or redirect. That's all for today.
In the next article, I will explain how to edit the hosts file if the Windows system is locked. In addition, I will answer popular questions: "Why can't I go to Odnoklassniki?", "Why can't I go to VKontakte, mail and other sites?". Subscribe and do not miss the release of this article (the article has already been published, you can read it).
