After entering the required site in the browser, suppose Google.com , the browser sequentially (according to priority) looks for a match between this domain name and the IP addressee (because it is IP addresses that network devices work with).
A) the specified site is checked in the hosts file, if it finds a match (let’s assume 1.1.1.1 Google.com is written in the hosts file), then the contents of IP - 1.1.1.1 will be opened for you, if there is no specified domain name, proceed to the next step;
b) cache dns is checked (if you have opened Google.com before, then most likely the IP of this site is saved in DNS cache your computer/laptop), if the IP of the site is indicated there, then the page opens for you, if not, proceeds to the last stage;
V) the request goes to the DNS server (it is registered manually in the settings network connection or issued via DHCP), if the DNS server does not have the specified site, it will “ask” another DNS servers, until it is found (if, of course, it exists at all) and the site opens successfully.
The hosts file is located along the path C:\Windows\System32\Drivers\etc\hosts (if C is the system drive). You can open it with a regular notepad. If you have not made any changes to hosts file, then the following will be written there:
|
Hosts file in Windows XP: 127.0.0.1 localhost |
Hosts file inWindows Vista:
127.0.0.1 localhost |
|
Hosts file in Windows 7: # 38.25.63.10 x.acme.com # x client host # localhost name resolution is handled within DNS itself. |
Hosts file in Windows 8 # Copyright (c) 1993-2009 Microsoft Corp. # localhost name resolution is handled within DNS itself. |
As you can see, regardless of the version, the host file is not very different, but if a virus “worked” on the hosts file, various sites and IPs can be added there. For example:
127.0.0.1 ftp.kasperskylab.ru
127.0.0.1 ids.kaspersky-labs.com
127.0.0.1 vk.com
127.0.0.1 drweb.com
Such additions to the file prevent you from accessing the specified sites.
1.2.3.4 ftp.kasperskylab.ru
1.2.3.4 ids.kaspersky-labs.com
1.2.3.4 vk.com
1.2.3.4 drweb.com
Such additions in the file when opening the specified sites will redirect you to other sites, possibly infected with viruses (IP-1.2.3.4- are fictitious).
If you find that hosts file changed, it needs to be fixed. In Windows XP, the file is simply opened in Notepad, the necessary changes are made and saved (you must log in as an administrator). On other versions (Windows Vista, 7, 8), you must give permission to change the file. To do this, open the folder in which hosts is located C:\Windows\System32\Drivers\etc(if drive C is system). Click right click mouse on hosts and choose "Properties".
Select a tab "Safety", then select the user under which you work on your computer/laptop (in in this example this is the site) and click the button "Change". A window will open "Permissions for the group "hosts"", select the user again and assign full rights to the file, click "OK", in the window "Properties: hosts", Same "OK".
After that, open hosts with Notepad and return the file to original state, save the changes when finished.
Hosts - text file, responsible for blocking, redirecting and generally accessing certain Internet sites.
It is through HOSTS that scammers block access to certain sites and portals. They often redirect you to other pseudo pages (supposedly Odnoklassniki or VKontakte), where they ask you to first enter your username and password, and then an SMS. As a result, scammers have your account information plus money for SMS. Check your computer for viruses and .
Where can I find the Hosts file?
The hosts file is located at:
system drive (most often C:) / windows / system32 / drivers / etc / hosts
Also in this folder you will find files such as: lmhosts, networks, protocol, services - their presence is normal.
The hosts file has disappeared, what should I do, where should I look?
He hasn't disappeared anywhere. Most likely it is simply hidden and in order to see it, you need to enable it in the settings. To do this, click Start - Control Panel - Folder Settings - View - at the very bottom, check the box “show” hidden files, folders and drives” and click apply. Now we are looking for the file there.
What should the Hosts file look like?
Just like the picture, maybe in English. If there are additional redirects below 127.0.0.1 localhost, remove everything. Here
The hosts file is designed to match domain names (sites), which are written using symbols, and the corresponding IP addresses (for example, 145.45.32.65), which are written as four numerical values. You can open any website in your browser not only after entering its name, but also after entering the IP address of this site.
IN Windows request to the hosts file has priority over requests to DNS servers. At the same time, the contents of this file are controlled by the computer administrator himself.
Therefore, quite often malware trying to change the contents of the hosts file. Why are they doing this?
They do this to block access to popular sites, or to redirect the user to other sites. There, at best, he will be shown advertising, and at worst, a fake page of a popular resource will be opened (social network, service window email, online banking service, etc.), asking you to enter your account information to log into the fake site.
Thus, due to the user's carelessness, an attacker can gain access to the user's data and cause damage to him.
Where is the hosts file located?
The hosts file is located in the folder with the Windows operating system, usually the “C” drive on the user’s computer.
The path to the hosts file will be like this:
C:\Windows\System32\drivers\etc\hosts
You can manually go through this path, or immediately open the folder with the host file using a special command.
For quick access to the file, press the keyboard shortcut “Windows” + “R”. This will open the Run window. In the "Open" field, enter either the path to the file (see above) or one of these commands:
%systemroot%\system32\drivers\etc %WinDir%\System32\Drivers\Etc
This file has no extension, but it can be opened and edited in any text editor.
Standard contents of the hosts file
In the Windows operating system, the "hosts" file has the following standard contents:
# Copyright (c) 1993-2009 Microsoft Corp. # # This is a sample HOSTS file used by Microsoft TCP/IP for Windows. # # This file contains the mappings of IP addresses to host names. Each # entry should be kept on an individual line. The IP address should # be placed in the first column followed by the corresponding host name. # The IP address and the host name should be separated by at least one # space. # # Additionally, comments (such as these) may be inserted on individual # lines or following the machine name denoted by a "#" symbol. # # For example: # # 102.54.94.97 rhino.acme.com # source server # 38.25.63.10 x.acme.com # x client host # localhost name resolution is handled within DNS itself. # 127.0.0.1 localhost # ::1 localhost
This file is similar in content to the operating systems Windows 7, Windows 8, Windows 10.
All entries that begin with the hash character # and continue to the end of the line are largely irrelevant to Windows, since they are comments. These comments explain what the file is for.
It says here that the hosts file is designed to map IP addresses to site names. Entries in the hosts file will need to be made according to certain rules: each entry must begin with new line, first write the IP address, and then after at least one space the site name. Next, after the hash (#), you can write a comment to the entry inserted into the file.
These comments do not affect the operation of the computer in any way, you can even delete all these entries, leaving only an empty file.
You can download the standard hosts file from here to install on your computer. It can be used to replace the modified file if you don't want to edit the hosts file on your computer yourself.
What to pay attention to
If the file on your computer is no different from this one, standard file, this means that there are no problems that could arise due to the change this file There are no malware on your computer.
Pay special attention to the contents of the file, which are located after these lines:
# 127.0.0.1 localhost # ::1 localhost
Additional entries can be inserted into the host file, which are added here by some programs.
For example, in this image, you can see that the program has added some entries to the standard contents of the hosts file. Between the commented lines, additional entries were inserted to perform certain actions. This was done so that during the installation of programs on my computer, this utility would cut off unwanted software.
There may be additional lines of this type: first, “a set of numbers”, and then after a space, “site name”, added in order, for example, to disable advertising in Skype program, or block access to a site.
If you yourself have not added anything to the hosts file, and do not use the program mentioned in this article (Unchecky), then you can safely remove incomprehensible entries from the hosts file.
Why do they change the hosts file?
The hosts file is modified in order to block access to a certain resource on the Internet, or in order to redirect the user to another site.
Usually, initially malicious code is executed after launching a program downloaded from the Internet. At this point, changes are automatically made to the properties of the browser shortcut, and quite often additional lines are added to the hosts file.
To block a site (for example, the VKontakte site), lines of this type are entered:
127.0.0.1 vk.com
For some sites, two versions of the site name may be entered with “www”, or without this abbreviation.
You yourself can block unwanted sites on your computer by adding a similar entry to the host file:
127.0.0.1 site_name
In this entry, the IP address (127.0.0.1) is the network address of your computer. Next comes the name of the site that you need to block (for example, pikabu.ru).
As a result, after entering the site name, you will see a blank page from your computer, although address bar browser will display the name of this web page. This site will be blocked on your computer.
When using redirection, after entering the name of the desired site, a completely different site will be opened in the user’s browser, usually this is a web page with advertising, or a fake page of a popular resource.
To redirect to another site, entries of the following type are added to the host file:
157.15.215.69 site_name
First there is a set of numbers - the IP address (I wrote random numbers here as an example), and then, after a space, the name of the site will be written in Latin letters, for example, vk.com or ok.ru.
The way this method works is something like this: bad people deliberately create a fake (fake) website with a dedicated IP address (otherwise this method will not work). Next, an infected application gets onto the user’s computer, and after launching it, changes are made to the hosts file.
As a result, when a user types the name of a popular site in the address bar of the browser, instead of the desired site, he is redirected to a completely different site. This could be a fake social network page that is designed to steal user personal data, or a site with intrusive advertising. Very often, from such a fake site, there are redirects (redirections) to many other specially created pages with advertising.
How to edit the hosts file
You can change the contents of the host file yourself by editing it using a text editor. One of the most simple ways To be able to change the file, open the hosts file in Notepad, opening the program as administrator.
To do this, create a shortcut to the Notepad utility on the Desktop, or launch the application in standard programs, which are located in the Start menu. To start, first click on the program shortcut with the right mouse button, and then select in context menu"Run as administrator" item. After this, the Notepad text editor window will open.
C:\Windows\System32\drivers\etc
After opening the "etc" folder, you will not see the "hosts" file, since Explorer will be selected to display text files. Select the All Files setting. After this, the hosts file will be displayed in this folder. You can now open the hosts file in Notepad to edit it.
After editing is complete, changes to the hosts file. Please note that the file type when saving should be “All files”.
Conclusions of the article
If the malicious program has changed the entries in the hosts file, you can replace the modified file with a standard one, or edit the contents of this file, removing unnecessary entries from there.
How to change the hosts file (video)
Restoring the default hosts file in Windows 7
File hosts establishes a correspondence between the IP server and the site domain. A request to this file takes precedence over calls to DNS servers. Unlike DNS, the contents of the file are controlled by the computer administrator.
Today, a large number of malware use the file hosts to block access to websites of popular portals or social networks. Often, instead of blocking sites, malware redirects the user to pages that look similar to popular resources ( social media, postal services etc.), where an inattentive user enters credentials, which thus fall to the attackers. It is also possible to block access to the websites of antivirus software companies.
Default file host located here C:\Windows\System32\drivers\etc The file has no extension, but can be opened with Notepad. To change the contents of a file in Notepad, you must have administrator rights.
To view the file host open the menu Start, select item Execute, enter the command
and press the buttonOK.This is what the file should look like host default.
If the file contains entries like 127.0.0.1 odnoklassniki.ru127.0.0.1 vkontakte.ru or the addresses of your sites that you cannot access, then first check your computer for “malware”, and then restore the file host
Restoring the contents of the hosts file to default
- Open menu Start, select item Execute, enter the command %systemroot%\system32\drivers\etc and press the button OK.
- Rename the hosts file to hosts.old.
- Create a new file hosts default. To do this, follow the steps below.
- Right click in free space in a folder %WinDir%\system32\drivers\etc, select item Create, click the element Text document, enter name hosts and press the key ENTER.
- Click the button Yes to confirm that the filename will not have the extension TXT.
- Open a new file hosts in a text editor. For example, open the file in " Notebook".
- Copy the text below into a file.
# Copyright (c) 1993-2009 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
#space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a "#" symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host
