The hosts file is responsible for establishing a correspondence between the domain and the site's IP address. Contacting the host has priority over sending a request to the DNS server, and the file is stored on the computer and controlled by the administrator, which makes it an important element of security Windows operation. In some cases, users are faced with the need to restore the hosts file to original state. You can delete unnecessary entries from it in two ways: manually and automatically, using special software.
Manual recovery
Typically, restoration of the hosts file is required after malicious applications add new entries to it. A typical attack looks like this: you open Odnoklassniki or VKontakte, and the site reports that your account is blocked and asks you to send an SMS to confirm your login. As a result, money is withdrawn from the phone, and you later find out that instead of VKontakte hosts file redirected you to a fake page.
But the host has nothing to do with it: it only turned out to be a tool in the hands of a malicious software. Therefore, after cleaning Windows antivirus you need to start restoring hosts.
Another option is to go to C:\Windows\System32\drivers\et and simply open hosts via Notepad. Inside you will see a lot of text on English language. You need to make sure there are no extra entries in the host. By default, the text should end with the line "# ::1 localhost". Everything after it should be deleted, especially if you yourself did not enter anything into the file.
However, this cleaning may not be complete, so we strongly recommend that you match the contents of your host with the information provided on the support page at https://support.microsoft.com/ru-ru/kb/972034. On Windows 7, the contents of hosts should look like this:
To make sure there are no extra entries, delete the old host and create a new file:
Now the old host will not function, and there will definitely be nothing unnecessary inside the new one, so you don’t have to worry about the safety of your money and personal data.
Automatic recovery
If manual recovery seems complicated, you can fix the host using special utilities. For example, technical support Microsoft, in an article about fixing the hosts file on different versions of Windows, suggests downloading Fix utility It, after launching which unnecessary entries will be deleted without user intervention. 
Another way is to use the AVZ antivirus program. This powerful tool research and Windows recovery, but we will consider only one of its functions - clearing the hosts file.
After entering the required site in the browser, suppose Google.com , the browser sequentially (according to priority) looks for a match between this domain name and the IP addressee (because it is IP addresses that network devices work with).
A) the specified site is checked in the hosts file, if it finds a match (let’s assume 1.1.1.1 Google.com is written in the hosts file), then the contents of IP - 1.1.1.1 will open for you, if there is no specified domain name, proceed to the next step;
b) the cache DNS is checked (if you have previously opened Google.com, then most likely the IP of this site is saved in the DNS cache of your computer/laptop), if the IP of the site is indicated there, then the page opens to you, if not, it proceeds to the last stage;
V) the request goes to the DNS server (it is registered manually in the settings network connection or issued via DHCP), if the DNS server does not have the specified site, it will “ask” another DNS server until it finds it (if, of course, it exists at all) and the site opens successfully.
The hosts file is located at C:\Windows\System32\Drivers\etc\hosts (if C- system disk). You can open it with a regular notepad. If you have not made changes to the hosts file, then the following will be written there:
|
Hosts file in Windows XP: 127.0.0.1 localhost |
Hosts file inWindows Vista:
127.0.0.1 localhost |
|
Hosts file in Windows 7: # 38.25.63.10 x.acme.com # x client host # localhost name resolution is handled within DNS itself. |
Hosts file in Windows 8 # Copyright (c) 1993-2009 Microsoft Corp. # localhost name resolution is handled within DNS itself. |
As you can see, regardless of the version, the host file is not very different, but if a virus “worked” on the hosts file, various sites and IPs can be added there. For example:
127.0.0.1 ftp.kasperskylab.ru
127.0.0.1 ids.kaspersky-labs.com
127.0.0.1 vk.com
127.0.0.1 drweb.com
Such additions to the file prevent you from accessing the specified sites.
1.2.3.4 ftp.kasperskylab.ru
1.2.3.4 ids.kaspersky-labs.com
1.2.3.4 vk.com
1.2.3.4 drweb.com
Such additions in the file when opening the specified sites will redirect you to other sites, possibly infected with viruses (IP-1.2.3.4- are fictitious).
If you find that the hosts file has been changed, it needs to be corrected. In Windows XP, the file is simply opened in Notepad, the necessary changes are made and saved (you must log in as an administrator). On other versions (Windows Vista, 7, 8), you must give permission to change the file. To do this, open the folder in which hosts is located C:\Windows\System32\Drivers\etc(if drive C is system). Click right click mouse on hosts and choose "Properties".
Select a tab "Safety", then select the user under which you work on your computer/laptop (in this example, this is a website) and press the button "Change". A window will open "Permissions for the group "hosts"", select the user again and assign full rights to the file, click "OK", in the window "Properties: hosts", Same "OK".
After that, open hosts with Notepad and return the file to its original state, and save the changes when finished.
Restoring the default hosts file in Windows 7
File hosts establishes a correspondence between the IP server and the site domain. A request to this file takes precedence over calls to DNS servers. Unlike DNS, the contents of the file are controlled by the computer administrator.
To date a large number of malware is using the file hosts to block access to websites of popular portals or social networks. Often, instead of blocking sites malware redirect the user to pages that look similar to popular resources (social networks, postal services etc.), where an inattentive user enters credentials, which thus get to the attackers. It is also possible to block access to the websites of antivirus software companies.
Default file host located here C:\Windows\System32\drivers\etc The file has no extension, but can be opened with Notepad. To change the contents of a file in Notepad, you must have administrator rights.
To view the file host open the menu Start, select item Execute, enter the command
and press the buttonOK.This is what the file should look like host default.
If the file contains entries like 127.0.0.1 odnoklassniki.ru127.0.0.1 vkontakte.ru or the addresses of your sites that you cannot access, then first check your computer for “malware”, and then restore the file host
Restoring the contents of the hosts file to default
- Open menu Start, select item Execute, enter the command %systemroot%\system32\drivers\etc and press the button OK.
- Rename the hosts file to hosts.old.
- Create a new file hosts default. To do this, follow the steps below.
- Right click in free space in folder %WinDir%\system32\drivers\etc, select item Create, click the element Text Document, Enter your name hosts and press the key ENTER.
- Click the button Yes to confirm that the filename will not have the extension TXT.
- Open a new file hosts in a text editor. For example, open the file in " Notebook".
- Copy the text below into a file.
# Copyright (c) 1993-2009 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
#space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a "#" symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host
What is the Hosts file for?
The purpose of this system file- assigning certain website addresses a specific IP.
This file is very popular with all kinds of viruses and malware in order to write their data into it or simply replace it.
The result of these actions may be signs of “insertion” of a site into browsers, which will ask to send an SMS when opening the browser, or blocking of various sites, at the discretion of the creators of the virus.
Where is the hosts file in windows?
For different versions Windows OS location of the hosts file is slightly different:
Windows 95/98/ME: WINDOWS\hosts
Windows NT/2000: WINNT\system32\drivers\etc\hosts
Windows XP/2003/Vista/Seven(7)/8: WINDOWS\system32\drivers\etc\hosts
Moreover, the ending hosts, this is already the final file, not a folder. He doesn't have it.
What should the correct hosts file look like?
The "contents" of the hosts file are also slightly different for different windows versions, but not really. It “writes” in English why it is needed and how to make exceptions, giving one example. All lines starting with a # sign mean that they are commented out and do not affect the file.
Content original file hosts for Windows XP:
#
#
#space.
#
#
# For example:
#
127.0.0.1 localhost
Contents of the original hosts file for Windows Vista:
# Copyright (c) 1993-2006 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
#space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a "#" symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host
127.0.0.1 localhost::1 localhost
Contents of the original hosts file for Windows 7:
# Copyright (c) 1993-2009 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
#space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a "#" symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host
# localhost name resolution is handle within DNS itself.
# 127.0.0.1 localhost
# ::1 localhost
Contents of the original hosts file for Windows 8:
# Copyright (c) 1993-2009 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
#space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a "#" symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host
# localhost name resolution is handled within DNS itself.
# 127.0.0.1 localhost
# ::1 localhost
As you can see, the contents of the host file for different versions Windows, there are no special differences.
How to open and edit the hosts file?
The hosts file can be found in standard Windows Notepad.
This is probably the most interesting part of the article.
First of all, you need to understand why change this file at all? Yes, in order to deny access to certain sites. Thus, by changing this file and having entered the site address into it, the user will not be able to access it through any .
In order to change the hosts file, it is advisable to open it as administrator () by right-clicking on the file and selecting "Run as administrator". Or open Notepad this way and open the file in it.
For quick action, you can simply click the Start button and select Run ( win+r) () and enter in the line:
notepad %windir%\system32\drivers\etc\hosts
As a result, this file will open in Notepad.
In order to block access to the site(let's assume it will be test.ru), you just need to add a line with this site at the very bottom:
127.0.0.1 test.ru
As a result, the file will have the following content:
# Copyright (c) 1993-1999 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
#space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a "#" symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host
# This HOSTS file created by Dr.Web Anti-rootkit API
# 127.0.0.1 localhost
# ::1 localhost
127.0.0.1 test.ru
Each new site that you want to block must be started on a new line and entered, not forgetting the local IP address 127.0.0.1
Also, to edit the hosts file, there is a program HOSTS EDITOR, which you can download and read the description from.
The way it works is that it helps edit the hosts file.
From the screenshot below the principle of its operation is clear; everything is done in a couple of clicks. Adding is done by clicking on +.
After editing, do not forget to click on the save button (2 button "Save changes" to the left of the "+" button).
You can also change this file for good purposes, for example speed up site loading.
How it works?
When you access the site, you see it Domain name, which has letters. But all sites on the Internet have an IP address, and names are already assigned using DNS. I won’t go into details of this process; that’s not what the article is about. But here you need to know that the hosts file has priority when accessing sites, and only after it does a request to DNS occur.
In order to speed up the loading of a site, you need to know its IP address and domain.
The IP address of the site can be found using various services, for example or .
A domain is the name of a website.
For example, let's speed up the loading of this site where you are reading an article by explicitly specifying the IP address and domain to the file.
Then the added line will be:
91.218.228.14 website
This speeds up page loading in a couple of seconds, and sometimes can give access if standard means You cannot access the site.
Still possible redirect to another site using hosts file.
To do this, you need to know the IP address of the site and its domain (as in the case described above), then the added line will be like this:
91.218.228.14 test.ru
And now, after entering address bar browser of the site test.ru, you will be redirected to the site specified in the IP address..
If you want to clean hosts file, then you can do this by simply deleting the content and inserting the original text from the description above (under spoilers).
Some nuances in the hosts file:
This way you can easily and free of charge block access to sites in Windows by editing the hosts file.
Many ordinary and slightly advanced computer users have been using them for many years and were not aware of the existence of a file named hosts, which does not have a surname (i.e. extension).
But thanks to viruses and imperfections operating systems family of Windows (Windows), users had to get to know this “host”, and quite closely.
What is the hosts file for?
In the Windows operating system (XP, Vista, 7, etc.) the file hosts used to associate (map) host names (nodes, servers, domains) with their IP addresses (name resolution).File hosts- it's simple text file, which does not have any extension (it doesn’t even have a dot :)).
File hosts physically located in the directory:
- \Windows\System32\drivers\etc\- for Windows 2000/NT/XP/Vista\7
- \Windows\- For old Windows 95/98/ME
Most often this directory is located on drive C, so in this case the full path to the file is obtained hosts represents:
By default, only one IP address should be specified in a normal hosts file, this is - 127.0.0.1 . This IP is reserved for localhost, that is, for your local PC. There shouldn't be any other addresses there!
File contents hosts for Windows XP (Russian OS version):
In text form, the contents of the hosts file for Windows XP can be copied from here:
# (C) Microsoft Corp., 1993-1999
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains mappings of IP addresses to hostnames.
# Each element must be on a separate line. The IP address must
# should be in the first column and must be followed by the appropriate name.
# The IP address and hostname must be separated by at least one space.
#
# Additionally, some lines may contain comments
# (such as this line), they must follow the node name and be separated
# from it with the symbol "#".
#
# For example:
#
# 102.54.94.97 rhino.acme.com # origin server
# 38.25.63.10 x.acme.com # client node x127.0.0.1 localhost
File contents hosts for Windows Vista (English OS version):
In text form, the contents of the hosts file for Windows Vista can be copied from here:
# Copyright (c) 1993-2006 Microsoft Corp.
#
#
#space.
#
#
# For example:
#
127.0.0.1 localhost
::1 localhost
File contents hosts for Windows 7 (English version of OS):
In text form, the contents of the hosts file for Windows 7 can be copied from here:
# Copyright (c) 1993-2009 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
#space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a "#" symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host# localhost name resolution is handled within DNS itself.
# 127.0.0.1 localhost
# ::1 localhost
Using the hosts file
File hosts theoretically can be used to speed up the Internet and reduce the amount of traffic. This is achieved by reducing requests to the DNS server for resources frequently visited by the user. For example, if you use every day search engines Yandex and Google (sites http://yandex.ru And http://google.ru respectively), then it makes sense in the file hosts after the line " 127.0.0.1 localhost" write the following lines:
93.158.134.11 yandex.ru
209.85.229.104 google.ru
This will prevent your Internet browser from having to access DNS server, and immediately establish a connection to sites yandex.ru And google.ru. Of course, few people do such tricks nowadays, if only for good reasons. modern speeds access.
Restrictions using the hosts file
Some advanced comrades sometimes use the hosts file to block unwanted web resources (for example, erotic content - for children until they grow up and become computer smarter than you). To do this you need after the line 127.0.0.1 localhost also add the bnm line or several lines:
127.0.0.1 address of blocked resource-1
127.0.0.1 addressblocked resource-2
127.0.0.1 addressblocked resource-3
For example:
The essence of this entry is that the specified blocked resource will now be matched by the browser to the IP address 127.0.0.1 , which is the address local computer, – accordingly, the forbidden site simply will not load.
This function is often used computer viruses, which add the browser redirects needed by attackers to the hosts file:
Most often, redirection is done to a “left” site, which visually does not differ from the real resource, while the user’s login and password are stolen (he enters them into the supposedly real fields of the site) or they simply write that your account is blocked (allegedly for spam, etc. ), pay money or send SMS (also very expensive) to unlock. Simultaneously with redirecting to their website from social networking sites, attackers block using a file hosts access to antivirus program sites.
Attention! Never pay for this! And don't send SMS!
A cell phone can only be used as a means of obtaining a password or unlock code. Those. messages should come to you, not come from you.
Although, if you don’t mind the money, check with your first mobile operator the cost of sending SMS to this number in order to definitely decide that you really don’t mind just giving this amount to someone.
How to edit the hosts file
- Each element must be written on its own (separate) line.
- The IP address of the site must begin at the first position of the line, followed (in the same line) by a space and followed by the corresponding host name.
- The IP address and hostname must be separated by at least one space.
- The comment line must begin with the # symbol.
- If comments are used in domain name matching strings, they must follow the host name and are also separated by # .
Viruses and hosts file
To prevent their actions from being immediately detected, attackers edit the file hosts in a cunning way. Several options are possible:
1. To the end of the file hosts is added VERY there are many lines (several thousand), and the redirection addresses (most often located at the end) are difficult to notice, especially if you view the contents of the file hosts using the built-in Windows notepad - a very poor editor.
To view the contents and edit the file hosts best to use text editor, which shows the number of lines in a document, for example Notepad++.
You should also be alarmed by the rather large size of the hosts file, of course normal condition it cannot be larger than a few kilobytes!
2. The original hosts file is edited, after which it is assigned the attribute " Hidden" or " System", because by default hidden files and folders are not displayed on Windows operating systems. In folder C:\WINDOWS\system32\drivers\etc file is created hosts.txt(by default, extensions are not displayed for registered file types, and the system does not accept the file hosts.txt, she only needs hosts), which is either completely empty, or everything is written as it should be in a real file hosts.
3. Similar to the second option, only here the attackers have already provided the option that extensions for registered file types are displayed in the operating system (the user enabled it independently). Therefore, instead of the file hosts.txt the virus creates a file hosts, which has the letter " O"Russian, not English. Visually the file looks like a real one, but is also not perceived by the system.
In this picture the first file hosts- hidden, the virus made changes to it. Second file hosts- not real, it contains the Russian letter " O" in the name, most often this file hosts empty, viruses do not bother to copy the contents from the real file.
Restoring the hosts file
If you have identified similar changes to your file host, everything needs to be restored to its original state. To do this you need to do the following:
- Disable real-time protection for your antivirus program, because many normal modern antivirus programs (for example, Avira) do not allow changes to the file hosts.
- Open directory C:\WINDOWS\system32\drivers\etc
- Enable the display of extensions for registered file types, hidden files, and system files.
- Click on the file hosts right click and select in context menu line " Edit with Notepad++":
If you don't have it installed text editor program Notepad++, I recommend installing it first and not using Notepad. If you don't have this moment Internet or just too lazy to download Notepad++, then you can use the poor notepad to edit the file hosts.
To open a file hosts with notepad, you need to left-click on it, it will appear Windows window with the message " The following file could not be opened..." Set the switch to " Selecting a program from the list manually". Click OK. In the window " Program selection" find in the list Notebook and press OK.
- Edit the contents of the hosts file so that it becomes as indicated at the beginning of this article.
- Save changes.
- Activate antivirus program protection (if disabled).
- Launch your browser and check that you can view the desired sites.
How the hosts file works
When a user types the address (URL) of a site in the browser and presses Enter, the user's browser:
- Checks in the hosts file whether the entered name is the computer's own name (localhost).
- If not, then the browser looks for the requested address (hostname) in the hosts file.
- If a hostname is found, the browser accesses the IP address specified in the hosts file corresponding to that host.
- If the hostname is not found in the hosts file, then the browser accesses the DNS resolver cache (DNS cache).
- If a hostname is found in the cache, the browser looks up the IP address stored in the DNS cache for that host;
- If the hostname is not found in the DNS resolver cache, the browser contacts the DNS server;
- If the requested web page (site) exists, the DNS server translates the user-specified URL into an IP address;
- The web browser downloads the requested resource.