HOSTS file not working

[Kyle Herrmann]

I have several users whose HOSTS file seems to be ignored when they change
it. Any entry they add is like it isn't even there.

I have run AdAware and HiJackThis on it, but discovered nothing besides the
Alexa spyware.

Anyone have any ideas besides spyware as to why the HOSTS file would be
ignored?

Thanks for any suggestions.

[Chuck]

On Fri, 5 Nov 2004 08:04:03 -0800, "Kyle Herrmann" <*email_address_deleted*>
wrote:

>I have several users whose HOSTS file seems to be ignored when they change
>it. Any entry they add is like it isn't even there.
>
>I have run AdAware and HiJackThis on it, but discovered nothing besides the
>Alexa spyware.
>
>Anyone have any ideas besides spyware as to why the HOSTS file would be
>ignored?
>
>Thanks for any suggestions.

Kyle,

Spyware would be my guess too. Remember HijackThis is pretty useless without
expert interpretation. Did you post your HJT log somewhere? Can you provide a
link to your post(s)?

The location of the hosts files isn't magical - and some spyware can hijack it
by changing the location. This article tells how to find the hosts file on your
system, using the registry entry:
http://support.microsoft.com/?id=314053

You'll be looking at registry key
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\Tcpip\Parameters]
value DataBasePath.

Kyle, please don't contribute to the spread and success of email address mining
viruses. Posting your email address openly will get you more unwanted email,
than wanted email. Learn to munge your email address properly, to keep yourself
a bit safer when posting to open forums. Protect yourself and the rest of the
internet - read this article.
http://www.mailmsg.com/SPAM_munging.htm

Cheers,
Chuck
Paranoia comes from experience - and is not necessarily a bad thing.

[Kyle Herrmann]

Thanks for the info.

I had checked the registry setting and it was setup correctly. Could they
edit the registry in another location to override the proper registry entry?

I haven't posted the Hijack this log, but I will when I get a chance to look
at the machine again.

Of course, if anyone has any other ideas, I would love to hear them.

Thanks Chuck.

"Chuck" > wrote in message
...
> On Fri, 5 Nov 2004 08:04:03 -0800, "Kyle Herrmann"
<*email_address_deleted*>
> wrote:
>
> >I have several users whose HOSTS file seems to be ignored when they
change
> >it. Any entry they add is like it isn't even there.
> >
> >I have run AdAware and HiJackThis on it, but discovered nothing besides
the
> >Alexa spyware.
> >
> >Anyone have any ideas besides spyware as to why the HOSTS file would be
> >ignored?
> >
> >Thanks for any suggestions.
>
> Kyle,
>
> Spyware would be my guess too. Remember HijackThis is pretty useless
without
> expert interpretation. Did you post your HJT log somewhere? Can you
provide a
> link to your post(s)?
>
> The location of the hosts files isn't magical - and some spyware can
hijack it
> by changing the location. This article tells how to find the hosts file
on your
> system, using the registry entry:
> http://support.microsoft.com/?id=314053
>
> You'll be looking at registry key
> [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\Tcpip\Parameters]
> value DataBasePath.
>
> Kyle, please don't contribute to the spread and success of email address
mining
> viruses. Posting your email address openly will get you more unwanted
email,
> than wanted email. Learn to munge your email address properly, to keep
yourself
> a bit safer when posting to open forums. Protect yourself and the rest of
the
> internet - read this article.
> http://www.mailmsg.com/SPAM_munging.htm
>
> Cheers,
> Chuck
> Paranoia comes from experience - and is not necessarily a bad thing.

[Hans-Georg Michna]

On Fri, 5 Nov 2004 09:44:58 -0800, "Kyle Herrmann"
> wrote:

>Of course, if anyone has any other ideas, I would love to hear them.

Kyle,

before looking into details, first make sure you're actually
looking at the HOSTS file, not at HOSTS.SAM. The latter is only
a sample file which has no effect.

Hans-Georg

--
No mail, please.

[Chuck]

On Fri, 5 Nov 2004 09:44:58 -0800, "Kyle Herrmann" > wrote:

>Thanks for the info.
>
>I had checked the registry setting and it was setup correctly. Could they
>edit the registry in another location to override the proper registry entry?
>
>I haven't posted the Hijack this log, but I will when I get a chance to look
>at the machine again.
>
>Of course, if anyone has any other ideas, I would love to hear them.
>
>Thanks Chuck.

Kyle,

DNS resolution is affected by the LSP / Winsock subsystem.
http://support.microsoft.com/?id=318584
http://support.microsoft.com/?id=811259

Give LSP-Fix and WinsockXPFix <http://www.cexx.org/lspfix.htm>, or WinsockFix
<http://www.tacktech.com/display.cfm?ttid=257> a shot.

If XP SP2, Start - Run - "cmd". Type "netsh winsock reset catalog" into the
command window.

If no help yet, reset TCP/IP.
http://support.microsoft.com/?id=299357

Start - Run - "cmd". Type "netsh int ip reset c:\netsh.txt" into the command
window.

Cheers,
Chuck
Paranoia comes from experience - and is not necessarily a bad thing.

[James Egan]

On Fri, 5 Nov 2004 08:04:03 -0800, "Kyle Herrmann"
> wrote:

>Anyone have any ideas besides spyware as to why the HOSTS file would be
>ignored?

If you're testing it using a web browser, make sure the local browser
cache is cleared.


Jim.

[Jack]

Hi
This page has some info about the Host file.
Read it may be a Bell will Strike: http://www.ezlan.net/host.htm
Jack (MVP-Networking).



"James Egan" > wrote in message
...
> On Fri, 5 Nov 2004 08:04:03 -0800, "Kyle Herrmann"
> > wrote:
>
> >Anyone have any ideas besides spyware as to why the HOSTS file would be
> >ignored?
>
> If you're testing it using a web browser, make sure the local browser
> cache is cleared.
>
>
> Jim.
>