Can't delete corrupt C:\WINDOWS\system32\drivers\etc\hosts file

i did this and no change - still locked

"John John - MVP" wrote:

neil wrote:
OS XP... I had a virus that redirected yahoo, Google, etc to another web
site. Ran a scan and eliminated the virus. The
C:\WINDOWS\system32\drivers\etc\hosts file was not visible when opening the
etc folder. I tried to create a new hosts file and was stopped by an error
that said the file already existed. I opened the etc\hosts file in the dos
window and listed its contents. It was filled with yahoo / Google redirects.
I tried to delete it with the dos command and was stopped by an error that
said I didn't have permission... I was logged on as an administrator.

Question should I boot up in protected mode and try to delete? If that
doesn't work should I go into the registry????

This has nothing to do with the registry. Your permissions on the file
have simply been revoked or you have been explicitly denied permission
to the file.

Try granting yourself full control on the file. At the command prompt
issue these commands and see if things change:

cacls C:\WINDOWS\system32\drivers\etc\hosts /E /G Administrators:F
cacls C:\WINDOWS\system32\drivers\etc\hosts /E /G "Your User Name":F

If you have spaces in your user name you must use the "quotation marks"

John


.

Perhaps you still have a virus or perhaps your AV software has a lock on
the file. Try while booted to Safe Mode. If that fails try deleting it
from the Recovery Console or try with a utility like Unlocker.

John

On 8/10/2010 4:50 AM, rachid wrote:
i did this and no change - still locked

"John John - MVP" wrote:

neil wrote:
OS XP... I had a virus that redirected yahoo, Google, etc to another web
site. Ran a scan and eliminated the virus. The
C:\WINDOWS\system32\drivers\etc\hosts file was not visible when opening the
etc folder. I tried to create a new hosts file and was stopped by an error
that said the file already existed. I opened the etc\hosts file in the dos
window and listed its contents. It was filled with yahoo / Google redirects.
I tried to delete it with the dos command and was stopped by an error that
said I didn't have permission... I was logged on as an administrator.

Question should I boot up in protected mode and try to delete? If that
doesn't work should I go into the registry????

This has nothing to do with the registry. Your permissions on the file
have simply been revoked or you have been explicitly denied permission
to the file.

Try granting yourself full control on the file. At the command prompt
issue these commands and see if things change:

cacls C:\WINDOWS\system32\drivers\etc\hosts /E /G Administrators:F
cacls C:\WINDOWS\system32\drivers\etc\hosts /E /G "Your User Name":F

If you have spaces in your user name you must use the "quotation marks"

John


.

Perhaps you still have a virus or perhaps your AV software has a lock on
the file. Try while booted to Safe Mode. If that fails try deleting it
from the Recovery Console or try with a utility like Unlocker.

John

On 8/10/2010 4:50 AM, rachid wrote:
i did this and no change - still locked

"John John - MVP" wrote:

neil wrote:
OS XP... I had a virus that redirected yahoo, Google, etc to another web
site. Ran a scan and eliminated the virus. The
C:\WINDOWS\system32\drivers\etc\hosts file was not visible when opening the
etc folder. I tried to create a new hosts file and was stopped by an error
that said the file already existed. I opened the etc\hosts file in the dos
window and listed its contents. It was filled with yahoo / Google redirects.
I tried to delete it with the dos command and was stopped by an error that
said I didn't have permission... I was logged on as an administrator.

Question should I boot up in protected mode and try to delete? If that
doesn't work should I go into the registry????

This has nothing to do with the registry. Your permissions on the file
have simply been revoked or you have been explicitly denied permission
to the file.

Try granting yourself full control on the file. At the command prompt
issue these commands and see if things change:

cacls C:\WINDOWS\system32\drivers\etc\hosts /E /G Administrators:F
cacls C:\WINDOWS\system32\drivers\etc\hosts /E /G "Your User Name":F

If you have spaces in your user name you must use the "quotation marks"

John


.

rachid wrote:

i did this and no change - still locked
snipped rachid's attempt to hijack neil's 8-MONTH OLD thread

So neil has become rachid. Uh huh. Start your own thread on your own
problem. You don't know if your host's setup is the same as neil's. He
and you may be using different security software that protects against
changes to the hosts file. Describe YOUR setup and YOUR actions.


--- Posting Hints ---

ALWAYS REVIEW your message before submitting it. You want someone OTHER
than yourself to understand your post. Also remember that no one here
is looking over your shoulder to see at what you are pointing. If you
don't well explain your situation by providing the DETAILS that you
already know, don't expect others to know what is your situation.
Explain YOUR computing environment and just what actions you take to
reproduce the problem.

Often you get just one chance per potential respondent to elicit a reply
from them. If they skip your post because you gave them nothing to go
on (no details, no versions, no OS, no context) then they will usually
move on to the next post and never return to yours.

What is Usenet:
http://en.wikipedia.org/wiki/Usenet
http://en.wikipedia.org/wiki/Newsgroups
http://www.masonicinfo.com/newsgroups.htm
http://www.mcfedries.com/Ramblings/usenet-primer.asp

When using a webnews-for-dummies interface (e.g., Microsoft's
Communities, Google Groups, or a leech site using a forum-to-Usenet
proxy), those are gateways to Usenet. Despite the pretense of a forum,
you are participating in a newsgroup (aka Usenet).

Note: Microsoft is dropping their "Communities" webnews-for-dummies
interface that gateways to Usenet. Microsoft is leaving Usenet.
Microsoft is not Usenet. To continue accessing the microsoft.public.*
newsgroups, you will need to connect a newsreader to a non-Microsoft
NNTP server or suffer with Microsoft's inane web-based forums.

How to post to newsgroups:
http://66.39.69.143/goodpost.htm
http://support.microsoft.com/kb/555375
http://users.tpg.com.au/bzyhjr/liszt.html
http://www.mugsy.org/asa_faq/getting_along/usenet.shtml

Regarding error or status messages:
- Do NOT omit the message.
- Do NOT describe the message.
- Do NOT summarize the message.
- Do NOT paraphrase the message.
- Do NOT truncate the message.
- Do show the ENTIRE message (but munge or star out personal info,
like your username in an e-mail address but not the domain).
And DETAIL the steps to reproduce the error or problem.

Bye.

rachid wrote:

i did this and no change - still locked
snipped rachid's attempt to hijack neil's 8-MONTH OLD thread

So neil has become rachid. Uh huh. Start your own thread on your own
problem. You don't know if your host's setup is the same as neil's. He
and you may be using different security software that protects against
changes to the hosts file. Describe YOUR setup and YOUR actions.


--- Posting Hints ---

ALWAYS REVIEW your message before submitting it. You want someone OTHER
than yourself to understand your post. Also remember that no one here
is looking over your shoulder to see at what you are pointing. If you
don't well explain your situation by providing the DETAILS that you
already know, don't expect others to know what is your situation.
Explain YOUR computing environment and just what actions you take to
reproduce the problem.

Often you get just one chance per potential respondent to elicit a reply
from them. If they skip your post because you gave them nothing to go
on (no details, no versions, no OS, no context) then they will usually
move on to the next post and never return to yours.

What is Usenet:
http://en.wikipedia.org/wiki/Usenet
http://en.wikipedia.org/wiki/Newsgroups
http://www.masonicinfo.com/newsgroups.htm
http://www.mcfedries.com/Ramblings/usenet-primer.asp

When using a webnews-for-dummies interface (e.g., Microsoft's
Communities, Google Groups, or a leech site using a forum-to-Usenet
proxy), those are gateways to Usenet. Despite the pretense of a forum,
you are participating in a newsgroup (aka Usenet).

Note: Microsoft is dropping their "Communities" webnews-for-dummies
interface that gateways to Usenet. Microsoft is leaving Usenet.
Microsoft is not Usenet. To continue accessing the microsoft.public.*
newsgroups, you will need to connect a newsreader to a non-Microsoft
NNTP server or suffer with Microsoft's inane web-based forums.

How to post to newsgroups:
http://66.39.69.143/goodpost.htm
http://support.microsoft.com/kb/555375
http://users.tpg.com.au/bzyhjr/liszt.html
http://www.mugsy.org/asa_faq/getting_along/usenet.shtml

Regarding error or status messages:
- Do NOT omit the message.
- Do NOT describe the message.
- Do NOT summarize the message.
- Do NOT paraphrase the message.
- Do NOT truncate the message.
- Do show the ENTIRE message (but munge or star out personal info,
like your username in an e-mail address but not the domain).
And DETAIL the steps to reproduce the error or problem.

Bye.

I followed the instructions above, but i ended up having to remove a
fake "user" from the permissions list on the hosts file. when i right
clicked on the the hosts file, went to properties, under security.
whatever virus did it, created a user named "3-00a-v---bbasass11001" or
something to that affect. so i added the "authenticated users" group
back to the list, and removed the funky user group. This allowed me to
edit the hosts file.

I normally dont post my findings, which is kind of selfish, because it
takes to long to register, but this issue had me bugged for a very long
time. no pun intended.
Thanks everyone for your help

meboy101 wrote:
I followed the instructions above, but i ended up having to remove a
fake "user" from the permissions list on the hosts file. when i right
clicked on the the hosts file, went to properties, under security.
whatever virus did it, created a user named "3-00a-v---bbasass11001"
or something to that affect. so i added the "authenticated users"
group back to the list, and removed the funky user group. This
allowed me to edit the hosts file.

I normally dont post my findings, which is kind of selfish, because it
takes to long to register, but this issue had me bugged for a very
long time. no pun intended.
Thanks everyone for your help

Which instructions?

Above what?

What is that takes long to register?

Do you have a specific question?

http://members.shaw.ca/dts-l/goodpost.htm

--
Peter
Please Reply to Newsgroup for the benefit of others
Requests for assistance by email can not and will not be acknowledged.
This posting is provided "AS IS" with no warranties, and confers no rights.
http://www.microsoft.com/protect

Daave wrote:

meboy101 wrote:


[snip]


Thanks everyone for your help

Which instructions?

Above what?

What is that takes long to register?

Do you have a specific question?


If you missed it, 'meboy' is posting with "User-Agent: vBulletin
USENET gateway". We don't see what 'meboy' saw and 'meboy'
probably won't see us.

Questions should have been; What is Usenet? What am i doing,
posting to various web-sites each requiring their own
registration instead of using Usenet directly where at most one
registration is needed for any number of groups/topics?

Usenet via AIOE.org = no registration at all required to post.


--

On Wednesday, December 9, 2009 at 12:03:01 AM UTC+4, neil wrote:
OS XP... I had a virus that redirected yahoo, Google, etc to another web
site. Ran a scan and eliminated the virus. The
C:\WINDOWS\system32\drivers\etc\hosts file was not visible when opening the
etc folder. I tried to create a new hosts file and was stopped by an error
that said the file already existed. I opened the etc\hosts file in the dos
window and listed its contents. It was filled with yahoo / Google redirects.
I tried to delete it with the dos command and was stopped by an error that
said I didn't have permission... I was logged on as an administrator.

Question should I boot up in protected mode and try to delete? If that
doesn't work should I go into the registry????

Thanks,
Neil

Go directly to : C:\Windows\System32\drivers\etc )

On Thu, 20 Aug 2015 11:15:19 -0700 (PDT), wrote:

On Wednesday, December 9, 2009 at 12:03:01 AM UTC+4, neil wrote:
OS XP... I had a virus that redirected yahoo, Google, etc to another web
site. Ran a scan and eliminated the virus. The
C:\WINDOWS\system32\drivers\etc\hosts file was not visible when opening the
etc folder. I tried to create a new hosts file and was stopped by an error
that said the file already existed. I opened the etc\hosts file in the dos
window and listed its contents. It was filled with yahoo / Google redirects.
I tried to delete it with the dos command and was stopped by an error that
said I didn't have permission... I was logged on as an administrator.

Question should I boot up in protected mode and try to delete? If that
doesn't work should I go into the registry????

Thanks,
Neil

Go directly to : C:\Windows\System32\drivers\etc )

Create a Linux bootable flash drive. I'm sure you can delete it from
that.

wrote:
On Wednesday, December 9, 2009 at 12:03:01 AM UTC+4, neil wrote:
OS XP... I had a virus that redirected yahoo, Google, etc to another web
site. Ran a scan and eliminated the virus. The
C:\WINDOWS\system32\drivers\etc\hosts file was not visible when opening the
etc folder. I tried to create a new hosts file and was stopped by an error
that said the file already existed. I opened the etc\hosts file in the dos
window and listed its contents. It was filled with yahoo / Google redirects.
I tried to delete it with the dos command and was stopped by an error that
said I didn't have permission... I was logged on as an administrator.

Question should I boot up in protected mode and try to delete? If that
doesn't work should I go into the registry????

Thanks,
Neil

Go directly to : C:\Windows\System32\drivers\etc )

Answering a 6 year old post ? :-)