The WindowsHosts file serves to map user-friendly and familiar web site addresses (such as Google) to the actual IP addresses that are behind such names (such as 216.239.51.99). The Hosts file is sometimes used by network administrators for managing fixed networks. Unfortunately, it is also a target for viruses that want to hijack a computer's internet connectivity. Fortunately, however, if the Hosts file has been attacked and unwanted material written into it, the file can be manually cleaned.
The Hosts file is located deep in the Windows folder. It is not easy to find, but following these steps will help you locate it, inspect it and-if necessary-clean it up.
First, you need to open up the Windows text editor called Notepad. (For Windows Vista, 7 and 8, this needs to be launched with administrator privileges.) Depending on which version of Windows you have, this is done differently:
1) In Windows XP:
- Click on the Start button
- Click the Run button in the menu
- Type notepad in the box, hit the Enter key
- Click on the Start button
- Type notepad in the search box
- Right-click the Notepad program in the list
- Click Run as administrator in the drop-down menu
- Click Yes to allow the program to make changes (if this option appears on the screen)
- Click on the Start button
- Type notepad in the search box
- Right-click the Notepad program in the list
- Click Run as administrator in the drop-down menu
- Click Yes to allow the program to make changes (if this option appears on the screen)
- Open the Charms menu and click on the Search Charm
- Type “notepad” in the Apps search window
- Right-click the program Notepad that appears in the results in the upper left corner
- In the taskbar that opens at the bottom of the screen, click Run as administrator
- Click Yes to allow the program to make changes (if this option appears on the screen)
When notepad is opened up, you will see a new window for the Notepad text editor that looks like this:
To locate the Hosts file, start with a double-click on the C drive in the left panel, then the Windows folder, the System32 folder, the drivers folder, and finally the etc folder. Once the etc folder is open, click on Text documents (*.txt) and drop down to the next option which is All files (*.*). If you are in the correct folder, you will see a list of 3 to 5 files in the window, as shown below. Now, double-click the Hosts file (circled) to open it up in the text editor.
The example below is of an actual hijacked Hosts file. All the lines of text that are preceded by the # sign are legitimate (comments). All the others were inserted by a virus to steer users in various countries to the unintended IP address of 74.50.127.5 (the web site designed by the virus author) instead of Google.
To remove the intruding instructions in the host file is simply a matter of deleting the lines that are not wanted. Using Notepad, move the cursor to the area (as highlighted, above) and delete those lines, leaving the original lines in the Hosts file.
A clean Hosts file will look something like this:
When finished editing, simply save the file, reboot the computer, and try to use your browser normally. Hopefully, the experience of being steered away from desired web sites will be gone, and you will be able to browse freely.
For more assistance contact Technical Support here.
