Clean Windows Hosts File

All Windows installation consists of a single file to manually map IP addresses to host names. This Windows Hosts file is loaded each time Windows start. By default, Windows hosts file contains only one mapping and that is the localhost. Any address mapped to 127.0.0.1 will redirect connection back to your local machine. This is useful for blocking unwanted services from reaching the Internet. Editing the HOSTS file will provide positive results for user, but it is relatively damaging when Trojan alters it for malicious purpose.

Most of the time, malware modifies Windows hosts file to prevent users from gaining access to Security related websites. It is also on this file that Trojan can successfully redirect Internet browser’s request to unwanted locations.

Below is a guide to clean your Windows Hosts File.

How to Edit Windows Hosts File

1. Navigate to the following location for file location:

Windows 95/98/Me:
C:\Windows\hosts

Windows NT/2000/XP:
C:\Winnt\System32\drivers\etc\hosts

Windows Vista and Windows 7:
C:\Winnt\System32\drivers\etc\hosts

2. Double-click the hosts file to open with corresponding application .

3. If necessary, deselect the “Always use this program to open this program” check box.

Edit Hosts FIle

4. Scroll through the list of programs and double-click Notepad.
5. When the file opens, delete all the entries added by the risk. See sample of a clean hosts file content below.
6. Close Notepad and it should be save automatically (without a file extension).

Windows Hosts File

- – Below this line is an example of Clean Windows Hosts File – - 

# Copyright (c) 1993-2009 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a ‘#’ symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host

# localhost name resolution is handled within DNS itself.
# 127.0.0.1 localhost
# ::1 localhost

- – Above this line is an example of Clean Windows Hosts File – -

Note: You may replace your existing hosts file with the above if you are certain that it was maliciously edited. Copy and paste the code to your HOSTS file and save it.

You might find these helpful:

32 Comments

  1. Hugo
    Oct 23, 2008 @ 17:38:24

    I cant save the file after editing it.

  2. John
    Oct 24, 2008 @ 13:40:45

    Same for me. Any ideas? Thanks

  3. Mark
    Oct 25, 2008 @ 22:28:18

    right click on the file and select properties and unselect read only befor you open it

  4. Kimberly
    Oct 26, 2008 @ 00:45:12

    Same for me – I’ve been trying for several days to get rid of this…I’ve followed every step, tried everything I can think of, nothing’s working – ideas? I get told “cannot create the file” when I try to save the notepad file.. (and there was no “read only” check in the first place…I tried that..)
    Thanks muchly – any help would be greatly appreciated!

  5. Mike
    Oct 26, 2008 @ 14:28:24

    Hey, I’ve managed to get rid of Trenderdia completely, and fixed my host files, but I’m currently using Mozilla Firefox as my browser, and when I try to go to facebook via firefox, i still get re-directed to that fake microsoft site… However, if i go to facebook via Internet Explorer, it’s fine… Is there another Hosts file, or equivelant that needs cleaning for firefox?

    Thanking thou for any help!

  6. Jeff
    Oct 27, 2008 @ 05:40:18

    i no longer get the “dead in a month” message but i cant seem to get rid of the fake microsoft site. ive deleted all the infected files and what not using the Malwarebytes’ Anti-Malware software. i tried to edit my host list but i seem to have the same problem as kimberly. when asked to overwrite i say yes then i get a message to make sure my file path is correct and i know it is. help please?

  7. Helen
    Oct 31, 2008 @ 18:46:16

    I’m no computer tech and it’s taken me days but finally I’ve got rid of it. Followed all the instructions on here but the key thing for me was deselecting ‘read only’ by right clicking on the host file – but this must be done before opening it. Then open it and delete entries and save.
    Thank you very much!

  8. Margret
    Dec 03, 2008 @ 22:47:50

    You include ME, but not Vista? Vist’s not that broken, is it?

    So what’s the file look like in Vista? I have several HOSTNAME files, and I’m not sure which one It’s (more-or-less) safe to mess with.

  9. Nagaraju
    Feb 13, 2009 @ 05:11:50

    Am i delete entire file content of that file .

  10. Suzanne
    Mar 10, 2009 @ 15:08:41

    Hej, I still don’t know how to save it…
    and i’ve got like, 2 localhosts, so i guess i’ve to only leave the
    127.0.0.1 localhost
    cause here it says ::1 localhost
    And if i want to save it, there comes a text message like: cannot create the bla bla bla..
    And like what should you save it? .txt?
    Tnks

  11. azmi
    Oct 16, 2009 @ 07:59:00

    still no anything happen.. i stil cant go to anvirus site

  12. host4theday
    Nov 16, 2009 @ 07:47:12

    Simple steps that WORKS !!

    1. Install MicrosoftFixit50267.msi (The current host file will be renewed)
    2. Copy and paste the content of a Clean Windows Hosts File.
    3. Save and Done !

  13. Mike The Tech Guy
    Nov 17, 2009 @ 22:32:36

    Virus Im currently battling refuses to let me alter hosts file even in Safe Mode.. Cant de select Read Only as it blocks that too. Hijack This isnt working either.. ESET has been installed and is currently detecting viruses. Love these jobs..

  14. Lev Gaitsgory
    Nov 29, 2009 @ 06:49:29

    There is the host file at my PC with VISTA:

    # Copyright (c) 1993-2006 Microsoft Corp.
    #
    # This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
    #
    # This file contains the mappings of IP addresses to host names. Each
    # entry should be kept on an individual line. The IP address should
    # be placed in the first column followed by the corresponding host name.
    # The IP address and the host name should be separated by at least one
    # space.
    #
    # Additionally, comments (such as these) may be inserted on individual
    # lines or following the machine name denoted by a ‘#’ symbol.
    #
    # For example:
    #
    # 102.54.94.97 rhino.acme.com # source server
    # 38.25.63.10 x.acme.com # x client host

    127.0.0.1 localhost
    ::1 localhost

    As you see it is the same as a sample of clean file above, but just one extra line:
    ::1 localhost

    Should I delete it, or this file is clean and I shouldn’t do anything with it

  15. D
    Apr 16, 2010 @ 23:49:56

    The problem appears to be that not only is the etc/hosts file marked read-only, but the entire etc folder is also marked that way. So to be able to clean your hosts file (removing everything but the “127.0.0.1 localhost” entry), you have to first go up one level to the drivers directory, then right-click the etc folder and deselect read-only. You will have to do this using the administrator account and then authorize the action when it asks you. Also make sure you apply the change to all sub-folders and files. Then you can finally go back into the etc directory and clean your hosts file by opening it with Notepad. That worked for me after a lot of frustration trying to remove the read-only lock on the file itself, which didn’t work.

  16. only 13 years old (dosnt want to put in real name)
    May 14, 2010 @ 20:34:19

    Hugo your hosts file is really hosts.txt the file tries to save It as just hosts to change it to just hosts.

    1: Change the file to what you want it to be.
    2: Save it to your documents.
    3: Go to documents folder after you saved it.
    4: Push Alt and a tool bar should show up.
    5: Click tools select folder options and click on the view tab.
    6: Find were it says “Hide extensions for known file types”.
    7: Click on that and make sure its off and click okay.
    8: Now your hosts file you saved in documents should say “hosts.txt” just change the name to just “hosts” no .txt or .exe or anything like that just hosts.
    9: Save the file to “OS C:/windows/system32/drivers/etc” and replace the old file with the new one that you made for your hostname or what ever it is

    You only have to do this once after that it should save no problem hope this helps because i saw that a lot of people didn’t know how to save this file.

  17. only 13 years old (dosnt want to put in real name)
    May 14, 2010 @ 21:12:40

    Also this is what my hosts file looks like.

    # Copyright (c) 1993-2006 Microsoft Corp.
    #
    # This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
    #
    # This file contains the mappings of IP addresses to host names. Each
    # entry should be kept on an individual line. The IP address should
    # be placed in the first column followed by the corresponding host name.
    # The IP address and the host name should be separated by at least one
    # space.
    #
    # Additionally, comments (such as these) may be inserted on individual
    # lines or following the machine name denoted by a ‘#’ symbol.
    #
    # For example:
    #
    # 102.54.94.97 rhino.acme.com # source server
    # 38.25.63.10 x.acme.com # x client host

    127.0.0.1 localhost
    ::1 localhost

  18. only 13 years old (dosnt want to put in real name)
    May 14, 2010 @ 21:15:43

    last comment sorry didn’t mean to put ::1 localhost at the end

  19. Sammy
    May 29, 2010 @ 16:41:00

    Only 13 years old… I have followed all your instructions but when i try to save the host file (from documents) to the etc file it says that i do not have permission and to contact the administrator. I have ran a command prompt to run as administrator but it still won’t let me save it.

    Can you/anyone help at all… i feel really frustrated that I have got all this way and now i can’t save the file.

    I too have the ::1 localhost on the bottom which i want to remove.

    Thanks

    Sammy

  20. Ang
    May 31, 2010 @ 22:35:32

    Im exactly the same as sammy, it says to run as administrator ….pls help

  21. Frustrated with the PC
    Jul 15, 2010 @ 03:19:44

    Only 13 Years Old – worked for me Thanks!!!

  22. Michael
    Jul 23, 2010 @ 20:00:38

    I have been fighting this “read-only” issue, as malware had put a bunch of redirects in my hosts file. Even running as administrator would not let me change the file. What I finally had to do was go into properties, security, edit permissions, add myself as an authorized user with full permissions, and apply that. Once I did that I was able to uncheck the read only box, delete the malicious entries and save it.

    I have seen this issue with hosts file come up a lot recently, programs like spybot and av scanners can’t seem to fix it because they get errors trying to alter the hosts file.

    Also make sure when you save the file you save it without an extension, most programs will try and add one, so you have to delete it. The file is HOSTS, no extension, no .ini, no .txt, no .doc, etc.

  23. Zoua
    Aug 06, 2010 @ 17:10:49

    Thanks to only 13 years old. :) I followed everybody’s steps. And it worked. Disabled read-only option for etc file first. And then saved it as a document, renamed it with no extension, copy and replaced it in the original folder (c:windows/system32/drivers/etc). I ran a google test and it still redirected me, but I realized that i made a copy file of hosts. deleted that copy and IT HAS WORKED FOR ME SO FAR. I hope this corrects the re-directing crap. :) Thanks guys!

  24. snakebones
    Apr 02, 2011 @ 17:44:48

    None of the options above solved my issue still had permission issue with replace or delete. So I downloaded a linux boot disk and restarted the computer and booted into the ubuntu distro i downloaded and after it started i went to the windows volume/windows/system32/drivers/etc/hosts and deleted and it worked perfect for me but if you have a second computer to use and can take the drive that is infected out and put it into the second computer as a slave drive that should work also.

  25. another good ninja
    Sep 23, 2011 @ 22:50:43

    Hey guys, if you don’t know where the read-only check is, you can find it in the properties of the file when you right click it.

  26. Bob Bobson
    Apr 29, 2012 @ 21:12:41

    I use a batch file to copy an offline backup of my HOSTS file to the ETC directory. That way, I can securely make modifications to my backup and simply copy it over the active one at will.

    Also, Google for “hosts mvp” to find a copy that comes with lots of ad-servers and such. Further, Spybot S&D includes a function (immunization) that can add ad- and tracking-servers to the HOSTS file.

  27. Serge
    Jan 18, 2013 @ 09:37:44

    go to run, type cmd, right click on cmd, run as administrator, enter, type notepad, from notepad open the host file, modify and save.

  28. lilay
    Mar 17, 2013 @ 07:26:50

    Would you image that what I found in my windows host file? ………..near to 1000 web redirecting hosts? OMG!
    Than you for your help!

  29. brainfreeze
    Jul 18, 2013 @ 10:11:43

    Hi, I am a lousy computer user but I would be glad if anyone could help to see if what I am seeing on my host’s file is alright?
    The “127.0.0.1 localhost” duplicates?

    It’s is kinda slow while browsing on the internet. Thanks!

    ——————————————————————
    # Copyright (c) 1993-1999 Microsoft Corp.
    #
    # This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
    #
    # This file contains the mappings of IP addresses to host names. Each
    # entry should be kept on an individual line. The IP address should
    # be placed in the first column followed by the corresponding host name.
    # The IP address and the host name should be separated by at least one
    # space.
    #
    # Additionally, comments (such as these) may be inserted on individual
    # lines or following the machine name denoted by a ‘#’ symbol.
    #
    # For example:
    #
    # 102.54.94.97 rhino.acme.com # source server
    # 38.25.63.10 x.acme.com # x client host

    127.0.0.1 localhost

    127.0.0.1 localhost
    127.0.0.1 localhost
    127.0.0.1 localhost

  30. kettlebell exercises video
    Mar 26, 2014 @ 20:44:27

    Maybe you could write subsequent articles relating to this article. I want to learn more things about it! I have been browsing on-line more than three hours lately, yet I by no means found any fascinating article like yours.

  31. Harold
    Aug 25, 2014 @ 12:03:08

    tried all the options given but still can’t adjust my host file, or save /overwrite the corrupt one

  32. Bryant
    Jan 18, 2015 @ 04:14:49

    For those of you who are finding it impossible to save your host file after editing and keep getting the message telling you that the file can’t be over-written, or something to that effect…All you have to do, is open up your ‘etc’ folder and right-click on ‘host’ and scroll down to ‘properties’ and when the properties box opens, just un-check the ‘read-only’ box and then close it out. Now, right-click on ‘Notepad’ and choose, ‘Run as Administrator’. When it opens, click on ‘File’ and then ‘Open’ and then in the top window of the box, type in, ‘System32′, then choose, ‘drivers’, then ‘etc’. After you open, etc, click on ‘host’ and edit away. After you’ve finished editing, just close the window and it’ll ask you if you want to save, just click ‘Yes’ and you’re done!

Leave a Reply

*

privacy policy