Understanding the Hosts File and Malware Relating to the Hosts File in Windows

[Sneakyone]

Understanding the Hosts File and Malware Relating to the Hosts File in Windows

---

What is the Hosts File?
The **hosts file** in Windows is a system-level text file used to **map domain names to IP addresses** before the system queries a DNS server. It provides a way to override DNS resolution locally.

Default Hosts File Location in Windows:

Code:

C:\Windows\System32\drivers\etc\hosts

Example of a Default Windows Hosts File:

Code:

# This is a sample HOSTS file used by Microsoft TCP/IP.
# The IP address and the corresponding host name should be placed on individual lines.
127.0.0.1      localhost
::1            localhost

This file is used primarily for **network troubleshooting, local development, or blocking domains**.

---

How Does Malware Exploit the Hosts File?
Malware often **modifies the Windows hosts file** for malicious purposes, such as:

• Redirecting users to **phishing or malicious websites**.
  
• Blocking access to **antivirus/security update servers**.
  
• Hijacking legitimate domain names to display **fake websites**.
  
• Preventing users from visiting **security-related domains**.
  

Example of a Maliciously Modified Hosts File:

Code:

127.0.0.1      www.microsoft.com
127.0.0.1      www.google.com
203.0.113.50    www.bankwebsite.com  # Redirects to a phishing page

In this case, Microsoft and Google are **blocked**, while the banking website is **redirected** to a fraudulent server.

---

How to Check If Your Hosts File Is Compromised
To inspect the hosts file in Windows:

• Press **Win + R**, type **notepad C:\Windows\System32\drivers\etc\hosts**, and press **Enter**.
  
• If you see suspicious entries like **unknown IP addresses mapped to popular websites**, your hosts file may be infected.
  
• Compare your hosts file with the default format (see above).
  

---

How to Restore the Default Hosts File in Windows

Method 1: Manually Reset the Hosts File

• Open **Notepad as Administrator** (`Win + R`, type `notepad`, press **Ctrl + Shift + Enter**).
  
• Click **File > Open**, navigate to:
  
  Code:

  C:\Windows\System32\drivers\etc
• Change file type to **All Files** (`*. *`), then open **hosts**.
  
• Delete any **suspicious or unknown entries**.
  
• Save the file and restart your computer.
  

Method 2: Use Microsoft’s Official Hosts File Reset Tool

• Visit **Microsoft's Support Page**.
  
• Download the **Fix it** tool to reset the hosts file.
  

Method 3: Reset the Hosts File Using Command Prompt

• Open **Command Prompt as Administrator** (`Win + R`, type `cmd`, press **Ctrl + Shift + Enter**).
  
• Run the following command:
  
  Code:

  type nul > C:\Windows\System32\drivers\etc\hosts
• Then restore the default hosts file with:
  
  Code:

  echo 127.0.0.1 localhost > C:\Windows\System32\drivers\etc\hosts
• Restart your computer.
  

---

How to Protect the Hosts File from Malware

• **Make the hosts file read-only** to prevent unauthorized modifications:
  
  Code:

  attrib +r C:\Windows\System32\drivers\etc\hosts
• Use **antivirus software** that monitors changes to the hosts file.
  
• Enable **Windows Defender’s Tamper Protection** to block modifications.
  
• Avoid downloading **untrusted programs** that can alter system settings.
  
• Regularly check the hosts file for **unexpected changes**.
  

---

Detecting and Removing Hosts File Malware
If malware keeps modifying your hosts file, use **anti-malware tools**:

• **Malwarebytes** - Detects and removes hosts file infections.
  
• **HitmanPro** - Scans for malware that modifies system files.
  
• **ESET Online Scanner** - Free cloud-based malware scanner.
  
• **Microsoft Safety Scanner** - Checks for system infections.
  
• **Kaspersky TDSSKiller** - Detects rootkits that modify the hosts file.
  

If malware persists:

• Boot into **Safe Mode** (`Win + R`, type `msconfig`, go to **Boot > Safe Mode**).
  
• Run a **full antivirus scan**.
  
• Reset the hosts file manually.
  

---

Conclusion

• The **Windows hosts file** is a powerful tool for local DNS resolution.
  
• Malware often **abuses the hosts file** to hijack web traffic or block security updates.
  
• Regular **monitoring and security best practices** can help prevent modifications.
  
• If the hosts file is compromised, **reset it and remove malware** immediately.
  

Keeping the hosts file secure is essential to preventing cyber threats and ensuring a safe browsing experience.

Code:

https://pastebin.com/tZvhBq2t