Contents of the hosts file. How to quickly clear (restore) the hosts file What should be in Windows 8 hosts

Using the hosts file on your computer, you can configure the mapping between a domain and a specific IP address.

This setting may be necessary, for example, if you have transferred your site and domain to a new hosting, and you need to check the operation of the site at its main address. However, the DNS server cache still “remembers” the previous A-record of the domain, and when accessing the site it will give the previous IP address at which the site is no longer accessible. In order not to wait for the DNS cache to be updated (it can take several hours), you can specify the required combination of domain and IP address in the hosts file - a request to this file has priority over access to DNS servers.

Find out which IP the request is going to at the moment when accessing a domain, you can use the ping command - working with it is described in more detail.

Another option for using settings in hosts is to deny access to a particular site from your computer. For example, if you specify an incorrect IP in the hosts for the facebook.com domain (say, 127.0.0.1), then it will be impossible to go to this site from your computer.

The setup itself is very simple: just specify the required IP address in the file, followed by a space - the domain name. Changes must be made as an administrator.

Windows

If the system was installed by default on drive C, the file will be located at: c:\windows\system32\drivers\etc\hosts.

Open required file can be done in one of the following ways. Make sure you follow all the steps on behalf of the administrator.

Option 1.

Launch the command line (press Win+R, type cmd in the window that appears and click OK) and run the command below in it:

Notepad.exe c:\windows\system32\drivers\etc\hosts

The hosts file will be opened in Notepad and you can enter .

Option 2.

Go to "My Computer" -> Local disk From -> Windows -> System32 -> drivers -> etc or paste the desired path into address bar conductor:

In the etc folder, click right click mouse on the hosts file, select "Open with" and then select "Notepad":


Typically the file looks like this:


Enter the required IP and domain, for example, 92.53.96.120 mydomain.com:


Save your changes. To do this, select "File" - "Save". In the window that opens, select "All files" and click "Save".


To check the settings, .

The hosts file is a rather vulnerable place in the Windows operating system. This file becomes the number one target for almost all viruses and Trojans that manage to infect a computer.
The purpose of this file is to store a list of domains and their corresponding IP addresses. The operating system uses this list to convert domains to IP addresses and vice versa.

Every time you enter the address of the site you need into the address bar of your browser, a request is made to convert the domain to an IP address. Currently, this translation is performed by a service called DNS. But, at the dawn of the development of the Internet, the hosts file was the only way to associate a symbolic name (domain) with a specific IP address.
Even now this file has a direct impact on the transformation of symbolic names. If you add an entry to the hosts file that will associate the IP address with the domain, then such an entry will work perfectly. This is exactly what the developers of viruses, Trojans and other malware.

As for the file structure, then hosts file this is normal text file no extension. That is, this file is not called hosts.txt, but simply hosts. To edit it, you can use the regular text editor Notepad.

The standard hosts file consists of several lines that begin with the “#” character. Such lines are not taken into account by the operating system and are simply comments.

Also in standard file hosts there is an entry “127.0.0.1 localhost”. This entry means that when you access the localhost symbolic name, you will be accessing your own computer.

Fraud with the hosts file

There are two classic ways to benefit from making changes to the hosts file. Firstly, it can be used to block access to sites and servers of antivirus programs.

For example, having infected a computer, the virus addsin the hosts file the following entry: “127.0.0.1 kaspersky.com”. When I try to open the website kaspersky.com operating system will connect to IP address 127.0.0.1. Naturally, this is an incorrect IP address. This leads to the fact that Access to this site is completely blocked.As a result, the user of the infected computer cannot download antivirus or antivirus database updates.

In addition, virus developers can use another technique. By adding entries to the hosts file, they can redirect users to a fake site.


For example, having infected a computer, the virus adds the following entry to the hosts file: “90.80.70.60 vkontakte.ru.” Where “90.80.70.60” is the IP address of the attacker’s server. As a result, when trying to access a well-known site, the user ends up on a site that looks exactly the same, but is located on someone else’s server. As a result of such actions, fraudsters can obtain logins, passwords, and other personal information user.


So, in case of any suspicion of virus infection or site substitution, the first thing you need to do is check the HOSTS file.

The malware disguises modification of the hosts file as follows:

To make it difficult to detect lines added by a virus, they are written to the end of the file

After a large empty area formed as a result of repeated line feeds;

After this, the original hosts file is assigned the Hidden attribute (by default hidden files and the folders are not visible);

A false hosts file is created, which, unlike the real hosts file (which has no extension), has the extension .txt (by default, extensions are not displayed for registered file types):

Where is the hosts file located?

Depending on the operating system version Windows file hosts can be located in different folders. For example, if you use Windows XP, Windows Vista, Windows 7 or Windows 8, then the file is located in the folderWINDOWS\system32\drivers\etc\


In the Windows NT and Windows 2000 operating systems, this file is located in the folder WINNT\system32\drivers\etc\


Editing the hosts file

You can edit the file hosts and in Notepad, delete unnecessary lines, or add your own.
In order to edit the hosts file, you need to launch Notepad in Administrator mode, and then open the file C:\Windows\System32\drivers\etc\hosts in it.

How to clean the hosts file

So, point by point.

Click "Start".

Choose "All programs".

Then select the item "Standard".

On "Notepad" click right click the mouse and select the item "Run as administrator."

In the notepad window that opens, select the File menu, then "Open..."

In the window that opens, select “Computer” on the left side of the window.

Then open the disk WITH:.

Windows directory.

System32 directory.

Drivers directory.

Catalog etc.

When you open the etc directory, you will see an empty directory. In the lower right corner of the window, select "All files".

Select the hosts file and click the button "Open".

Check for the necessary content: at the beginning there are explanatory comments from Microsoft about what this file is and how to use it. Then there are several examples of how to enter various commands. All this is just plain text and does not carry any functions! We skip it and reach the end. Next should come the teams themselves. Unlike comments (i.e. plain text), they must begin not from the "#" sign, and from specific numbers, indicating the IP address.

Any commands in your hosts file after the following lines can be malicious:

  • On Windows XP: 127.0.0.1 localhost
  • On Windows Vista: ::1 localhost
  • On Windows 7/8: # ::1 localhost

As you can see, host files are slightly different in different operating systems.

In order not to clean up anything unnecessary, you need to know how the commands are deciphered. There is nothing complicated here. At the beginning of each command there is digital ip address, then (separated by a space) the letter associated with it domain name, and after it there may be a small comment after the "#" sign.

Remember! All commands starting from numbers 127.0.0.1(except, 127.0.0.1 localhos t) block access to various sites and Internet services. Which ones exactly, look in the next column following these numbers.
Teams having at the beginning any other numbers ip addresses, redirect(redirect) to fraudulent sites instead of official ones. Which sites have been replaced with fraudulent ones, also look in each column following these numbers.
Thus, it will not be difficult to guess which commands in your hosts file are malicious! If something is still not clear, look at the screenshot below.

Please keep this point in mind. Many virus commands can be hidden far at the very bottom of the file by cunning Internet attackers, so take the time to scroll the slider all the way down!

After you do the cleanup, don't forget to save all changes ( "File" --> "Save"). If you opened the hosts file from the Notepad program itself, when saving changes, in the column "File type" be sure to select an option "All files", otherwise notepad, instead of saving in the hosts file, will only make it text copy of hosts.txt, which is not system file and does not perform any functions!

After a successful save, do not forget to restart your computer.


How to block sites in hosts

So, the hosts file is already open and you see that it is built in the form of a regular text document.

At the beginning you will see comments (plain text that does not provide any functionality) starting with the symbol "#" . They may be followed by some functional commands prescribed by the system.

But we don't need them. We skip them and get to the very end of the document. Let's make a retreat. And now, here, we can already write the commands we need!

When finished working with the file, open the File menu, select "Save".


To understand how to correctly enter commands for blocking web resources, you need to know that each PC has its own so-called. loopback address, which sends any request back to itself. For any computer running Windows, Linux or Mac, this address is always the same - 127.0.0.1 . Now, with the help of just this IP address, you can block any request to an unwanted site so that it is sent not to the requested resource, but to brotherly to the local computer.

This command in hosts is written as follows: " 127.0.0.1 domain name to block "Here are real examples: 127.0.0.1 mega-porno.ru, 127.0.0.1 odnoklassniki.ru, 127.0.0.1 vk.com etc.

That's all. Now access to all unwanted sites is securely blocked. The main thing is to resave the hosts file after making changes! Detailed instructions see above.

Restoring the hosts file after a virus infection

As already mentioned, today a large number of malware use the file hosts to block access to websites of popular portals or social networks. Often, instead of blocking sites, malware redirects the user to pages that look similar to popular resources (social networks, postal services etc.), where an inattentive user enters credentials, which thus fall to the attackers.
If the file contains entries like 127.0.0.1 odnoklassniki.ru 127.0.0.1 vkontakte.ru or the addresses of your sites that you cannot access, then first check your computer for “malware”, and then restore the file hosts

Many users who have been hacked are interested in where they can download the hosts file. However, there is no need to search for and download the original hosts file. You can fix it yourself; to do this, you need to open it with a text editor and delete everything except the line except “127.0.0.1 localhost”. This will allow you to unblock access to all sites and update your antivirus.

Let's take a closer look at the process of restoring the hosts file:

1. Open the folder in which this file is located. In order not to wander through directories for a long time in search of the desired folder, you can use a little trick. Press the key combination Windows+R to open the menu "Run". In the window that opens, enter the command "%systemroot%\system32\drivers\etc"and click OK.

2. After this, a folder will open in front of you in which the hosts file is located.

3. Next you need to do backup copy current file. In case something goes wrong. If the hosts file exists, then simply rename it to hosts.old. If the hosts file is not in this folder at all, then you can skip this item.


4.Create a new empty hosts file. To do this, right-click in the etc folder and select"Create a text document"

5. When the file is created, it must be renamed to hosts. When renaming, a window will appear with a warning that the file will be saved without an extension. Close the warning window by clicking OK.

6. Once the new hosts file has been created, it can be edited. To do this, open the file using Notepad.

7. Depending on the version of the operating system, the contents of the standard hosts file may differ.

This is what all, without exception, “clean” hosts files should look like.

Pay attention!

  • For Windows XP and Windows Server 2003 needs to be added "127.0.0.1 localhost"
  • Windows Vista, Windows Server 2008, Windows 7 and Windows 8 you need to add two lines: "127.0.0.1 localhost" and "::1 localhost"

If you ever find missing or, conversely, unnecessary entries in such a file, it is better to delete them quickly. Especially if they were not made by you or without your consent. Most likely, this is the result of viruses!

Restoring the default hosts file in Windows 7: Copy the text below into a file.

# Copyright (c) 1993-2009 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
#space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a "#" symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host # localhost name resolution is handled within DNS itself.
# 127.0.0.1 localhost
# ::1 localhost

Save and close the file.

File hosts establishes a correspondence between the IP server and the site domain. A request to this file takes precedence over calls to DNS servers. Unlike DNS, the contents of the file are controlled by the computer administrator.

Today, a large number of malware use the file hosts to block access to websites of popular portals or social networks. Often, instead of blocking sites, malware redirects the user to pages that look similar to popular resources (social networks, email services, etc.), where an inattentive user enters credentials, which thus get to the attackers. It is also possible to block access to the websites of antivirus software companies.

Hosts file location

Default file hosts located here C:\Windows\System32\drivers\etc The file has no extension, but can be opened with Notepad. To change the contents of a file in Notepad, you must have administrator rights.

To view the file hosts open the menu Start, select item Execute, enter the command

and press the button OK

This is what the file should look like hosts default.

If the file contains entries like 127.0.0.1 odnoklassniki.ru 127.0.0.1 vkontakte.ru or the addresses of your sites that you cannot access, then first check your computer for “malware”, and then restore the file hosts

Restoring the contents of the hosts file to default

  • Open menu Start, select item Execute, enter the command
    %systemroot%\system32\drivers\etc

    and press the button OK.

  • Rename the hosts file to hosts.old.
  • Create new file hosts default. To do this, follow the steps below.
  1. Right click on an empty space in the folder %WinDir%\system32\drivers\etc, select item Create, click the element Text document , enter name hosts and press the key ENTER.
  2. Click the button Yes to confirm that the filename will not have the extension TXT.
  3. Open a new file hosts V text editor. For example, open the file in " Notebook".
  4. Copy the text below into a file.
    # Copyright (c) 1993-2009 Microsoft Corp.
    #
    # This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
    #
    # This file contains the mappings of IP addresses to host names. Each
    # entry should be kept on an individual line. The IP address should
    # be placed in the first column followed by the corresponding host name.
    # The IP address and the host name should be separated by at least one
    #space.
    #
    # Additionally, comments (such as these) may be inserted on individual
    # lines or following the machine name denoted by a "#" symbol.
    #
    # For example:
    #
    # 102.54.94.97 rhino.acme.com # source server
    # 38.25.63.10 x.acme.com # x client host

    # localhost name resolution is handled within DNS itself.
    # 127.0.0.1 localhost
    # ::1 localhost

Save and close the file.

You can edit the file hosts and in Notepad, delete unnecessary lines, or add your own. To do this you need to run Notebook in mode Administrator.

How to launch standard programs Windows see

Windows is far from Linux in terms of the systematic use of configuration files to customize the functionality of the operating system. First of all, because Windows uses the registry for this.

But still, there are such files in Windows, and it is sometimes useful to know their purpose. An important repository of configuration options includes a file called Hosts. The file name does not have an extension, so when automatic search there is no need to specify it.

In the course of the presentation, we will focus on the seventh version of the OS, as the most widely used by consumers (Microsoft's tricks in the G8 failed to convince users that Metro is cool).

Essentially, we are dealing with a repository of domain names similar to the names DNS servers. The benefit of using it is that the computer owner is able to regulate the priorities of domains when translating them into real network addresses when accessing Internet resources.

File domains take precedence over any external ones DNS addresses, even those specified in the settings network connections. The default storage location in 7 looks like this: %SystemRoot%\system32\drivers\etc\hosts. However, this path is not possible. The system administrator can override it by changing the registry key named HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Tcpip\Parameters\DataBasePath. Files with the same name and purpose are included not only in the Windows system environment; they can be found in Unix-like operating systems, Mac-OS and even on the Android platform.

Internal structure of Hosts records and storage manipulation

Although Hosts does not have an extension, from the inside it looks like a regular test file with entries in approximately the following format: 127.0.0.1 localhost. That is, with a structure consisting of a domain's IP address and its symbolic name, separated by spaces or a tab character.

The example given is a mandatory entry in any such file. It corresponds to the address and name of the user's machine itself. All other entries look similar to this one. With the help of the information placed here, the most different tasks. For example:

  • You can associate the name localhost not with the address of the local machine, but with the address of any computer on the enterprise intranet. This is often done system administrators enterprises and organizations.
  • Similar associations can be used to optimize access to external hosts. If you create a record with a range of IP addresses corresponding to the real addresses of the desired sites, then their pages will load faster than when accessing the provider’s DNS database.
  • One more useful option– the ability to organize blocking of unwanted domains (for example, domains of advertising sites). To do this, all such domains are assigned a local machine address – 127.0.0.1

In principle, hosts is an outdated technology, supported for reasons of backward compatibility.

In addition, it has a serious drawback: if the network connection uses an intermediate proxy server, then all storage entries are simply ignored. There are also security concerns.

The fact is that many viruses like to dig into the contents of a file and change it at their discretion. One of the recommendations given during a virus attack is to open the file in Notepad and delete from it all entries located below the localhost entry.

Hello friends!
In some situations it is necessary to change or restore the hosts file.

In this article I will tell you what it is intended for and how to edit it correctly. I will give an example of how using the hosts file you can speed up, redirect or block access to certain sites.

The hosts file is a special system text file that is responsible for converting symbolic domain names into their corresponding IP addresses and vice versa. In addition to the usual address, an Internet site also has an IP address.

For example, social network Odnoklassniki has an address like www.ok.ru and IP address 217.20.147.94. By the way, you can enter these numbers into the address bar of your browser and go, but you will be redirected to www.ok.ru.

It should be noted that such domain addresses (www.ok.ru and others) were invented solely for the sake of convenience. Agree, it is much easier to remember the symbolic name (domain) ok.ru than its IP address 217.20.147.94.

However, the server (dedicated computer) on which the ok.ru website is located does not accept such symbolic treatment. To convert a host name to an IP address, the hosts file and a special domain name system (abbreviated as DNS) are used. Moreover, the hosts file has priority over DNS.

When you enter an address, the first thing you do is look at your hosts file, and only then contact the DNS server. Unlike DNS, the hosts file can be edited directly.

I believe that you now understand the importance of the hosts file and understand why most malware seeks to gain access to it.

Using the hosts file

By managing the hosts file, you can speed up access to certain sites or, conversely, limit access to them. You can organize redirection from some pages to other sites. For example, when accessing some prohibited resources, you will be redirected to the website of the Ministry of Internal Affairs.

But the greatest danger comes from malicious software, which, having gained access to the hosts file, will use it for its own malicious purposes. For example, block access to websites, social networks, or the websites of antivirus software companies.

Where is the hosts file located?

As a rule, if it is an operating room Windows system(NT, 2000, XP, 2003, Vista, 7, 8), the hosts file is located in system partition on drive C. The full address looks like this: C:\Windows\System32\drivers\etc\hosts.

There are more quick way get to the host file. To do this, press the key combination: Win + R or “Start” → “Run”. A window for entering a command will open. Enter the following command:

  • notepad %windir%\system32\drivers\etc\hosts

And here is the host file itself, which by default looks like this:

If there is no hosts file in this folder, then most likely the virus has changed its location in the registry key. Below is a registry key that specifies the path to the folder with the host file:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Tcpip\Parameters \DataBasePath

In addition, the hosts file may be hidden. In this case, go to “Folder Options” → “View” and set the value to “Show hidden folders files and disks."

How to edit the hosts file?

The hosts file can be edited in any text editor. For example, in a standard Windows notepad.

Let's look at the editing options and get started block access to the sites mentioned above: vk.com and ok.ru.

The site or sites to which access needs to be blocked are written on a new line; first, the local IP address is indicated at the beginning of the line - 127.0.0.1 .

In our case, the entry looks like this:

127.0.0.1 vk.com
127.0.0.1 ok.ru

Save the changes. Now open the browser and try to go to the address vk.com or ok.ru. As you can see, the hosts file has done its job, and the attempt to connect to these sites failed.

You can also redirect(make a redirect) to another site. To do this, you need to know the IP address of the site where the redirection will be made, and next to it, indicate the domain from which the redirect is being made, separated by a space.

The example below shows that first I entered the IP address of the site yandex.ru (213.180.204.3), and indicated the domain vk.com separated by a space.

This means that when you try to access the vk.com website, you will be redirected to yandex.ru (213.180.204.3).

To speed up the loading of a site, you need to know its IP address and domain. This data is written in the hosts file.

It would seem that everything is simple: you need to register the necessary changes in the hosts file and click “Save”. But the system complains and does not allow you to save the desired changes. More precisely, it suggests saving it to a separate text file.

This is due to stricter security rules in the OS latest versions, and this makes sense, since many viruses try to write their lines here. In this case, the changes are made by us, and this is done purposefully.

You need to do the following. Return to the location of the hosts file and right-click to call context menu, where select “Properties”.

Go to the “Security” tab and select the user under whose name you are working.

Agree with the warning about the reduced security level. Go back and save changes.

There is an easier way to edit the hosts file - using command line. You can read it.

To restore the default hosts file settings, simply copy and paste the text below:

# Copyright (c) 1993-2009 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
#space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a ‘#’ symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host

127.0.0.1 localhost

This is how you can easily and simply by editing the hosts file, you can block access to sites or perform redirection. That's all for today.

In the next article I will tell you how to edit the hosts file if the Windows system is locked. In addition, I will answer popular questions: “Why can’t I log into Odnoklassniki?”, “Why can’t I log into VKontakte, email and other sites?” Subscribe and don’t miss the release of this article (the article has already been published, you can read it).



2024 wisemotors.ru. How does this work. Iron. Mining. Cryptocurrency.