Download a clean hosts file. How to restore the hosts file in Windows

After entering the required site in the browser, suppose Google.com , the browser sequentially (according to priority) looks for a match between this domain name and the IP user (because it is IP addresses that network devices work with).

A) the specified site is checked in the hosts file, if it finds a match (let’s assume 1.1.1.1 Google.com is written in the hosts file), then the contents of the IP - 1.1.1.1 will open for you, if there is no specified domain name, proceed to the next step;

b) cache dns is checked (if you have opened Google.com before, then most likely the IP of this site is saved in DNS cache your computer/laptop), if the IP of the site is indicated there, then the page opens for you, if not, proceeds to the last stage;

V) the request goes to the DNS server (it is registered manually in the settings network connection or issued via DHCP), if the DNS server does not have the specified site, it will “ask” another DNS servers, until it is found (if, of course, it exists at all) and the site opens successfully.

The hosts file is located at the path C:\Windows\System32\Drivers\etc\hosts (if C is the system drive). You can open it with a regular notepad. If you have not made any changes to hosts file, then the following will be written there:

As you can see, regardless of the version, the host file is not very different, but if a virus “worked” on the hosts file, various sites and IPs can be added there. For example:

127.0.0.1 ftp.kasperskylab.ru
127.0.0.1 ids.kaspersky-labs.com
127.0.0.1 vk.com
127.0.0.1 drweb.com

Such additions to the file prevent you from accessing the specified sites.

1.2.3.4 ftp.kasperskylab.ru
1.2.3.4 ids.kaspersky-labs.com
1.2.3.4 vk.com
1.2.3.4 drweb.com

Such additions in the file when opening the specified sites will redirect you to other sites, possibly infected with viruses (IP-1.2.3.4- are fictitious).

If you find that the hosts file has been changed, it needs to be corrected. In Windows XP, the file is simply opened in Notepad, the necessary changes are made and saved (you must log in as an administrator). On other versions (Windows Vista, 7, 8), you must give permission to change the file. To do this, open the folder in which hosts is located C:\Windows\System32\Drivers\etc(if drive C is system). Click right click mouse on hosts and choose "Properties".

Select a tab "Safety", then select the user under which you work on your computer/laptop (in in this example this is the site) and click the button "Change". A window will open "Permissions for the group "hosts"", select the user again and assign full rights on the file, click "OK", in the window "Properties: hosts", Same "OK".

After that you open hosts Notepad and return the file to original state, save the changes when finished.

What is the Hosts file for?
The purpose of this system file is to assign certain website addresses to a specific IP.
This file is very popular with all kinds of viruses and malware in order to write their data into it or simply replace it.
The result of these actions may be signs of “insertion” of a site into browsers, which will ask to send an SMS when opening the browser, or blocking of various sites, at the discretion of the creators of the virus.

Where is the hosts file in windows?
For different versions OS Windows location hosts file is slightly different:

Windows 95/98/ME: WINDOWS\hosts
Windows NT/2000: WINNT\system32\drivers\etc\hosts
Windows XP/2003/Vista/Seven(7)/8: WINDOWS\system32\drivers\etc\hosts

What it should look like correct file hosts?
The "contents" of the hosts file are also slightly different for different windows versions, but not really. It is "written" in English why it is needed and how to make exceptions with one example. All lines starting with a # sign mean that they are commented out and do not affect the file.
Contents of the original hosts file for Windows XP:

#

#




#space.
#


#
# For example:
#



127.0.0.1 localhost

# Copyright (c) 1993-2006 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
#space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a "#" symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host
127.0.0.1 localhost::1 localhost

# Copyright (c) 1993-2009 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
#space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a "#" symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host
# localhost name resolution is handle within DNS itself.
#127.0.0.1 localhost
# ::1 localhost

# Copyright (c) 1993-2009 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
#space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a "#" symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host

# localhost name resolution is handled within DNS itself.
#127.0.0.1 localhost
# ::1 localhost

How to open and edit the hosts file?
The hosts file can be found in standard Windows Notepad.
This is probably the most interesting part of the article.
First of all, you need to understand why change this file at all? Yes, in order to deny access to certain sites. Thus, by changing this file and writing the site address into it, the user will not be able to access it through any .
In order to change the hosts file, it is advisable to open it as administrator () by right-clicking on the file and selecting "Run as administrator". Or open Notepad this way and open the file in it.

For quick action, you can simply click the Start button and select Run ( win+r) () and enter in the line:

notepad %windir%\system32\drivers\etc\hosts

In order to block access to the site(let's assume it will be test.ru), you just need to add a line with this site at the very bottom:

127.0.0.1 test.ru

# Copyright (c) 1993-1999 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
#space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a "#" symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host

# This HOSTS file created by Dr.Web Anti-rootkit API

#127.0.0.1 localhost
# ::1 localhost
127.0.0.1 test.ru

Also, to edit the hosts file, there is a program HOSTS EDITOR, which you can download and read the description from.
The way it works is that it helps edit the hosts file.
From the screenshot below the principle of its operation is clear; everything is done in a couple of clicks. Adding is done by clicking on +.

You can also change this file for good purposes, for example speed up site loading.
How does this work?
When you access the site, you see it domain name, which has letters. But all sites on the Internet have an IP address, and names are already assigned using DNS. I won’t go into details of this process; that’s not what the article is about. But here you need to know that the hosts file has priority when accessing sites, and only after it does a request to DNS occur.
In order to speed up the loading of a site, you need to know its IP address and domain.
The IP address of the site can be found using various services, for example or .
A domain is the name of a website.
For example, let's speed up the loading of this site where you are reading an article by explicitly specifying the IP address and domain to the file.
Then the added line will be:

91.218.228.14 website

Still possible redirect to another site using hosts file.
To do this, you need to know the IP address of the site and its domain (as in the case described above), then the added line will be like this:

91.218.228.14 test.ru

If you want clean hosts file, then you can do this by simply deleting the content and inserting the original text from the description above (under spoilers).

Some nuances in the hosts file:

Downloading a clean Hosts file for Windows 10 is not at all necessary. You can manually clear the file of all changes. This system file, which very often suffers from virus attacks. Attackers enter their parameters into Hosts. After this, strange things begin to happen on the computer. For example, you cannot go to the site you need or the transition to unknown pages is automatically triggered. If your computer has been affected virus attack, then after identifying holes in the security system, take care to return Hosts to its original form.

How to return the Hosts file to its original state

• Download a clean Hosts file and replace the problematic one;
• Delete all contents of the Hosts file;

Few users who work with the "seven" and surf the Internet realize the true meaning of the HOSTS file (Windows 7). Its content will be shown a little later, but for now let’s dwell a little on the theory.

why is it needed?

In general, if anyone paid attention, the file itself is located in the etc directory, if you sequentially move along the tree from Windows folders, via System32 to the drivers directory on system disk. Not everyone, however, enters such a jungle of the system, but by and large, this is not necessary. On the other hand, if you pay attention, the object itself does not have an extension, although, in fact, it is an ordinary text document.

But let's take a closer look at Windows 7. Its content is that it is this object that is responsible in the system for the relationship between host names (sites, nodes, etc.) and determining their IP addresses to provide end user access to the resource. Roughly speaking, we do not need to enter combinations consisting of numbers in the browser, but we can only specify the names of resources.

And one more small clarification about the HOSTS file (Windows 7). Its content may change. Depending on what changes have been made, this can help block certain sites, speed up access to certain resources, or, on the contrary, can play a cruel joke by redirecting the user to dubious sites. However, first let's look at the original file.

(Windows 7): Contents

So, first, let's try to open. I must say that if you use standard method double click, nothing will work, because, as mentioned above, this object does not have an extension. In addition, the file may be hidden, so you should first select display in the view menu hidden objects. But the system will offer several applications to open. We choose the simplest thing - standard Notepad and look at the contents of the HOSTS file (Windows 7). Before us is something incomprehensible: descriptive text, some examples and a line indicating the local IP (# 127.0.0.1 localhost). That's how it should be.

Attention! Below is a line indicating reserved local address there should be nothing at all, unless, of course, the user wants some resource to be blocked!

In general, everything above localhost is allowed resources. Everything below is blocked. It is not difficult to guess that many viruses, in particular programs that distribute spam or advertising (Malware, Adware, etc.) independently edit the contents of this file. So it turns out that when requesting one resource, the user receives a redirect (redirection) to a completely different one.

Default HOSTS in Windows 7

We have reviewed the original file. Now let's look at the changed content. To correct it, you can take the contents of a “clean” file for the “seven” from another computer or from the Internet, copy it, then paste it into the original and save it.

But there is one problem. The fact is that sometimes, after removing everything unnecessary, it is not possible to save the file as the original (the system simply does not allow this to be done).

How to enter in this case? First, delete the original completely (Shift + Del), bypassing the Trash. Then we right click on the empty space inside the etc directory and create new file with the same name, but we do not specify the extension. Now we insert the necessary content into it and save the object. After this, you need to find the lmhosts.sam file there and delete it, as indicated earlier.

That's it, it's done. What in the first, what in the second case in mandatory A system reboot is required. Only then will everything work as expected. And, of course, editing should be done exclusively with administrator rights.

Bottom line

In general, there were very brief information O HOST file. If you look at the issues of blocking some unwanted resources or, on the contrary, allowing access to them with faster access, editing must be done exclusively manually and according to certain rules. Here you need to remember that the key role of the separator is played by the line indicating the reserved local IP. Well, then, as they say, it’s a matter of technique. By the way, the above technique will also help if the contents of the object have been changed due to the influence of virus programs.

I write about what worries me at the moment. The websites Odnoklassniki, VKontakte, and My World were simultaneously blocked on my computer.

Of course, you can bypass the blocking using an anonymizer if this happens at work or school, but if this is your computer, then know that you “caught a virus.” Of course, it is very unpleasant to realize that a “stranger” is in charge of your territory, but do not despair, everything is in our hands!

To remove the virus you need to find the hosts file on your computer at these addresses: Click the button Start - Computer - Local disk(WITH:) and further -

Windows95/98/ME:WINDOWS\hostsWindowsNT/2000:

WINNT\system32\drivers\etc\hostsWindowsXP/2003/Vista:

WINDOWS\system32\drivers\etc\hosts

Attention!

Before opening the file, click at the top Tools - Folder Options - View - Additional options . Scroll the window and find the option at the very bottom Show hidden folders, files, disks.

This is very important, since the virus hosts file enters our computer in hidden form.

I discovered two “extra” hosts files. These hidden “virus” files need to be removed. Open the file with Notepad editor(right click - “open with”).

If you do not have this editor, then open it using Notepad or WpordPad.

A “clean” hosts file should look like this:

For Windows XP

# Copyright (c) 1993-1999 Microsoft Corp.

# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.

# This file contains the mappings of IP addresses to host names. Each

# entry should be kept on an individual line. The IP address should

# be placed in the first column followed by the corresponding host name.

# The IP address and the host name should be separated by at least one

# Additionally, comments (such as these) may be inserted on individual

# lines or following the machine name denoted by a ‘#’ symbol.

# 102.54.94.97 rhino.acme.com # source server

# 38.25.63.10 x.acme.com # x client host

127.0.0.1 localhost

For Windows systems Vista

#

#




#space.
#


#
# For example:
#


127.0.0.1 localhost::1 localhost

For Windows 7 system

# Copyright (c) 1993-2006 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
#space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a ‘#’ symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host
# localhost name resolution is handle within DNS itself.
#127.0.0.1 localhost
# ::1 localhost

In Russian:

# (C) Microsoft Corp., 1993-1999

# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.

# This file contains mappings of IP addresses to hostnames.

# Each element must be on a separate line. The IP address must

# should be in the first column and must be followed by the appropriate name.

# The IP address and hostname must be separated by at least one space.

# Additionally, some lines may contain comments

# (such as this line), they must follow the node name and be separated

# from it with the ‘#’ symbol.

# For example:

# 102.54.94.97 rhino.acme.com # origin server

# 38.25.63.10 x.acme.com # client node x

127.0.0.1 localhost

When you compared " clean version» with yours and found extra entries - get rid of them - they're garbage! Also remove unnecessary hidden hosts files, in which you will find links to Odnoklassniki, My World, VKontakte and many other nasty things. You will understand everything yourself.

This is what an infected hosts file looks like:

If you are afraid to make any changes, then simply restore the hosts file. To do this, create on drive C (it was selected to make it easier to perform subsequent steps) empty file hosts.txt, open it in notepad and enter there the file template corresponding to your operating system(see above).

After this, copy the created file to the directory C:\Windows\System32\Drivers\etc or to C:\Windows\SysWOW64\drivers\etc for 64-bit Windows 7.

If hidden files no, and your only file contains more than the above - delete everything in it and insert one of the above texts.

Attention!

The hosts file is saved without an extension (there should not be a hosts.txt format) After everything done, be sure to restart your computer.