Sign up ×
Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

First: I can't find any information on this phenomenon, not anywhere on the net.

I don't know which application does it, but something in my Windows 7 Home Premium system (fully updated & legal) updates my hosts file. I have UAC enabled. To edit my hosts file, I have to run Notepad with admin privileges or else I can't save my file.

The line has disappeared several times now. It looks like that is the only line to which this happens. I have other lines in the same file, and they are left untouched.

I suspect Google Chrome to be responsible for this, since the Google Updater probably has the permissions to modify system files - and it's in their interest to load their crap, but I am not sure. While I understand that I use their services and that ads pay for those services, I don't like the idea of software violating my system like that. And I am surprised that it's even possible, I thought Chrome installed within the user profile and didn't need system write access to install.

Can anyone else confirm this issue? Any experience with similar things happening to the hosts file?

Edit: I have ProcessMonitor running with a filter on the hosts file. Let's see what I can find... thanks for the suggestion, I hadn't thought of it initially.

Update: This morning, Process Monitor showed a bunch of file activity. And is gone! It looks like Windows Defender did it. Read the Process Monitor log here:

share|improve this question
I dunno, I would suspect adware that is trying to serve ads from doubleclick. I don't know if this is a common technique, but I'd start with a virus/spyware scan (fully updated, of course) and/or the Microsoft malicious software removal tool. –  Steve Dispensa Sep 6 '11 at 17:50
I know. MalwareBytes comes up clean, so do Avast! scans. There are about 15 entries in that file, and all of them point to localhost so it's not like there's malware trying to re-route any domain names. I'm monitoring the file with Process Monitor and it doesn't show anything out of the ordinary: after a /flushdns and a browser restart, the DnsClient service reloads the file once. That's it. –  Jacob Sep 6 '11 at 19:16
What happens if you point the IP to something other than –  Steve Sep 7 '11 at 22:13
It wouldn't have made a difference, I think. Windows Defender has a thing for, who knows why can tell me! –  Jacob Sep 8 '11 at 4:12
@Jacob possibly because it's trying to prevent the tracking that doubleclick does - so it's really a good change. <goes and modifies hosts> –  Jonathan Dickinson Oct 15 '11 at 12:49

1 Answer 1

up vote 16 down vote accepted

Use Process Monitor with a filter to watch the hosts file. Run it long enough and you will see everything that changes the file.

share|improve this answer
Yes, that's one of my favorite tools. I wanted to make sure others were aware of the possible existence of this weird issue, just solving the problem isn't the only thing I'm after. –  Jacob Sep 6 '11 at 17:21
Ok, Process Monitor helped me find the answer quickly. Good thinking. –  Jacob Sep 8 '11 at 4:11

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.