Host file - Access is Denied - Safer-Networking Forums

esman01 · 2006-06-08, 20:58

I am receiving a "Cannot create file "C:\Windows\System\drivers\etc\hosts". Access is denied" error message on both a customer's computer as well as my own computer. Neither has TeaTimer nor IE Tweaks - Lock hosts file read-only protection against hijackers selected. I thought that the customer's computer might still have some sort of malware on it, but when my own computer, which is clean, can not modify the hosts file, I thought I would post a message here. On my computer, I previously added the Spybot hosts list - updated that a few weeks back. Could there be a problem with one of the latest updates?

Customer's PC has NAV 2005, ZA FW, SS&D, Ad-Aware SE Pro (w/ Ad-watch disabled) & CCleaner & SpywareBlaster installed. Cleaned up w/ HJT, ran Ewido, F-Secure, & PestScan online scans, as well as X-Cleaner & F-Secure's Blacklight Rootkit scans. Everything is coming up clean.

Thank you for your help.

md usa spybot fan · 2006-06-08, 21:16

When you go into Spybot > Mode > Advanced Mode > Tools > Hosts File and do an "Add Spybot-S&D hosts list", Spybot also appears to "lock" the HOSTS file by setting the attributes on the HOSTS file to read-only.

If you do not want the read-only attribute set on the HOSTS file after doing a "Add Spybot-S&D hosts list", go into Spybot > Mode > Advanced Mode > Tools > IE Tweaks. Under "Miscellaneous locks" uncheck the following:

Lock Hosts file read-only as protection against hijackers.

esman01 · 2006-06-08, 21:26

Thank you for your prompt reply. I must not have been clear in my original post. IE Tweaks - Lock hosts file read-only protection against hijackers has been unselected on both machines.

Cosmo · 2006-06-10, 22:40

Hi esman01,

what is the situation, where the access is denied for the hosts-file? Do you want to read or write / change (whatever)? Has the respevtive user on both machines admin-privilges oder limited user rights?

Understanding you correctly, you have added the spybot-hosts lists some weeks ago; so, this would mean, you had write-acces at that time (?) or an error message. If this worked correctly, can you remove the spybot-hosts-entries on the same place?

Thomas

esman01 · 2006-06-11, 03:05

Cosmo:
I want to modify / change the host file by adding the latest SS&D host file items. User account is Admin level on both machines.

I was last able to do it a few weeks back on my machine. Earlier today I was able to do it in safe mode, so I am guessing one of the security programs- Zone Alarm firewall, Microsoft's Windows Defender, Spybot Search & Destroy, Ad-Aware, or SpywareBlaster is blocking the change. I think it is the same program on both machines, so I am ruling out the anti-virus programs (AVG anti-virus on mine, Norton anti-virus on customer's). I am not aware of any Windows Update that is preventing changes to the Hosts file.

In researching this, I found that Zone Alarm firewall added a Lock Host File feature with one of their latest updates. Firewall tab > Advanced > Lock Hosts File. This feature is unchecked / disabled by default, and it was unchecked / disabled on both machines.

Spybot S&D also has a Hosts file locking feature mentioned in previous posts. It also was unchecked / disabled on both machines.

I am unclear about Windows Defender. I looked at Tools > General Settings and did not see anything specially about Hosts files locking. I am under the impression that it would alert me. I am not getting an alert, but I am getting an "Access is Denied" error message when I try to change the Hosts file in normal mode.

I do not think SpywareBlaster is blocking it either, unless that is a recent change. In opening the Hosts file, only the Spybot S&D Hosts list has been added, so that is why I am thinking it was related to SS&D, but I have not confirmed this.

I tried using WhoLockMe & Unlocker, and nothing appeared to be locking it.

I am now considering this as an inconvenience, since I am able to make changes in safe mode, and I do not think virus / spyware / other malware would be able to make changes while in normal mode.

I hope this information is useful and accurate. I would appreciate any additional comments. Thanks.

esman01 · 2006-06-11, 06:02

I just installed the 06-10-06 SS&D updates, closed and then restarted SS&D, then tried to add the SS&D Hosts lists and it worked. I had also changed Windows Defender to alert me of changes from allowed programs, and it did. I then had Windows Defender allow the change.

I have another customer's machine than I am fixing. I installed Spybot S&D on that one, along with SpywareBlaster, Windows Defender, and Ad-Aware, but not ZoneAlarm firewall, and I was able to install the SS&D Hosts file, with the latest updates (dated 06-10-06) on that machine with no problems. I was thinking that maybe the ZoneAlarm firewall was preventing the change. Now I am not sure. Wonder if the latest updates from SS&D fixed the problem? Anyways, I think the issue is resolved.

enoskype · 2006-06-13, 02:38

Hi esman01,

I had exatly the same problem with SS&D, and after reading your comments here, with exatly the same softwares installed,SS&D,SpywareBlaster,Windows Defender,Ad-Aware, ZonaAlarm, I have found out that the latest ZoneAlarm version:6.5.700.000 locks the hosts file. Must be a bug. Even with the lock host file checkbox unchecked, it does lock the host file.

Temporary solution:
ZoneAlarm->Firewall->Advanced->''check the lock host file check box''->OK->Advanced->''uncheck the the lock host file check box''->OK----------> host file is unlocked for SS&D to update.

It is temporary because next time ZoneAlarm starts up with Windows restart, checkbox is unchecked but the hosts file is locked again.
You have to repeat steps above.

The issue is still pending.
Thanks.

esman01 · 2006-06-13, 16:49

enoskype:

Thank you for your comments. I ran your temporary solution and it was exactly as you described it, confirming that it is ZoneAlarm causing the problem. Have you contacted ZoneLabs? I posted in the ZoneAlarm forum under Security Issues. Here is the link (if their moderators do not move it to a different section): http://forum.zonelabs.org/zonelabs/b...ssage.id=15537

Thanks again.

suebaby41 · 2006-06-26, 20:35

The temporary fix did not work for me. Any other suggestions?

esman01 · 2006-06-26, 20:53

You can try restarting in safe mode. ZA does not load in safe mode. If you cannot alter the hosts file in safe mode, then I would guess that something else is preventing changes.

2006-06-08, 20:58	#1
esman01 Junior Member Join Date: Dec 2005 Posts: 13	Host file - Access is Denied I am receiving a "Cannot create file "C:\Windows\System\drivers\etc\hosts". Access is denied" error message on both a customer's computer as well as my own computer. Neither has TeaTimer nor IE Tweaks - Lock hosts file read-only protection against hijackers selected. I thought that the customer's computer might still have some sort of malware on it, but when my own computer, which is clean, can not modify the hosts file, I thought I would post a message here. On my computer, I previously added the Spybot hosts list - updated that a few weeks back. Could there be a problem with one of the latest updates? Customer's PC has NAV 2005, ZA FW, SS&D, Ad-Aware SE Pro (w/ Ad-watch disabled) & CCleaner & SpywareBlaster installed. Cleaned up w/ HJT, ran Ewido, F-Secure, & PestScan online scans, as well as X-Cleaner & F-Secure's Blacklight Rootkit scans. Everything is coming up clean. Thank you for your help.

2006-06-08, 21:16	#2
md usa spybot fan Spybot Advisor Team Join Date: Oct 2005 Posts: 5,879	When you go into Spybot > Mode > Advanced Mode > Tools > Hosts File and do an "Add Spybot-S&D hosts list", Spybot also appears to "lock" the HOSTS file by setting the attributes on the HOSTS file to read-only. If you do not want the read-only attribute set on the HOSTS file after doing a "Add Spybot-S&D hosts list", go into Spybot > Mode > Advanced Mode > Tools > IE Tweaks. Under "Miscellaneous locks" uncheck the following: Lock Hosts file read-only as protection against hijackers. __________________ Getting an answer is one thing, learning is another. Microsoft Windows XP Home Edition running on a 2.40GHz Intel® Pentium® 4 Processor with 512 MB of RAM and a 533 MHz System Bus.

2006-06-13, 02:38	#7
enoskype Junior Member Join Date: Jun 2006 Posts: 5	Host file - Access is Denied Hi esman01, I had exatly the same problem with SS&D, and after reading your comments here, with exatly the same softwares installed,SS&D,SpywareBlaster,Windows Defender,Ad-Aware, ZonaAlarm, I have found out that the latest ZoneAlarm version:6.5.700.000 locks the hosts file. Must be a bug. Even with the lock host file checkbox unchecked, it does lock the host file. Temporary solution: ZoneAlarm->Firewall->Advanced->''check the lock host file check box''->OK->Advanced->''uncheck the the lock host file check box''->OK----------> host file is unlocked for SS&D to update. It is temporary because next time ZoneAlarm starts up with Windows restart, checkbox is unchecked but the hosts file is locked again. You have to repeat steps above. The issue is still pending. Thanks.

2006-06-26, 20:35	#9
suebaby41 Junior Member Join Date: Oct 2005 Location: South Carolina, USA Posts: 2	The temporary fix did not work for me. Any other suggestions? __________________ You don't stop laughing when you get old; you get old when you stop laughing.

Thread Tools
Show Printable Version Email this Page
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode

2006-06-08, 21:26	#3
esman01 Junior Member Join Date: Dec 2005 Posts: 13	Thank you for your prompt reply. I must not have been clear in my original post. IE Tweaks - Lock hosts file read-only protection against hijackers has been unselected on both machines.

2006-06-10, 22:40	#4
Cosmo Junior Member Join Date: May 2006 Posts: 18	Hi esman01, what is the situation, where the access is denied for the hosts-file? Do you want to read or write / change (whatever)? Has the respevtive user on both machines admin-privilges oder limited user rights? Understanding you correctly, you have added the spybot-hosts lists some weeks ago; so, this would mean, you had write-acces at that time (?) or an error message. If this worked correctly, can you remove the spybot-hosts-entries on the same place? Thomas

2006-06-11, 03:05	#5
esman01 Junior Member Join Date: Dec 2005 Posts: 13	Cosmo: I want to modify / change the host file by adding the latest SS&D host file items. User account is Admin level on both machines. I was last able to do it a few weeks back on my machine. Earlier today I was able to do it in safe mode, so I am guessing one of the security programs- Zone Alarm firewall, Microsoft's Windows Defender, Spybot Search & Destroy, Ad-Aware, or SpywareBlaster is blocking the change. I think it is the same program on both machines, so I am ruling out the anti-virus programs (AVG anti-virus on mine, Norton anti-virus on customer's). I am not aware of any Windows Update that is preventing changes to the Hosts file. In researching this, I found that Zone Alarm firewall added a Lock Host File feature with one of their latest updates. Firewall tab > Advanced > Lock Hosts File. This feature is unchecked / disabled by default, and it was unchecked / disabled on both machines. Spybot S&D also has a Hosts file locking feature mentioned in previous posts. It also was unchecked / disabled on both machines. I am unclear about Windows Defender. I looked at Tools > General Settings and did not see anything specially about Hosts files locking. I am under the impression that it would alert me. I am not getting an alert, but I am getting an "Access is Denied" error message when I try to change the Hosts file in normal mode. I do not think SpywareBlaster is blocking it either, unless that is a recent change. In opening the Hosts file, only the Spybot S&D Hosts list has been added, so that is why I am thinking it was related to SS&D, but I have not confirmed this. I tried using WhoLockMe & Unlocker, and nothing appeared to be locking it. I am now considering this as an inconvenience, since I am able to make changes in safe mode, and I do not think virus / spyware / other malware would be able to make changes while in normal mode. I hope this information is useful and accurate. I would appreciate any additional comments. Thanks.

2006-06-11, 06:02	#6
esman01 Junior Member Join Date: Dec 2005 Posts: 13	I just installed the 06-10-06 SS&D updates, closed and then restarted SS&D, then tried to add the SS&D Hosts lists and it worked. I had also changed Windows Defender to alert me of changes from allowed programs, and it did. I then had Windows Defender allow the change. I have another customer's machine than I am fixing. I installed Spybot S&D on that one, along with SpywareBlaster, Windows Defender, and Ad-Aware, but not ZoneAlarm firewall, and I was able to install the SS&D Hosts file, with the latest updates (dated 06-10-06) on that machine with no problems. I was thinking that maybe the ZoneAlarm firewall was preventing the change. Now I am not sure. Wonder if the latest updates from SS&D fixed the problem? Anyways, I think the issue is resolved.

2006-06-13, 16:49	#8
esman01 Junior Member Join Date: Dec 2005 Posts: 13	enoskype: Thank you for your comments. I ran your temporary solution and it was exactly as you described it, confirming that it is ZoneAlarm causing the problem. Have you contacted ZoneLabs? I posted in the ZoneAlarm forum under Security Issues. Here is the link (if their moderators do not move it to a different section): http://forum.zonelabs.org/zonelabs/b...ssage.id=15537 Thanks again.

2006-06-26, 20:53	#10
esman01 Junior Member Join Date: Dec 2005 Posts: 13	You can try restarting in safe mode. ZA does not load in safe mode. If you cannot alter the hosts file in safe mode, then I would guess that something else is preventing changes.