Host file - Access is Denied

[esman01]

I am receiving a "Cannot create file "C:\Windows\System\drivers\etc\hosts". Access is denied" error message on both a customer's computer as well as my own computer. Neither has TeaTimer nor IE Tweaks - Lock hosts file read-only protection against hijackers selected. I thought that the customer's computer might still have some sort of malware on it, but when my own computer, which is clean, can not modify the hosts file, I thought I would post a message here. On my computer, I previously added the Spybot hosts list - updated that a few weeks back. Could there be a problem with one of the latest updates?

Customer's PC has NAV 2005, ZA FW, SS&D, Ad-Aware SE Pro (w/ Ad-watch disabled) & CCleaner & SpywareBlaster installed. Cleaned up w/ HJT, ran Ewido, F-Secure, & PestScan online scans, as well as X-Cleaner & F-Secure's Blacklight Rootkit scans. Everything is coming up clean.

Thank you for your help.

[md usa spybot fan]

When you go into Spybot > Mode > Advanced Mode > Tools > Hosts File and do an "Add Spybot-S&D hosts list", Spybot also appears to "lock" the HOSTS file by setting the attributes on the HOSTS file to read-only.

If you do not want the read-only attribute set on the HOSTS file after doing a "Add Spybot-S&D hosts list", go into Spybot > Mode > Advanced Mode > Tools > IE Tweaks. Under "Miscellaneous locks" uncheck the following:

• Lock Hosts file read-only as protection against hijackers.

[esman01]

Thank you for your prompt reply. I must not have been clear in my original post. IE Tweaks - Lock hosts file read-only protection against hijackers has been unselected on both machines.

[Cosmo]

Hi esman01,

what is the situation, where the access is denied for the hosts-file? Do you want to read or write / change (whatever)? Has the respevtive user on both machines admin-privilges oder limited user rights?

Understanding you correctly, you have added the spybot-hosts lists some weeks ago; so, this would mean, you had write-acces at that time (?) or an error message. If this worked correctly, can you remove the spybot-hosts-entries on the same place?

Thomas

[esman01]

Cosmo:
I want to modify / change the host file by adding the latest SS&D host file items. User account is Admin level on both machines.

I was last able to do it a few weeks back on my machine. Earlier today I was able to do it in safe mode, so I am guessing one of the security programs- Zone Alarm firewall, Microsoft's Windows Defender, Spybot Search & Destroy, Ad-Aware, or SpywareBlaster is blocking the change. I think it is the same program on both machines, so I am ruling out the anti-virus programs (AVG anti-virus on mine, Norton anti-virus on customer's). I am not aware of any Windows Update that is preventing changes to the Hosts file.

In researching this, I found that Zone Alarm firewall added a Lock Host File feature with one of their latest updates. Firewall tab > Advanced > Lock Hosts File. This feature is unchecked / disabled by default, and it was unchecked / disabled on both machines.

Spybot S&D also has a Hosts file locking feature mentioned in previous posts. It also was unchecked / disabled on both machines.

I am unclear about Windows Defender. I looked at Tools > General Settings and did not see anything specially about Hosts files locking. I am under the impression that it would alert me. I am not getting an alert, but I am getting an "Access is Denied" error message when I try to change the Hosts file in normal mode.

I do not think SpywareBlaster is blocking it either, unless that is a recent change. In opening the Hosts file, only the Spybot S&D Hosts list has been added, so that is why I am thinking it was related to SS&D, but I have not confirmed this.

I tried using WhoLockMe & Unlocker, and nothing appeared to be locking it.

I am now considering this as an inconvenience, since I am able to make changes in safe mode, and I do not think virus / spyware / other malware would be able to make changes while in normal mode.

I hope this information is useful and accurate. I would appreciate any additional comments. Thanks.

[esman01]

I just installed the 06-10-06 SS&D updates, closed and then restarted SS&D, then tried to add the SS&D Hosts lists and it worked. I had also changed Windows Defender to alert me of changes from allowed programs, and it did. I then had Windows Defender allow the change.

I have another customer's machine than I am fixing. I installed Spybot S&D on that one, along with SpywareBlaster, Windows Defender, and Ad-Aware, but not ZoneAlarm firewall, and I was able to install the SS&D Hosts file, with the latest updates (dated 06-10-06) on that machine with no problems. I was thinking that maybe the ZoneAlarm firewall was preventing the change. Now I am not sure. Wonder if the latest updates from SS&D fixed the problem? Anyways, I think the issue is resolved.

[enoskype]

Hi esman01,

I had exatly the same problem with SS&D, and after reading your comments here, with exatly the same softwares installed,SS&D,SpywareBlaster,Windows Defender,Ad-Aware, ZonaAlarm, I have found out that the latest ZoneAlarm version:6.5.700.000 locks the hosts file. Must be a bug. Even with the lock host file checkbox unchecked, it does lock the host file.

Temporary solution:
ZoneAlarm->Firewall->Advanced->''check the lock host file check box''->OK->Advanced->''uncheck the the lock host file check box''->OK----------> host file is unlocked for SS&D to update.

It is temporary because next time ZoneAlarm starts up with Windows restart, checkbox is unchecked but the hosts file is locked again.
You have to repeat steps above.

The issue is still pending.
Thanks.

[esman01]

enoskype:

Thank you for your comments. I ran your temporary solution and it was exactly as you described it, confirming that it is ZoneAlarm causing the problem. Have you contacted ZoneLabs? I posted in the ZoneAlarm forum under Security Issues. Here is the link (if their moderators do not move it to a different section): http://forum.zonelabs.org/zonelabs/b...ssage.id=15537

Thanks again.

[suebaby41]

The temporary fix did not work for me. Any other suggestions?

[esman01]

You can try restarting in safe mode. ZA does not load in safe mode. If you cannot alter the hosts file in safe mode, then I would guess that something else is preventing changes.