The system folder of any operating system is a “dark forest” for the average user. If you are not sure that the problem with the computer lies in it, then it’s better not to touch anything there at all and provide professionals with the opportunity to deal with problems. Today we’ll talk about what threats one small and inconspicuous text file carries. What should the Hosts file look like ? How to distinguish it from a virus?
Definition
To begin with, let's figure out what kind of beast this is - Hosts? This is the file responsible for blocking web pages and redirecting ip addresses. If you register the web address of an Internet resource in it, then the computer user will not be able to access the blocked site or will be redirected to another link indicated in the file.
In fact, this file is used by most system administrators in order to disable social networks for employees at work, as well as to organize parental control and block unwanted sites for children. So if you can’t get to any resource from a working computer, be sure to check the contents of the file first, which we will talk about a little further. So how does the Hosts file look right ?
Content
The main thing that determines the truth of a file and its belonging to the system, and not to viruses, is its contents. More precisely, the text written in it. What should the Hosts file look like in Windows 7 and other OSs from the inside?
To open the file we are studying, use the Notepad program. You will see English-language instructions for using this tool. It consists of 20 lines starting with the symbol "#". Here is sample content:
- The first line contains the rights to the OS. 1993 -... - years of existence of Microsoft. The second number will be the release date of your OS version. You can verify the authenticity of the file by right-clicking on “My Computer - Properties”. There you can find the version and release date of the OS. They must match the file.
- Then there are 10 lines explaining why this file is needed.
- And finally, examples of how to register a lock.
Location
File location also plays an important role. How will the file under consideration fulfill its function if it is not in the right folder?
So, what should the Hosts file look like and where should it be located. Depending on the version of the OS, it may be in different folders, but it will always be the original Windows system:
- For Win98 and ME, the Hosts file is located in the root C: \ WINDOWS.
- On WinXP and later, Hosts is located in the following directory: C: \ WINDOWS \ SYSTEM32 \ DRIVERS \ ETC. This is where the working version of the file is located if you are backing up the system or if it initially contains several switchable versions and patches. Then you can find a second, similar copy of the file, but it will also be in the system folder.
The size
What does the correct Hosts file look like? Its size is also initially determined. If you opened and saw exclusively what was described in the previous paragraph, then the file size will be 824 bytes. Or it will be empty if the instruction was deleted from there.
Any deviation implies that something other than comments was written to the file. On the one hand, these can be sites that are listed there by system administrators. On the other hand, if we are talking about a home computer and you are absolutely sure that no one “chemized” it, you should think about whether this file is a virus.
The main thing is to remember that no antivirus works with the Hosts file. More precisely, security programs block the ability to modify a file by programs from an unknown manufacturer. Thus, no one without your knowledge can enter any information there, block access to your favorite sites or, worse, redirect to a copy of the portal you need, where you can inadvertently enter your personal data that will subsequently get to the attackers. But if this happened, then urgently check your computer for viruses.
Virus
Now you know what the Hosts file should look like. It’s also worthwhile to figure out how it should not look.
- This file is not hidden, that is, by going to the system folder in which it is located, you can always see it. If he tries to disguise himself, this is at least a sign of viral activity.
- If you find it in a folder other than the one indicated above, delete it and it reappears, this should also alert.
Among other things, the registry can help with the question of what the Hosts file should look like. The fact is that the path to the file is written in a very specific directory, and this way you can determine whether the file you found is true or false (virus).
- To see the location of the hosts in the registry, run a command prompt and enter regedit.
- Path: HKEY_LOCAL_MACHINE \ SYSTEM \ CurrentControlSet \ services \ Tcpip \ Parameters
- By clicking on the settings folder, we look to the right. In the parameter list, we are interested in DataBasePath. It is in it that the path to the true Hosts file is registered. Any deviation from this path means that the file you found is a malicious program.
That's all. We sorted out all the features and determined what the Hosts file should actually look like.