Learning how to fix hosts file modified by malware is one of the fastest ways to regain control of a PC that suddenly blocks security websites or sends familiar sites to strange pages. The hosts file is a small text file that tells Windows which IP address to use for a website name, and malware loves to tamper with it. The fix takes about 15 minutes when done in the right order: clean the infection, repair the file, then close the doors it came through.
Key Takeaways
- The hosts file lives at C:\Windows\System32\drivers\etc\hosts and should normally contain only comment lines that start with a # symbol.
- Scan for malware first, then repair the file. Fixing the file alone lets the infection rewrite it.
- Notepad must be opened as administrator, or Windows will refuse to save the repaired file.
- After the repair, flush the DNS cache and check startup items, browser extensions, and proxy settings for leftovers.
- If banking or email sites were being redirected, change those passwords from a clean device.
Common Causes of a Hacked Hosts File
Malware edits the hosts file because it is a quiet and effective trick. Windows checks this file before it asks any DNS server, so one added line can override the real address of a website. Think of it like a handwritten sticky note on a phone book that says to call a different number for one contact. The phone book itself looks untouched.
How the File Usually Gets Changed
- Trojans and browser hijackers that run with administrator rights after a fake installer or a malicious email attachment.
- Adware bundled with free software, cracked programs, or keygens.
- Scripts launched from phishing pages that trick the user into approving a prompt.
- Rogue browser extensions that install a helper program in the background.
Signs the Hosts File Has Been Changed
- Antivirus, Windows Update, or Microsoft websites will not load while other sites work fine.
- A bank, search engine, or social media site opens a page that looks slightly wrong, or shows certificate warnings.
- Pop-ups or redirects appear only when visiting certain sites.
- Windows Security reports a hosts file hijack or modification.
Some legitimate programs also edit this file, including ad blockers, VPN software, Docker, and developer tools. An entry is only suspicious when it points a well-known website to an unfamiliar address or blocks security sites.
Before You Start
This is a software repair, so no disassembly is needed. A few basics keep it safe and smooth:
- An administrator account on the affected PC.
- Notepad, which is already included with Windows.
- Microsoft Defender (Windows Security), plus optionally a second-opinion scanner such as Malwarebytes.
- A clean phone or second computer for downloading tools and changing passwords if the infected PC cannot reach those sites.
Tip: Copy the hosts file to the desktop before editing anything. A backup, even of a damaged file, makes it easy to undo a wrong change.
If the file keeps coming back changed after a full cleanup, or Windows will not let any security tool run, stop and have a professional technician inspect the PC. A clean reinstall of Windows is sometimes the only reliable answer for a stubborn infection.
How to Fix Hosts File Modified by Malware Step by Step
- Step 1: Disconnect from the internet by turning off Wi-Fi or unplugging the Ethernet cable. This stops redirected sites from loading and limits what the malware can send out while the repair is underway.
- Step 2: Open Windows Security, go to Virus and threat protection, choose Scan options, and run a Full scan. For malware that hides from normal scans, choose Microsoft Defender Offline scan, which restarts the PC and scans before Windows fully loads. Running a second scanner such as Malwarebytes afterward catches what the first one missed. Quarantine or remove everything flagged.
- Step 3: Click Start, type Notepad, right-click it, and choose Run as administrator. Approve the prompt. Without this, saving the repaired file will fail.
- Step 4: In Notepad, choose File, then Open. Paste C:\Windows\System32\drivers\etc into the address bar and press Enter. Change the file type dropdown from Text Documents (*.txt) to All Files (*.*), then open the file named hosts. It has no file extension.
- Step 5: Read the file carefully. Lines that begin with # are harmless comments. Any line that does not start with # is an active entry, made of an IP address followed by a website name. Malicious entries often point sites like search engines, banks, or antivirus vendors to an unfamiliar IP address, or point security sites to 0.0.0.0 or 127.0.0.1 so they cannot load.
- Step 6: Scroll all the way to the bottom. Malware sometimes adds a large block of blank lines so the bad entries sit far below the visible area. Turning on Format, then Word Wrap, also helps reveal long lines.
- Step 7: Delete every entry you did not add on purpose. If the file is full of unknown lines, the cleanest option is to remove everything except the comment lines. A hosts file with only comments, or even a completely empty hosts file, is perfectly valid and Windows works normally with it.
- Step 8: Choose File, then Save. If Windows says access is denied, close Notepad and reopen it as administrator. If it still fails, right-click the hosts file, open Properties, and clear the Read-only checkbox if it is ticked, then try again.
- Step 9: Open Command Prompt as administrator and run ipconfig /flushdns. This clears the cached bad addresses so the corrected file takes effect right away.
- Step 10: Check for anything that can rewrite the file again. Open Task Manager, go to the Startup apps tab, and disable unknown entries. Review browser extensions and remove any that were not installed on purpose. Also check Settings, then Network and Internet, then Proxy, and turn off any proxy or setup script that was not set by the user.
- Step 11: Reconnect to the internet and test the sites that were blocked or redirected. Run Windows Update, then do one more quick scan to confirm the file stays clean after a restart.
Tip: A hosts file that looks clean but sites still misbehave usually means the problem is elsewhere, most often in the DNS server settings or a browser extension, not in the file itself.
Common Problems and Fixes
The Hosts File Will Not Save
This almost always means Notepad was not launched as administrator. Close it, reopen it using Run as administrator, and load the file again. A Read-only attribute in the file properties can also block saving.
The Bad Entries Keep Coming Back
Something is still running and rewriting the file. Run the Microsoft Defender Offline scan, check the Startup apps tab and Task Scheduler for unknown items, and remove suspicious browser extensions. If it keeps returning after all of that, a clean reinstall of Windows is the safest route.
Security Websites Still Will Not Load
Run ipconfig /flushdns again, then check the DNS server setting on the network adapter. Malware can also change DNS settings or add a proxy, which blocks sites even when the hosts file is clean.
Windows Security Will Not Start or Update
Try the scan from a different method, such as Microsoft Defender Offline, or download a scanner on a clean device and transfer it by USB drive. A threat that disables security tools is a strong sign that a deeper cleanup or a Windows reinstall is needed.
Legitimate Software Stopped Working After the Cleanup
Programs like Docker, a VPN client, or development tools may have added valid entries that were removed. Reinstalling or reopening those apps normally recreates the entries they need.
Frequently Asked Questions
What does the hosts file do in Windows?
The hosts file is a plain text file that maps website names to IP addresses. Windows checks it before asking a DNS server, so any entry in it overrides the normal address for that site.
Where is the hosts file located?
On Windows, it is at C:\Windows\System32\drivers\etc\hosts. The file has no extension. On macOS and Linux, the equivalent file is /etc/hosts.
What should a normal, clean hosts file look like?
A default Windows hosts file contains only comment lines that start with a # symbol. Some versions also include commented-out localhost lines. A completely empty file is also valid and works without problems.
How can you tell if malware modified the hosts file?
Look for active lines (those not starting with #) that point popular sites to unfamiliar IP addresses, or that send antivirus and Windows Update sites to 0.0.0.0 or 127.0.0.1. Symptoms include blocked security sites, odd redirects, and certificate warnings.
Is it safe to delete everything in the hosts file?
Yes, for most home users. Windows runs normally with an empty hosts file or one that contains only comments. The only entries lost would be ones added by programs such as VPNs, ad blockers, or developer tools, and those can be recreated.
Why does Windows say access is denied when saving the hosts file?
The hosts file is protected, so editing it requires administrator rights. Open Notepad using Run as administrator, then open and save the file again. Also check that the Read-only attribute is not ticked in the file properties.
Do I need to flush the DNS cache after fixing the hosts file?
Yes. Running ipconfig /flushdns in an administrator Command Prompt clears cached addresses so Windows stops using the old redirected entries right away.
Can fixing the hosts file alone remove the malware?
No. Repairing the file only treats a symptom. The malware that edited it is still on the PC and can change the file again, so a full antivirus scan and a check of startup items and browser extensions are needed.
Should passwords be changed after a hosts file attack?
If banking, email, or shopping sites were redirected, yes. Change those passwords from a clean device after the PC is cleaned, and turn on two-step verification wherever it is offered.
