1

Before someone goes and marks this as a duplicate, please understand that I have tried all of the following:

  1. Running notepad as an administrator, editing the file and attempting to save. No luck.
  2. Copying the hosts file to another folder, editing the file and attempting to replace/overwrite the original. No luck.
  3. Unchecking the read-only option in file properties. Wasn't set so no luck.
  4. Seeing what is using the file in SysInternals Process Explorer. Here's what I see. Doesn't look out of the ordinary. Please respond if you disagree.

Process Explorer search results for hosts file

  1. Taking ownership of the hosts file using the Security tab of the file properties. No luck.
  2. Taking ownership of the etc folder that contains the hosts file using the Security tab of the folder properties. No luck.
  3. Trying to use the administrative mode of Notepad++ to save the file. No luck.

Any other ideas?

jlavallet
  • 131
  • 5
  • I am looking around about this. I can edit / save HOSTS with Notepad or UltraEdit run as Admin. Are you sure you are editing HOSTS (not one of the other files in that folder). Are you using the folder C:\Windows\System32\drivers\etc ? Did you restart your computer before trying this? I use HOST and have items in there for mapping folders so I have used this. – John Mar 15 '21 at 18:04
  • Yes, I am positive I am trying to edit the C:\Windows\System32\drivers\etc\hosts file. I have restarted a couple of times. I am beginning to suspect a utility that I have called Logon Expert (https://logonexpert.com). I have tried stopping its service. I have tried killing off the two processes shown in Process Explorer (both kill off the taskbar and other file Explorer windows). I have one more idea - I'm going to reboot and go into safe mode and see if I can save the file. I will report back in a few minutes. – jlavallet Mar 15 '21 at 18:16
  • See what happens in Safe Mode. I do not use the utility you have. – John Mar 15 '21 at 18:18
  • First of all @John .. 100+ points for ULTRAEDIT :) .. :) .. :) .. I have the same EXACT experience as you do. Works fine. I even tried it with notepad++ and notepad (original).. as long as I run it with the proper permissions.. IT JUST WORKS for me. I am also NOT USING "LogonExpert" .. in fact >I< am the logon expert.. I don't trust utilities like that. – Señor CMasMas Mar 15 '21 at 18:36
  • It may be that you have a virus solution that actively blocks editing of the hostsfile. For example I know that Webroot has this setting. What I always do is this: Copy hosts to c:\temp, edit it there and save, then copy the file and paste it in the right folder. Windows UAC pops up and you hit Yes to copy. At this point, either it succesfully overwrites the file or you get an error telling you exactly why its not working. For example: File in use by other process aka virus scanner protection) – LPChip Mar 15 '21 at 19:27
  • It's like the hosts file is locked/protected by your antivirus program or other security software. – DavidPostill Mar 15 '21 at 19:41
  • 1
    [This](https://superuser.com/questions/968359/windows-10-hosts-file-used-by-another-process?rq=1) indicates that would be a likely reason. – Ramhound Mar 15 '21 at 19:53
  • You could gather a boot Process Monitor trace with a path filter for the file. Maybe see which processes are opening it prior to you trying to overwrite the file Do include the system process which is disabled by default. – HelpingHand Mar 15 '21 at 20:44
  • We need first to know what happens in Safe Mode. – harrymc Mar 15 '21 at 20:48
  • Sorry for the late reply. I had intended to come back to this as soon as I tried safe mode. Well, I'm back now and I have resolved the issue through safe mode but I'm not satisfied with that. Here's what I experienced. At first I selected safe mode with networking out of habit. I had the same problem. I could not save the file and I could not overwrite the file. Then I switched to safe mode (without networking) and I was able to save (technically overwrite) the file. So what's going on? – jlavallet Mar 16 '21 at 00:05
  • Uninstall Logon Expert completely, restart and test. See if you can edit normally. – John Mar 16 '21 at 01:36
  • I suppose that makes lots of sense. I will give them a try if I have time today. Thanks for the ideas. – jlavallet Mar 16 '21 at 12:29

1 Answers1

0

So as it turns out, I skipped over a suggestion because I didn't think it had merit. I was wrong...

@Ramhound had the clue that I needed in the post he provided.

A solution in that post suggested running Process Explorer as Administrator and then searching for the hosts file. As soon as I did I saw this:

Process Explorer Search showing Hosts file using processes including WRSA.exe

Note the WRSA.exe process that was not in my original screenshot. This is Webroot with a hand firmly grasping the hosts file.

And continuing to read that solution, it became clear that Webroot was the culprit.

I opened Webroot and searched for the setting alluded to. Here's what I found:

Webroot > Advanced > Shields > Prevent any program from modifying the HOSTS file.

After unchecking the box, I was able to save my hosts file in an elevated notepad++ session.

So here is the kicker. There is a difference in the implementations of Webroot on Windows Home and Windows Professional.

I am used to working on Windows Professional. There is no problem saving your hosts file in an elevated notepad/notepad++ session on Windows Professional.

If you are using Webroot on Windows Home, however, it appears that you must uncheck this box to be able to save changes to your hosts file.

jlavallet
  • 131
  • 5