Can't get rid of SettingsModifier:Win32/HostsFileHijack

Windows Defender says I have a virus & can't get rid of it. I get the message under Protection History that it's severe. Supposedly, it was found yesterday, 7/24/20 about 8PM. First, I chose Quarantine, but nothing happened. Then I chose remove, but nothing happened.

My actual hosts file wasn't modified since 6/15/20, so I don't know where this virus is...or even if it's a false alarm. Here is the image I get:


Not sure what to do. I also tried to update my host file using Hostman, and got the message of no new updates. However, it also said "Unknown error loading hosts file".

I just tried opening the hosts file with BlueLife Hosts Editor, but it was blank & every time I try, I get a message that Windows Defender found threats.

Any suggestions?

OldNavyGuy said:

Click on Actions and remove it.

I did before I posted. And I got a message that Defender couldn't.

Somehow, I took away the read only attribute, saved it in BlueLife. However, now my hosts file is empty & Hostman won't update it.

See this page to download zipped HostsFile: How To: Download and Extract the HOSTS file

Jacee said:

See this page to download zipped HostsFile: How To: Download and Extract the HOSTS file

Thank you for your advice. I've seen that page before. I don't know if that hosts file is old, as they don't talk about Win10, but I'll check it out.

OldNavyGuy said:

Download and run Nirsoft's ShadowCopyView.

https://www.nirsoft.net/utils/shadow_copy_view.html

Open the most recent Shadow Copy in the list.

Navigate to C:\Windows\System32\drivers\etc

Extract the Hosts file.

Thank you again. I'll try this. I need to leave right now, but I'll let you know what happens.

Additional: I just realized that I have the deleted hosts file in Macrium Reflect from this morning. Copied the file over. I set Windows Defender to "Allow...on this computer" & the notices have stopped. I realize that this wouldn't be advisable if it were a virus, but others have said this is a false alarm...although I don't know why others on this site haven't mentioned it.

This is probably not an infection. Latest updates to Defender triggers any change of hosts file as possible unwanted change...

forums malwarebytes hostsfilehijack

AndreTen said:

This is probably not an infection. Latest updates to Defender triggers any change of hosts file as possible unwanted change...

forums malwarebytes hostsfilehijack

I found another forum also where someone said this was a false positive. Thanks for this.

Well if Defender detects your own Hosts file modifications then you'll have to figure out how to exclude it.

I don't use Defender so cannot help.

Re: Hosts file permissions.

Download Hosts-perm.bat

Will PM you a link.

Jacee said: See this page to download zipped HostsFile: How To: Download and Extract the HOSTS file

Please scroll down and read all .... it does talk about Windows 10!

For Windows 10/8 users ...

You can follow the above instructions, but the Save As box is different. After extracting the HOSTS file, right-click on the "mvps.bat" and select: