can't edit hosts file?

[J. P. Gilliver (John)]

I'm sure I have edited it since moving to W7! But now when I try, I am
told it is in use: "The process cannot access the file because it is
being used by another process." (The process being plain original
NotePad.) If I try to delete it (having made a copy of course!), I get
"The action can't be completed because the file is open in System".

I've just done a restart, and tried again before opening anything I'd
have thought would be using it - no change. Though as I said, I'm sure
I've edited it before, and that _wouldn't_ have been under those
circumstances.

What's using it? "System" isn't very informative - could be a user
rather than a process.

[Char Jackson]

On Thu, 5 Apr 2018 20:04:01 +0100, "J. P. Gilliver (John)"

Post by J. P. Gilliver (John)
I'm sure I have edited it since moving to W7! But now when I try, I am
told it is in use: "The process cannot access the file because it is
being used by another process." (The process being plain original
NotePad.) If I try to delete it (having made a copy of course!), I get
"The action can't be completed because the file is open in System".
I've just done a restart, and tried again before opening anything I'd
have thought would be using it - no change. Though as I said, I'm sure
I've edited it before, and that _wouldn't_ have been under those
circumstances.
What's using it? "System" isn't very informative - could be a user
rather than a process.

Some AV programs will lock the hosts file to prevent malicious editing.
Also, I believe you have to run your editor, Notepad in this case, as
Administrator. If you're already aware of those restrictions, then I'm
not sure what the deal is.

[J. P. Gilliver (John)]

Post by Char Jackson
On Thu, 5 Apr 2018 20:04:01 +0100, "J. P. Gilliver (John)"

Post by J. P. Gilliver (John)
I'm sure I have edited it since moving to W7! But now when I try, I am
told it is in use: "The process cannot access the file because it is
being used by another process." (The process being plain original
NotePad.) If I try to delete it (having made a copy of course!), I get
"The action can't be completed because the file is open in System".
I've just done a restart, and tried again before opening anything I'd
have thought would be using it - no change. Though as I said, I'm sure
I've edited it before, and that _wouldn't_ have been under those
circumstances.
What's using it? "System" isn't very informative - could be a user
rather than a process.

Some AV programs will lock the hosts file to prevent malicious editing.
Also, I believe you have to run your editor, Notepad in this case, as
Administrator. If you're already aware of those restrictions, then I'm
not sure what the deal is.

I've tried this - running Notepad as administrator, and turning off AVG.
I still get "...cannot access the file because it is being used by
another process."

[Ed Cryer]

Post by J. P. Gilliver (John)

Post by Char Jackson
On Thu, 5 Apr 2018 20:04:01 +0100, "J. P. Gilliver (John)"

Post by J. P. Gilliver (John)
I'm sure I have edited it since moving to W7! But now when I try, I am
told it is in use: "The process cannot access the file because it is
being used by another process." (The process being plain original
NotePad.) If I try to delete it (having made a copy of course!), I get
"The action can't be completed because the file is open in System".
I've just done a restart, and tried again before opening anything I'd
have thought would be using it - no change. Though as I said, I'm sure
I've edited it before, and that _wouldn't_ have been under those
circumstances.
What's using it? "System" isn't very informative - could be a user
rather than a process.

Some AV programs will lock the hosts file to prevent malicious editing.
Also, I believe you have to run your editor, Notepad in this case, as
Administrator. If you're already aware of those restrictions, then I'm
not sure what the deal is.

I've tried this - running Notepad as administrator, and turning off AVG.
I still get "...cannot access the file because it is being used by
another process."

Try using Process Explorer to see what's got it tied up; Find tab, Find
Handle or DLL.
In Windows 7 the hosts file is;
C:\Windows\System32\drivers\etc\hosts

Ed

[Auric__]

Post by Char Jackson
On Thu, 5 Apr 2018 20:04:01 +0100, "J. P. Gilliver (John)"

Post by J. P. Gilliver (John)
I'm sure I have edited it since moving to W7! But now when I try, I am
told it is in use: "The process cannot access the file because it is
being used by another process." (The process being plain original
NotePad.) If I try to delete it (having made a copy of course!), I get
"The action can't be completed because the file is open in System".
I've just done a restart, and tried again before opening anything I'd
have thought would be using it - no change. Though as I said, I'm sure
I've edited it before, and that _wouldn't_ have been under those
circumstances.
What's using it? "System" isn't very informative - could be a user
rather than a process.

Some AV programs will lock the hosts file to prevent malicious editing.
Also, I believe you have to run your editor, Notepad in this case, as
Administrator. If you're already aware of those restrictions, then I'm
not sure what the deal is.

If you have Sysinternals Process Explorer, search for "hosts" (Ctrl+F) and
it'll show you what has it open. You can close the handle from the lower main
pane (Ctrl+L). (You may need to "Show Details for All Processes".)

(Any program with similar capabilities should be able to do this.)

Otherwise, try rebooting to safe mode and editing there.

[J. P. Gilliver (John)]

Post by Auric__

Post by Char Jackson
On Thu, 5 Apr 2018 20:04:01 +0100, "J. P. Gilliver (John)"

Post by J. P. Gilliver (John)
I'm sure I have edited it since moving to W7! But now when I try, I am
told it is in use: "The process cannot access the file because it is
being used by another process." (The process being plain original
NotePad.) If I try to delete it (having made a copy of course!), I get
"The action can't be completed because the file is open in System".
I've just done a restart, and tried again before opening anything I'd
have thought would be using it - no change. Though as I said, I'm sure
I've edited it before, and that _wouldn't_ have been under those
circumstances.
What's using it? "System" isn't very informative - could be a user
rather than a process.

Some AV programs will lock the hosts file to prevent malicious editing.
Also, I believe you have to run your editor, Notepad in this case, as
Administrator. If you're already aware of those restrictions, then I'm
not sure what the deal is.

If you have Sysinternals Process Explorer, search for "hosts" (Ctrl+F) and
it'll show you what has it open. You can close the handle from the lower main
pane (Ctrl+L). (You may need to "Show Details for All Processes".)
(Any program with similar capabilities should be able to do this.)
Otherwise, try rebooting to safe mode and editing there.

Thanks, you and Ed. Excellent idea. Then I found my Process Explorer
won't work! I've extracted it again from the .zip file I downloaded (and
yes, it _did_ work then!); I run it, I get the UAC popup, I click Run in
that, and - nothing happens. And there's nothing beginning with P in
Task Manager other than Panorama.

[Mayayana]

"J. P. Gilliver (John)" <G6JPG-***@255soft.uk> wrote

| Thanks, you and Ed. Excellent idea. Then I found my Process Explorer
| won't work! I've extracted it again from the .zip file I downloaded (and
| yes, it _did_ work then!); I run it, I get the UAC popup, I click Run in
| that, and - nothing happens. And there's nothing beginning with P in
| Task Manager other than Panorama.

Sounds fishy to me. Your software generally
works but editing HOSTS and running ProcExp
are blocked? I'd suspect some kind of sneaky
thing had got onto the system.

If it were me I'd first shut off UAC and if that
didn't clear things up I'd try downloading some
malware/AV products. (Many of them can be
downloaded as free packages for emergency use.)

The only other thing I can think of would be if you
had somehow screwed up file restrictions.... maybe
logging on as Guest or some such? But you have a
lot of experience. I can't think of anything you
might have done accidentally.
It's an interesting mystery.

[Paul]

Post by Mayayana
| Thanks, you and Ed. Excellent idea. Then I found my Process Explorer
| won't work! I've extracted it again from the .zip file I downloaded (and
| yes, it _did_ work then!); I run it, I get the UAC popup, I click Run in
| that, and - nothing happens. And there's nothing beginning with P in
| Task Manager other than Panorama.
Sounds fishy to me. Your software generally
works but editing HOSTS and running ProcExp
are blocked? I'd suspect some kind of sneaky
thing had got onto the system.
If it were me I'd first shut off UAC and if that
didn't clear things up I'd try downloading some
malware/AV products. (Many of them can be
downloaded as free packages for emergency use.)
The only other thing I can think of would be if you
had somehow screwed up file restrictions.... maybe
logging on as Guest or some such? But you have a
lot of experience. I can't think of anything you
might have done accidentally.
It's an interesting mystery.

I think Kaspersky blocks about half of the
Sysinternals programs. As an example.

And even without an AV, you can use SRP in the
OS, to block particular things. SRP was used to
block the first round of Ransomware (before the
Ransomware became more sophisticated and borrowed
techniques from existing malware).

Paul

[Ed Cryer]

Post by J. P. Gilliver (John)

Post by Auric__

Post by Char Jackson
On Thu, 5 Apr 2018 20:04:01 +0100, "J. P. Gilliver (John)"

Post by J. P. Gilliver (John)
I'm sure I have edited it since moving to W7! But now when I try, I am
told it is in use: "The process cannot access the file because it is
being used by another process." (The process being plain original
NotePad.) If I try to delete it (having made a copy of course!), I get
"The action can't be completed because the file is open in System".
I've just done a restart, and tried again before opening anything I'd
have thought would be using it - no change. Though as I said, I'm sure
I've edited it before, and that _wouldn't_ have been under those
circumstances.
What's using it? "System" isn't very informative - could be a user
rather than a process.

Some AV programs will lock the hosts file to prevent malicious editing.
Also, I believe you have to run your editor, Notepad in this case, as
Administrator. If you're already aware of those restrictions, then I'm
not sure what the deal is.

If you have Sysinternals Process Explorer, search for "hosts" (Ctrl+F) and
it'll show you what has it open. You can close the handle from the lower main
pane (Ctrl+L). (You may need to "Show Details for All Processes".)
(Any program with similar capabilities should be able to do this.)
Otherwise, try rebooting to safe mode and editing there.

Thanks, you and Ed. Excellent idea. Then I found my Process Explorer
won't work! I've extracted it again from the .zip file I downloaded (and
yes, it _did_ work then!); I run it, I get the UAC popup, I click Run in
that, and - nothing happens. And there's nothing beginning with P in
Task Manager other than Panorama.

Try running it as Administrator.
If that doesn't work, look here;
https://support.microsoft.com/en-us/help/816683/process-explorer-from-sysinternals-does-not-start

If it's still unfixed after that, then do a comprehensive check of what
else is shut out; and then let us know.

Ed

[Ed Cryer]

Post by Ed Cryer

Post by J. P. Gilliver (John)

Post by Auric__

Post by Char Jackson
On Thu, 5 Apr 2018 20:04:01 +0100, "J. P. Gilliver (John)"

Post by J. P. Gilliver (John)
I'm sure I have edited it since moving to W7! But now when I try, I am
told it is in use: "The process cannot access the file because it is
being used by another process." (The process being plain original
NotePad.) If I try to delete it (having made a copy of course!), I get
"The action can't be completed because the file is open in System".
I've just done a restart, and tried again before opening anything I'd
have thought would be using it - no change. Though as I said, I'm sure
I've edited it before, and that _wouldn't_ have been under those
circumstances.
What's using it? "System" isn't very informative - could be a user
rather than a process.

Some AV programs will lock the hosts file to prevent malicious editing.
Also, I believe you have to run your editor, Notepad in this case, as
Administrator. If you're already aware of those restrictions, then I'm
not sure what the deal is.

If you have Sysinternals Process Explorer, search for "hosts" (Ctrl+F) and
it'll show you what has it open. You can close the handle from the lower main
pane (Ctrl+L). (You may need to "Show Details for All Processes".)
(Any program with similar capabilities should be able to do this.)
Otherwise, try rebooting to safe mode and editing there.

Thanks, you and Ed. Excellent idea. Then I found my Process Explorer
won't work! I've extracted it again from the .zip file I downloaded
(and yes, it _did_ work then!); I run it, I get the UAC popup, I click
Run in that, and - nothing happens. And there's nothing beginning with
P in Task Manager other than Panorama.

Try running it as Administrator.
If that doesn't work, look here;
https://support.microsoft.com/en-us/help/816683/process-explorer-from-sysinternals-does-not-start
If it's still unfixed after that, then do a comprehensive check of what
else is shut out; and then let us know.
Ed

A useful help in cases like this is to find what file permissions are
available.
Proxexp.exe Properties, Security tag.
Mine has full for System and Administrators; all but that for
Authenticated Users.

Ed

[J. P. Gilliver (John)]

In message <pa7mms$s3q$***@dont-email.me>, Ed Cryer
<***@somewhere.in.the.uk> writes:
[]

Post by Ed Cryer

Post by J. P. Gilliver (John)
Thanks, you and Ed. Excellent idea. Then I found my Process Explorer
won't work! I've extracted it again from the .zip file I downloaded
(and yes, it _did_ work then!); I run it, I get the UAC popup, I
click Run in that, and - nothing happens. And there's nothing
beginning with P in Task Manager other than Panorama.

Try running it as Administrator.

It did, thanks!

I've just modified the properties of the shortcut to run as
administrator, and that works too.
[]

[Good Guy]

could be a user rather than a process.

Yes it's a user who has very serious demented brain.

To edit a host file you need to drag it to your desktop (i.e. move it)
and then edit it. after editing it, drag it back to its original location.

Voila it works. It wasn't difficult was it, old man?

/--- This email has been checked for viruses by
Windows Defender software.
//https://www.microsoft.com/en-gb/windows/comprehensive-security/

[slate_leeper]

Post by Good Guy

could be a user rather than a process.

Yes it's a user who has very serious demented brain.
To edit a host file you need to drag it to your desktop (i.e. move it)
and then edit it. after editing it, drag it back to its original location.
Voila it works. It wasn't difficult was it, old man?

I have always edited it directly in the original location, but since I
change it fairly often, I now have a link to it on the desktop, and
open it with right-click "Open with notepad."

[J. P. Gilliver (John)]

Post by slate_leeper

Post by Good Guy

could be a user rather than a process.

Yes it's a user who has very serious demented brain.

(I think bad guy has a mirror.)

Post by slate_leeper

Post by Good Guy
To edit a host file you need to drag it to your desktop (i.e. move it)
and then edit it. after editing it, drag it back to its original location.
Voila it works. It wasn't difficult was it, old man?

I have always edited it directly in the original location, but since I
change it fairly often, I now have a link to it on the desktop, and
open it with right-click "Open with notepad."

Me too. Well, I have a shortcut to NotePad+, with hosts as a parameter
(i. e. the shortcut's Target line is
C:\Windows\Notepad+.exe C:\WINDOWS\system32\drivers\etc\hosts. [and its
startup line is %HOMEDRIVE%%HOMEPATH%, though that's probably not
necessary]). That saves the right-click and open with step.

[Bob_S]

I'm sure I have edited it since moving to W7! But now when I try, I am told
it is in use: "The process cannot access the file because it is being used
by another process." (The process being plain original NotePad.) If I try
to delete it (having made a copy of course!), I get "The action can't be
completed because the file is open in System".
I've just done a restart, and tried again before opening anything I'd have
thought would be using it - no change. Though as I said, I'm sure I've
edited it before, and that _wouldn't_ have been under those circumstances.
What's using it? "System" isn't very informative - could be a user rather
than a process.

Are you sure you have enabled hidden files and that you have the correct
HOSTS file (uppercase and no extension).

It is in the C:\Windows\System32\drivers\etc directory. You may have other
hosts or HOSTS.xxx files with some extension.

[J. P. Gilliver (John)]

Post by J. P. Gilliver (John)

Post by J. P. Gilliver (John)
I'm sure I have edited it since moving to W7! But now when I try, I am
told it is in use: "The process cannot access the file because it is

[]

Post by J. P. Gilliver (John)
What's using it? "System" isn't very informative - could be a user

Post by J. P. Gilliver (John)
rather than a process.

Are you sure you have enabled hidden files and that you have the
correct HOSTS file (uppercase and no extension).

Yes; because it's in such an obscure place and has no extension, I have
a shortcut set up, that opens NotePad+ directly on it. (I don't think
the case matters for such a short filename ...

Post by J. P. Gilliver (John)
It is in the C:\Windows\System32\drivers\etc directory. You may have
other hosts or HOSTS.xxx files with some extension.

... but it's the only hosts file in there anyway.) I _have_ edited it
before; that's why I set up the shortcut.

[jetjock]

On Fri, 6 Apr 2018 02:28:29 +0100, "J. P. Gilliver (John)"

Post by J. P. Gilliver (John)

Post by J. P. Gilliver (John)

Post by J. P. Gilliver (John)
I'm sure I have edited it since moving to W7! But now when I try, I am
told it is in use: "The process cannot access the file because it is

[]

Post by J. P. Gilliver (John)
What's using it? "System" isn't very informative - could be a user

Post by J. P. Gilliver (John)
rather than a process.

Are you sure you have enabled hidden files and that you have the
correct HOSTS file (uppercase and no extension).

Yes; because it's in such an obscure place and has no extension, I have
a shortcut set up, that opens NotePad+ directly on it. (I don't think
the case matters for such a short filename ...

Post by J. P. Gilliver (John)
It is in the C:\Windows\System32\drivers\etc directory. You may have
other hosts or HOSTS.xxx files with some extension.

... but it's the only hosts file in there anyway.) I _have_ edited it
before; that's why I set up the shortcut.

John,

Try "unlocker" to see if something has really locked the file. Will
all allow you to unlock, rename, move or delete the file.

https://unlocker.en.softonic.com/?ex=REG-60.2

[Auric__]

Post by Bob_S
Are you sure you have enabled hidden files and that you have the correct
HOSTS file (uppercase and no extension).

As a general rule, Windows isn't case-sensitive. It shouldn't matter if it's
"hosts" or "HOSTS" or even something silly like "HoStS".

[Char Jackson]

On Fri, 6 Apr 2018 03:25:29 -0000 (UTC), "Auric__"

Post by Auric__

Post by Bob_S
Are you sure you have enabled hidden files and that you have the correct
HOSTS file (uppercase and no extension).

As a general rule, Windows isn't case-sensitive. It shouldn't matter if it's
"hosts" or "HOSTS" or even something silly like "HoStS".

Agreed, and for the record, the default is lower case for this file. I'm
not sure why Bob mentioned uppercase.

[Auric__]

Post by Char Jackson
On Fri, 6 Apr 2018 03:25:29 -0000 (UTC), "Auric__"

Post by Auric__

Post by Bob_S
Are you sure you have enabled hidden files and that you have the
correct HOSTS file (uppercase and no extension).

As a general rule, Windows isn't case-sensitive. It shouldn't matter if
it's "hosts" or "HOSTS" or even something silly like "HoStS".

Agreed, and for the record, the default is lower case for this file.

It's lowercase in systems that *are* case-sensitive. Both my Mac and my Linux
server have /etc/hosts.

Post by Char Jackson
I'm not sure why Bob mentioned uppercase.

In older systems -- 9x and NT3/4 -- the sample hosts files were uppercase.
(HOSTS.SAM) Shrug.

[Char Jackson]

On Fri, 6 Apr 2018 05:00:06 -0000 (UTC), "Auric__"

Post by Auric__

Post by Char Jackson
On Fri, 6 Apr 2018 03:25:29 -0000 (UTC), "Auric__"

Post by Auric__

Post by Bob_S
Are you sure you have enabled hidden files and that you have the
correct HOSTS file (uppercase and no extension).

As a general rule, Windows isn't case-sensitive. It shouldn't matter if
it's "hosts" or "HOSTS" or even something silly like "HoStS".

Agreed, and for the record, the default is lower case for this file.

It's lowercase in systems that *are* case-sensitive. Both my Mac and my Linux
server have /etc/hosts.

Post by Char Jackson
I'm not sure why Bob mentioned uppercase.

In older systems -- 9x and NT3/4 -- the sample hosts files were uppercase.
(HOSTS.SAM) Shrug.

On my virgin Windows 98SE VM, it's called "Hosts.sam". Only the first
letter is capitalized. ;-)

[Auric__]

Post by Char Jackson
On Fri, 6 Apr 2018 05:00:06 -0000 (UTC), "Auric__"

[snip]

Post by Char Jackson

Post by Auric__

Post by Char Jackson
I'm not sure why Bob mentioned uppercase.

In older systems -- 9x and NT3/4 -- the sample hosts files were
uppercase. (HOSTS.SAM) Shrug.

On my virgin Windows 98SE VM, it's called "Hosts.sam". Only the first
letter is capitalized. ;-)

IIRC, 9x systems had a setting to do that with all-caps filenames. Perhaps
it's an Explorer setting. My 95 & 98SE systems both show "HOSTS.SAM". [shrug]

[Bob_S]

Post by Auric__

Post by Bob_S
Are you sure you have enabled hidden files and that you have the correct
HOSTS file (uppercase and no extension).

As a general rule, Windows isn't case-sensitive. It shouldn't matter if it's
"hosts" or "HOSTS" or even something silly like "HoStS".

You are correct - it is not all uppercase. I made mine Uppercase to remind
me it has been modified to eliminate the bitcoin sites such as
coin-hive.com. I see my original hosts file has been renamed hosts.bak.

As you said, it's not case sensitive and I made it all caps a reminder for
me that obviously I'd forgotten about.

As for a guess as to why it is being locked - I'd be looking at any security
type software that may have a lock on it because they have modified the file
and blocking it from being modified.

Also just did a quick search and found this:
https://www.devside.net/wamp-server/unlock-and-unblock-the-windows-hosts-file

[J. P. Gilliver (John)]

In message <pa707h$tb7$***@dont-email.me>, Bob_S <***@here.com> writes:
[]

Post by Bob_S
https://www.devside.net/wamp-server/unlock-and-unblock-the-windows-hosts-file

That sorted it: it was ZoneAlarm that was the culprit! (I'm only using
the firewall part of it.) Though why that should cause it to appear to
be "System" - PID 4 - that had the hosts file open, I have no idea.

For anyone else: just changing the setting in ZA, or turning off ZA
altogether, didn't let me edit the hosts file; I had to do a reboot (as
the above suggested might be the case). Actually, I changed ZA not to
restart before rebooting; I suppose I should have tried just its hosts
file setting. (That can wait for next reboot.)

[Bill Bradshaw]

Copy the hosts file onto a USB stick. Edit it and then copy the edited
version back. I have partitions on my harddrive I can copy the hosts file
to and edit it so that is another way.
--
<Bill>

Brought to you from Anchorage, Alaska

Post by J. P. Gilliver (John)
I'm sure I have edited it since moving to W7! But now when I try, I am
told it is in use: "The process cannot access the file because it is
being used by another process." (The process being plain original
NotePad.) If I try to delete it (having made a copy of course!), I get
"The action can't be completed because the file is open in System".
I've just done a restart, and tried again before opening anything I'd
have thought would be using it - no change. Though as I said, I'm sure
I've edited it before, and that _wouldn't_ have been under those
circumstances.
What's using it? "System" isn't very informative - could be a user
rather than a process.

[J. P. Gilliver (John)]

Post by Bill Bradshaw
Copy the hosts file onto a USB stick. Edit it and then copy the edited
version back. I have partitions on my harddrive I can copy the hosts file
to and edit it so that is another way.

It wasn't the editing, it was the copying back - either as a save from
NotePad, or a copy from the edited copy somewhere else. The system
wouldn't let me overwrite the existing file while it was "open in
System". ZoneAlarm appears to have been the culprit; rebooting with that
off seems to have made the system happy.

[tesla sTinker]

you need to run event viewer, and follow the time stamp and event id
while running resource monitor. That is the only way you can track a
host file to the app that is running it. Without the event viewer id
number, you will never find. Unless your real good with time stamp.
Watch the associated handles and the id numbers in those handles. If you
want to know what it is for certain. Make sure you check host in
processes section or it will not show its face in associated handles.
There is an app you can get that follows svc host files easier, but as
in you already have the stuff in windows, its just learning how to use
it to track the host with. The services are annoying as most of them,
are scams by ms. No such thing as freedom. Not in commy microsoft
shit. Which is why we use pc tools firewall. It does not hide
anything important as in the commys firewall of MS.

Post by J. P. Gilliver (John)

Copy the hosts file onto a USB stick. Edit it and then copy the edited
version back. I have partitions on my harddrive I can copy the hosts file
to and edit it so that is another way.

It wasn't the editing, it was the copying back - either as a save from
NotePad, or a copy from the edited copy somewhere else. The system
wouldn't let me overwrite the existing file while it was "open in
System". ZoneAlarm appears to have been the culprit; rebooting with that
off seems to have made the system happy.

[Mayayana]

"tesla sTinker" <***@truecarpentry.org> wrote

| Which is why we use pc tools firewall. It does not hide
| anything important as in the commys firewall of MS.
|
|
You use PC Tools firewall on Win7? I have v. 7 of that
but never got around to trying it. I'm curious what you
like about it and how you'd compare it to other options.

I gave up on ZA many years ago, when they started
letting MS call home by default on XP. (Before that I
used AtGuard, which was my all-time favorite, but they
sold it to Symantec, who of course ruined it and doubled
the price. Symantec set over 700 programs to be let
through their firewall by default. The result was a useless
product that got great reviews for its "ease of use". :)

On XP I use Online Armor, which I find to be about
as good as I can expect, inasmuch as it warns me if
anything tries to go out and it allows me to make rules
fairly easily to block a process, or restrict a process to
specific ports.
But they also sold out. I using v. 4.0.0.15 and I
understand that it was completely changed after that.

So I'm happy with my XP firewall but would be curious
about a better firewall on Win7 than Private Firewall.

In the meantime, I think we'll have to tease John about
not noticing that ZA was blocking him from editing HOSTS. :)

Though, in his defense, I see that as one of the big
problems with a lot of software these days. AV wants to
be firewall and computer health software. Firewalls want
to be AV and email filters. Both of them want to monitor
downloads and control programs.

It's hard to find software that just does the job well
and gets out of the way. Online Armor actually
has a lot of that crap, but I disable all except the
firewall itself. Many AV/Firewall programs won't allow
normal online operation with default settings, blocking
just about everything except known software.

One of them, Trendmicro, actually tracks people online.
I know that because I see it in my website server logs.
Someone downloads a ZIP from my site and immediately,
in less than a minute, Trendmicro downloads the same
ZIP from their site in Japan. I wonder if people realize
how intrusive all this "safety" is.

[tesla sTinker]

version 7 is a clean firewall that permits everything.
And that, is why I use it. However, the whole pc tools
stopped, and their links were taken over by symantec.

has network meter, has options for all ports and channels,
logs everything. Together with wireshark, it is a non folly
machine.

Symantec
Which is a virus company that is not worth a dam.
They have all stopped doing things honestly, and for that reason,
we do not upgrade anything. Unless it does not work right.
Version 7 works.... The others, and we have Private Firewall as well,
are just not up to par.

You may be able to get a copy on oldversion.com, if your lucky.

Post by Mayayana
| Which is why we use pc tools firewall. It does not hide
| anything important as in the commys firewall of MS.
|
|
You use PC Tools firewall on Win7? I have v. 7 of that
but never got around to trying it. I'm curious what you
like about it and how you'd compare it to other options.
I gave up on ZA many years ago, when they started
letting MS call home by default on XP. (Before that I
used AtGuard, which was my all-time favorite, but they
sold it to Symantec, who of course ruined it and doubled
the price. Symantec set over 700 programs to be let
through their firewall by default. The result was a useless
product that got great reviews for its "ease of use". :)
On XP I use Online Armor, which I find to be about
as good as I can expect, inasmuch as it warns me if
anything tries to go out and it allows me to make rules
fairly easily to block a process, or restrict a process to
specific ports.
But they also sold out. I using v. 4.0.0.15 and I
understand that it was completely changed after that.
So I'm happy with my XP firewall but would be curious
about a better firewall on Win7 than Private Firewall.
In the meantime, I think we'll have to tease John about
not noticing that ZA was blocking him from editing HOSTS. :)
Though, in his defense, I see that as one of the big
problems with a lot of software these days. AV wants to
be firewall and computer health software. Firewalls want
to be AV and email filters. Both of them want to monitor
downloads and control programs.
It's hard to find software that just does the job well
and gets out of the way. Online Armor actually
has a lot of that crap, but I disable all except the
firewall itself. Many AV/Firewall programs won't allow
normal online operation with default settings, blocking
just about everything except known software.
One of them, Trendmicro, actually tracks people online.
I know that because I see it in my website server logs.
Someone downloads a ZIP from my site and immediately,
in less than a minute, Trendmicro downloads the same
ZIP from their site in Japan. I wonder if people realize
how intrusive all this "safety" is.

[Good Guy]

Post by Mayayana
Symantec
Which is a virus company that is not worth a dam.

You must be brain damaged or that you are too poor to buy a decent
Anti-Virus subscription. symantec is one of the best around but poor
people like you can't afford it. In order to buy it the user must have
some intelligence to earn a better living and so afford to buy a premium
product. For poor people like you, there are free ones like Avast, & AVG.

Why nutters like you are still using a Windows system is beyond my
imagination. Windows is for people with education and riff-raff like
you should be using Linux Junk.

[Mayayana]

"tesla sTinker" <***@truecarpentry.org> wrote

| Version 7 works.... The others, and we have Private Firewall as well,
| are just not up to par.
|
| You may be able to get a copy on oldversion.com, if your lucky.

Thanks. I'll try it. As I mentioned, I have v. 7
already. I just never tried installing it. I've seen
enough things disappear from the Internet that
long ago I started storing backups of things I
might want later. That includes a number of
firewalls.

[Mayayana]

"tesla sTinker" <***@truecarpentry.org> wrote


| version 7 is a clean firewall that permits everything.
| And that, is why I use it.

I installed it and set it to block all system processes. I
then tried to run Firefox. It should have asked me whether
to allow FF online. It didn't. So I set up a rule. It still was
blocked. I set it to allow all in/out. It still was blocked.
I can only get online if I disable the PC Tools firewall.
Am I missing something?

[Bob_S]

"Symantec

Post by tesla sTinker
Which is a virus company that is not worth a dam.
They have all stopped doing things honestly, and for that reason,
we do not upgrade anything. Unless it does not work right.
Version 7 works.... The others, and we have Private Firewall as well,
are just not up to par.
snip......

Some strong statements - can you back them up with some facts to enlighten
us?

If just personal opinion - well we all have those but when you slam a
product or a company, how about telling us why. Otherwise you come across
as just venting because you didn't understand their software, it wasn't
right for your system(s) or just had a bad experience and still hold a
grudge.

I did state in my post that their product used to be a resource hog but no
longer. I have been using their products for years (both personally and on
clients systems) and they are one of the best available today. If you think
a free product is better then think about who pays the guy's that make the
product you're using and see if free is really free and has it been tested
by a legitimate lab.

No, not trying to start a troll war here but using a free AV product for
home use is one thing and quite another when it's used in a commercial
environment. Check out Symantec and compare them to whoever makes that free
software you're entrusting you security to.

[Mayayana]

"Bob_S" <***@here.com> wrote
| "Symantec
| >Which is a virus company that is not worth a dam.

| Some strong statements - can you back them up with some facts to enlighten
| us?

| Check out Symantec and compare them to whoever makes that free
| software you're entrusting you security to.
|

I don't know about tesla, but I'm happy to
"enlighten" anyone who might consider Symantec.

Long ago I had their system works. It was a pig.
The "doctor" came up with all sorts of things that
needed to be fixed. Similar to Malwarebytes today:
It finds things that sound important but in general
they're not. Things like orphan CLSID entries in the
Registry that do neither harm nor good.

System Works has the dubious distinction of being
the first program I ever saw that tried to call home
during install but wouldn't tell me that was what it
was doing.

My favorite all-time firewall was AtGuard. Symantec
licensed it, literally doubled the price, and turned it to
junk by setting over 700 programs to go through by
default.

I once used Clean Sweep from Quarterdeck. It was
a great program that could package any program install
into a single file for transfer to another computer, or
as a backup.
Symantec bought the company. I don't remember
what they did with it. If I remember correctly they
turned it into a useless backup program.

At one time I had Drive Image from PowerQuest. It
was a very good DOS-level program for making and
restoring disk images. Symantec bought it and turned
out a bloated .Net monstrosity for system backup.

In my experience I've seen Symantec act as nothing
more than a parasite, buying up the best companies,
then using a big marketing budget, combined with stripping
functionality, to make big sales to the kind of suckers
who pay extra for things they see on TV. Though I
shouldn't say suckers. Most people don't know how to find
out about products, so they get exploited by the big
marketers. It's like the women who pay a rate of hundreds
of dollars per gallon for special "age reversing" moisturizing
cream in fancy bottles, which are nevertheless nothing
but mineral oil with water and an emulsifier, combined
with lots of marketing. Similarly, Symantec is good at
making fancy bottles to sell 30 cents worth of mineral
oil for $16.

Their trick is to water down the software so that
it's foolproof. Very important, very official, extra
high tech software that does nothing much useful.
It's a very clever idea. A good firewall requires configuration.
But a useless firewall that lets everything through appears
to be very easy to use, thus getting great reviews from
the lapdog tech media.

I don't know what Symantec is pushing these days
for system backup. I use an amazing little program called
BootIt that cost me something like $39, could fit on a floppy,
and handles all aspects of disk imaging, partitioning, and
multi-booting. I'd be willing to bet that whatever Symantec
offers is a gigantic, bloated mess for more than twice the
price, with very snazzy window decorations in the GUI.

So what about you? You suggest checking out Symantec
and you're critical of someone being negative about them
without backing it up, yet I don't see where you detailed any
particular products of theirs that you think are good, and why
you think so.

[Bob_S]

Mayayana,

Wow - quite the rant. Sounds like you've had a bad time over software
acquisitions for quite awhile. I can understand your displeasure but hey,
things change even if you don't and they do move on without you.

You don't like Symantec - fine. But as you said, you don't know what
Symantec has these days. You can download their free trials and see for
yourself whether it suits you or not. I believe you'll find they dropped a
lot of stuff and cleaned up their offerings with the new management in the
past few years.

They do have quite a track record:
https://www.symantec.com/about/corporate-profile/business-overview

They are involved in insuring their products meet the latest standards:
https://www.symantec.com/about/corporate-profile/technology

And they have a global research organization Symantec Research Labs:
https://www.symantec.com/about/corporate-profile/technology/research-labs

And no, I don't own any of their stock that I'm aware of...

All in all, they have the resources behind them that makes products as good
or better than any in the industry. Do they make mistakes, sure and like
all companies trying to stay ahead in technology - they will make more in
the future.

But for now, their latest products work very well and they're not resource
hogs.

Bob S.

[Mayayana]

"Bob_S" <***@here.com> wrote

| Wow - quite the rant.

Not a rant. Details. Didn't you ask for details?
When it comes to Symantec I just happen to have
a lot of details, because they ruined a lot of my
favorite software.

| Sounds like you've had a bad time over software
| acquisitions for quite awhile.

That's quite a jump in logic. I don't like Symantec
so I must be a ranting crank who can't seem to have
good luck with software? How did you manage to get
religious about something like Symantec? I expect that
from AppleSeeds. Maybe even some MS Office fans.
But... Symantec? It must be those snazzy yellow and
black suits that make them look like a cross between
James Bond and a sleek bee in a Broadway musical.

I haven't had an especially bad time with software.
In fact, the ones I listed were all mainstays and
I considered them to be the best available -- until
Symantec bought them.

And as I noted, I've been delighted with BootIt
for years now. I just don't like Symantec. And I have
lots of reasons. Did I mention that? :)

| You don't like Symantec - fine. But as you said, you don't know what
| Symantec has these days.

And apparently neither do you. You say people shouldn't
use anything free over a choice like Symantec, which has
"labs", whatever that means. Do you really buy into all this
pseudo-science marketing by these companies? No one needs
a "lab" to investigate computer viruses. They're not the same
thing as disease viruses.

And what's your evidence for the amazingness of Symantec?
Nothing but links to Symantec marketing webpages? All I
asked was that if you're going to tell people what they should
use then you should back that up... as you were asking tesla
to do. A simple link or two to comparative surveys would be
fine. Something that shows Symantec's high-priced spread is
justifiably better than free options.
Since the free options are generally given away as part of
a marketing plan, I don't see any reason to think they're inferior.
If you try Acme Feee at home and don't like it then you're
not likely to buy Acme Paid for your business.

Personally I don't use any AV and haven't for many
years. I often install something basic for friends without
experience who I help. In that case I'm looking for
something free that stays out of the way. Just enough
to notice unusual activity and warn them. I regard the
whole idea as grossly outdated and the software itself
tends to be a resource hog. Not just Symantec's. We're
talking about a program that wants to scan every file
touched, to compare byte patterns to *millions* of
stored patterns from collected malware. (Byte patterns
that need updating several times per day. When the idea
of virus signatures started out they needed updating
once per month.)
And if you touch that file again in 5 minutes it will be
scanned again. The whole approach has become untenable.

AV is also a privacy/security risk in itself. For example, I've
noticed that people who use Trendmicro get followed
online. Someone downloads a ZIP from my website. Within
a minute, my server logs show TM in Japan has downloaded
the same ZIP. Every move is being reported home. Should
we trust *any* company to do that? Well... OK... Facebook
can probably be trusted. :)

The worse AV gets, the more there are also false positives.
I have at least one program I wrote that set off Avira.
Someone wrote to tell me. So I installed Avira. Sure enough.
It even had a made-up, scary sounding name for my "malware".
I'd apparently infested a number of my compilations. I found
that if I compiled it with different options it wouldn't set off
Avira. I sure am glad I didn't *pay* for that kind of genius.

Karl Peterson, a former MS MVP, once wrote an article
about a similar situation. After a lot of searching he figured
out that the AV was set off by the fact that he'd hard-coded
"HKEY_LOCAL_MACHINE" into his executable. Of course, I
could "rant" all day about this. :)

But in my experience those are typical examples. If
you're going to bank online and enable javascript
everywhere then you're basically a hayseed in a
whorehouse and some thick latex is in order. Otherwise...

| You can download their free trials and see for
| yourself whether it suits you or not. I believe you'll find they dropped a
| lot of stuff and cleaned up their offerings with the new management in the
| past few years.

So you also don't have any facts to back up your
position? No specific features you find notable? No
independent testing to link to? You expect us to
research it simply on your say so?!

[Bob_S]

Post by Mayayana
| Wow - quite the rant.
Not a rant. Details. Didn't you ask for details?
When it comes to Symantec I just happen to have
a lot of details, because they ruined a lot of my
favorite software.
| Sounds like you've had a bad time over software
| acquisitions for quite awhile.
That's quite a jump in logic. I don't like Symantec
so I must be a ranting crank who can't seem to have
good luck with software? How did you manage to get
religious about something like Symantec? I expect that
from AppleSeeds. Maybe even some MS Office fans.
But... Symantec? It must be those snazzy yellow and
black suits that make them look like a cross between
James Bond and a sleek bee in a Broadway musical.
I haven't had an especially bad time with software.
In fact, the ones I listed were all mainstays and
I considered them to be the best available -- until
Symantec bought them.
And as I noted, I've been delighted with BootIt
for years now. I just don't like Symantec. And I have
lots of reasons. Did I mention that? :)
| You don't like Symantec - fine. But as you said, you don't know what
| Symantec has these days.
And apparently neither do you. You say people shouldn't
use anything free over a choice like Symantec, which has
"labs", whatever that means. Do you really buy into all this
pseudo-science marketing by these companies? No one needs
a "lab" to investigate computer viruses. They're not the same
thing as disease viruses.
And what's your evidence for the amazingness of Symantec?
Nothing but links to Symantec marketing webpages? All I
asked was that if you're going to tell people what they should
use then you should back that up... as you were asking tesla
to do. A simple link or two to comparative surveys would be
fine. Something that shows Symantec's high-priced spread is
justifiably better than free options.
Since the free options are generally given away as part of
a marketing plan, I don't see any reason to think they're inferior.
If you try Acme Feee at home and don't like it then you're
not likely to buy Acme Paid for your business.
Personally I don't use any AV and haven't for many
years. I often install something basic for friends without
experience who I help. In that case I'm looking for
something free that stays out of the way. Just enough
to notice unusual activity and warn them. I regard the
whole idea as grossly outdated and the software itself
tends to be a resource hog. Not just Symantec's. We're
talking about a program that wants to scan every file
touched, to compare byte patterns to *millions* of
stored patterns from collected malware. (Byte patterns
that need updating several times per day. When the idea
of virus signatures started out they needed updating
once per month.)
And if you touch that file again in 5 minutes it will be
scanned again. The whole approach has become untenable.
AV is also a privacy/security risk in itself. For example, I've
noticed that people who use Trendmicro get followed
online. Someone downloads a ZIP from my website. Within
a minute, my server logs show TM in Japan has downloaded
the same ZIP. Every move is being reported home. Should
we trust *any* company to do that? Well... OK... Facebook
can probably be trusted. :)
The worse AV gets, the more there are also false positives.
I have at least one program I wrote that set off Avira.
Someone wrote to tell me. So I installed Avira. Sure enough.
It even had a made-up, scary sounding name for my "malware".
I'd apparently infested a number of my compilations. I found
that if I compiled it with different options it wouldn't set off
Avira. I sure am glad I didn't *pay* for that kind of genius.
Karl Peterson, a former MS MVP, once wrote an article
about a similar situation. After a lot of searching he figured
out that the AV was set off by the fact that he'd hard-coded
"HKEY_LOCAL_MACHINE" into his executable. Of course, I
could "rant" all day about this. :)
But in my experience those are typical examples. If
you're going to bank online and enable javascript
everywhere then you're basically a hayseed in a
whorehouse and some thick latex is in order. Otherwise...
| You can download their free trials and see for
| yourself whether it suits you or not. I believe you'll find they dropped a
| lot of stuff and cleaned up their offerings with the new management in the
| past few years.
So you also don't have any facts to back up your
position? No specific features you find notable? No
independent testing to link to? You expect us to
research it simply on your say so?!

Mayayana,

Oh boy - I think your tin foil hat just slipped a bit.

After reading the above, it would be futile to even try and convince you to
try something new, so I won't.

But here's something just for you to read that’s reasonably up to date (Dec
2017):

https://www.av-test.org/en/antivirus/home-windows/windows-10/december-2017/norton-norton-security-22.11-174816/

This ends this thread for me but please feel free to keep on ranting (it's
good for a chuckle) - but please do put that tin foil hat back on straight.

There ya go, that looks much better...;-)

[J. P. Gilliver (John)]

Post by Mayayana
| Which is why we use pc tools firewall. It does not hide
| anything important as in the commys firewall of MS.
|
|
You use PC Tools firewall on Win7? I have v. 7 of that
but never got around to trying it. I'm curious what you
like about it and how you'd compare it to other options.
I gave up on ZA many years ago, when they started
letting MS call home by default on XP. (Before that I
used AtGuard, which was my all-time favorite, but they
sold it to Symantec, who of course ruined it and doubled
the price. Symantec set over 700 programs to be let
through their firewall by default. The result was a useless
product that got great reviews for its "ease of use". :)

I have uninstalled ZA. My system was playing up: "System" (PID 4) was
sometimes taking 25% (almost railing one core), Chrome (my secondary
browser) was getting so sluggish as to be unusable, and my Start button
was sometimes unresponsive. The only major thing I'd done was install
ZA. That's far from conclusive - but the system has been much more
stable since I took it out.

Post by Mayayana
On XP I use Online Armor, which I find to be about
as good as I can expect, inasmuch as it warns me if
anything tries to go out and it allows me to make rules
fairly easily to block a process, or restrict a process to
specific ports.

On XP I used Kerio Personal Firewall (KPF) - I think 2.1.5. The last one
before they added bloat. Like your Armor, it warned me and was easy to
manage.

Post by Mayayana
But they also sold out. I using v. 4.0.0.15 and I
understand that it was completely changed after that.

Kerio was bought by Sunbelt (though had already started to bloat before
that). It changed out of all recognition after that. Unfortunately, It
wouldn't work under 7, even the 32-bit version. I presume your Armor
wouldn't, either.

Post by Mayayana
So I'm happy with my XP firewall but would be curious
about a better firewall on Win7 than Private Firewall.

Me too, except substitute ZA (though it _may_ not have been the
culprit). For me, "better" would mean simple to use, like my old KPF.

Post by Mayayana
In the meantime, I think we'll have to tease John about
not noticing that ZA was blocking him from editing HOSTS. :)
Though, in his defense, I see that as one of the big
problems with a lot of software these days. AV wants to
be firewall and computer health software. Firewalls want
to be AV and email filters. Both of them want to monitor
downloads and control programs.

Yes, ZA was wanting to add something - I think AV - and AVG is
_certainly_ frequently on at me to add things (with a price tag).

Post by Mayayana
It's hard to find software that just does the job well
and gets out of the way. Online Armor actually
has a lot of that crap, but I disable all except the
firewall itself. Many AV/Firewall programs won't allow
normal online operation with default settings, blocking
just about everything except known software.
One of them, Trendmicro, actually tracks people online.
I know that because I see it in my website server logs.
Someone downloads a ZIP from my site and immediately,
in less than a minute, Trendmicro downloads the same
ZIP from their site in Japan. I wonder if people realize
how intrusive all this "safety" is.

!

[Bill Bradshaw]

I seem to remember I have also been able to boot into safe mode and edit it.

<Bill>

Post by J. P. Gilliver (John)

Post by Bill Bradshaw
Copy the hosts file onto a USB stick. Edit it and then copy the
edited version back. I have partitions on my harddrive I can copy
the hosts file to and edit it so that is another way.

It wasn't the editing, it was the copying back - either as a save from
NotePad, or a copy from the edited copy somewhere else. The system
wouldn't let me overwrite the existing file while it was "open in
System". ZoneAlarm appears to have been the culprit; rebooting with
that off seems to have made the system happy.
--
J. P. Gilliver. UMRA: 1960/<1985
"That was a great speech. Every thinking American will vote for you."
"That's not enough. I need a majority." - Mo Udall