What are these 127.0.0.1 entries in my system hosts file?

Home » Windows » Windows Configuration

Summary: 127.0.0.1 is used in the hosts file by malware, anti-malware and ad blockers to block access to certain sites. The domains blocked will tell you which.

•

127.0.0.1 is "special", and refers to your own computer. It's used for both good and evil. The trick here is to understand which, and perhaps how these entries appeared on your computer in the first place.

•

As I said, 127.0.0.1 is a special IP address that is always defined to refer to the local computer. So whenever a computer attempts to connect to 127.0.0.1 it's really attempting to connect to itself.

Now, unless you're running a web server on your own machine (highly unlikely unless you explicitly set it up), and if a web browser tries to connect to 127.0.0.1 that connection will fail - there's no web server to answer the call.

The other piece of this puzzle is to realize that entries in your hosts file take priority over "real" lookups. For example, if you put this in your hosts file:

127.0.0.1 google.com
127.0.0.1 www.google.com

you'll no longer be able to access Google. Your browser would request the IP address for google.com, the system would find it in your hosts file first and assume that was the correct address. Your browser would attempt to access 127.0.0.1, your own computer, and that would fail.

From this comes one ad blocking technique that places these kinds of entries into your hosts file for known advertising sites. That way, when your browser attempts to access them to fetch an ad, that fails and no ad is displayed. It can also be used to prevent access to sites that are known to be malicious in nature.

In looking at the list provided by the person asking the question, that appears to be what's happening here. These appear to be advertising or malware sites that have been blocked.

Now, the question is: how did this list get there?

I'm going to assume that since you're asking, you didn't put it there. Manually installing such a list is the most common approach.

The other alternative is that some anti-malware or firewall package you're using added the list for you. I'd check the various packages you're running to see if perhaps that's part of the feature list.

One way that the hosts file gets abused is by malware.

As we've seen, we can block access to certain sites by creating a "127.0.0.1" entry in the hosts file. What some malware does is exactly that - to block anti-malware companies.

For example, malware might install hosts entries to block your anti-virus software from updating itself or its malware definition. If your infection occurs prior to the definitions being updated to detect it, the malware has effectively hidden such that it will never be discovered as your anti-malware will never be able to update itself.

So if you see a list of domains like symantec.com, ca.com, and the domains of other well known anti-malware companies, you can pretty much bet that something's up. You can delete them if you like, but I'm guessing that a) it's too late because you're infected, and b) the malware will just add them back.

The good news in all this is that most anti-malware software is very aware of the potential for hosts file abuse. Some anti-spyware software will go so far as to lock the file so that it can't be modified, and most others will notify you if it changes unexpectedly.

Related:

Helpful? Get new articles weekly by email in my FREE newsletter!

Your Name:
Your Email:

Why Subscribe?

• Can I fake the DNS ip lookup to test my website? In case you need to test your website, there are ways that you can fake the DNS IP lookup to be able to do so. We'll take a look at how that's done.

• Is this stuff in my 'hosts' file supposed to be there? The "hosts" file can be used for good or evil. Anti-malware programs may use it to block things, and malware may use it to block anti-malware.

• Is there a way to block certain URL's in IE? There are ways to block URLs in IE, but doing so will block them from all other programs as well.

Article C3492 - September 5, 2008