DNS Hijack / Hosts File Manipulation

What is DNS-HOSTS-REDIRECT?

DNS_HOSTS_REDIRECT shows up as a high-severity malware/security fault. This diagnosis detects unauthorized local DNS redirect entries added to the Windows Hosts file, preventing access to security updates and redirecting legitimate sites to phishing portals. Work through the steps below in order.

Common Causes

• Local malware execution utilizing administrator permissions to bypass write protections.

Step-by-Step Fix Guide

• 1
  Locate the hosts file inside System32\drivers\etc\ and reset its contents to the default empty layout.

  For lingering DNS-HOSTS-REDIRECT cases, "Locate the hosts file inside System32\drivers\etc\ and reset its contents to the default empty layout." is worth running through.

• 2
  Flush the local DNS resolver cache to clear corrupted lookup tables.

  This step, "Flush the local DNS resolver cache to clear corrupted lookup tables.", specifically rules out local malware execution utilizing administrator permissions to bypass write protections.

• 3
  Change network adapter settings to use secure public DNS servers (e.g. 1.1.1.1 or 8.8.8.8).

  "Change network adapter settings to use secure public DNS servers (e.g. 1.1.1.1 or 8.8.8.8)." covers a less common but documented cause of DNS-HOSTS-REDIRECT.

Commands & Diagnostics

Frequently Asked Questions