Member Avatar for buddyb

I was with a group of people the other day, talking about Spybot, Ad-Aware and some other stuff along that line, and some guy says there's a better way and he's not had the first pop-up.

He contends whenever you boot open the "etc" folder and delete everything there except what it takes to run the system. Anyone know anything about this folder and what it is for, and does it come off logical to do what this guy was telling me?

Thanks, BuddyB

  • 4 Contributors
  • 9 Replies
  • 1K Views
  • 6 Days Discussion Span
  • Latest Post Latest Post by alc6379

Dani AI

Generated

Short answer: do not delete the contents of the Windows "etc" folder. As and noted, it contains small, plain-text networking configuration files that the OS and network services rely on; wiping them can break name resolution and related behavior. 's Unix anecdote is a useful caution: deleting an OS config directory on any platform is a fast route to serious problems.

Practical, safe workflow to inspect/repair the files without destroying anything:

  • Make a backup copy before touching anything.
  • Open the files with a text editor run with administrative/elevated rights and scan for unexpected entries (redirects of well-known domains, long unrelated lists, or anything you did not add).
  • If you find suspicious entries, restore the backup, then run a full, up-to-date malware scan and check autorun/startup entries.
  • Protect the file afterward by making a copy for reference and marking the working file read-only until you need to edit it again.

Example commands (run from an elevated Command Prompt):

copy "%windir%\system32\drivers\etc\hosts" "%userprofile%\Desktop\hosts.bak"
notepad "%windir%\system32\drivers\etc\hosts"
attrib +r "%windir%\system32\drivers\etc\hosts"

If unsure, restore from a known-clean backup or a system restore point rather than deleting files. The advice to "delete everything" is unsafe; follow the backup–inspect–restore pattern instead.

Recommended Answers

All 9 Replies

Member Avatar for alc6379

which etc folder did he say? The only one I can think of is c:\windows\system32\drivers\etc , but you don't want to delete everything in there...

Member Avatar for buddyb

which etc folder did he say? The only one I can think of is c:\windows\system32\drivers\etc , but you don't want to delete everything in there...

You're on it, and right. I don't want to delete everything in there. Question is, how can I spot the good stuff, and separate it from the bad stuff. And, what is this folder for and about.
Thanks, BuddyB

Member Avatar for alc6379

Really, just don't fool with it at all.

etc contains the hosts file, where you can add IP address to hostname mappings, so you can customize things there. LMHOSTS does the same thing, but for the Network Neighborhood.

Basically, there's nothing to mess with there. Sometimes, people map known spamhosts or ad servers domain names to 127.0.0.1, to block those ads. But, that's about it, and there's really no point to doing that, even, as there are way to many ad servers to fool with blocking.

Member Avatar for buddyb

Really, just don't fool with it at all.

Appears to be sound advice. Point heeded. Thanks for the input.
BuddyB

Member Avatar for Cain

im pertty sure adaware doesnt run on a unix/linux box.. ive only ever used it on windows..
unix/linux systems contain a /etc folder.. you can delete everything in there if you like
but it will not be pretty. matter of fact you get to do an unscheduled failure simulation
with active restore from tape or the like via ufsrestore.

kinda like the redneck computer virus. "% rm -Rf /* <CR>" or "%rm /lib/ld.so.1"
either is a bad day in the end. sounds like someone was pulling your leg. :mrgreen:

Member Avatar for alc6379

im pertty sure adaware doesnt run on a unix/linux box.. ive only ever used it on windows..
unix/linux systems contain a /etc folder.. you can delete everything in there if you like
but it will not be pretty. matter of fact you get to do an unscheduled failure simulation
with active restore from tape or the like via ufsrestore.

kinda like the redneck computer virus. "% rm -Rf /* <CR>" or "%rm /lib/ld.so.1"
either is a bad day in the end. sounds like someone was pulling your leg. :mrgreen:

They might have been pulling his leg, but there is indeed an etc folder in Windows, like I said above. Next time you're near a Windows machine, check it out.

Member Avatar for DMR

im pertty sure adaware doesnt run on a unix/linux box..

Yup, and there's a reason for that, isn't there? :mrgreen:


Seriously though- the guy talking about the etc folder was either joking or spewing nonsense from his Southern Orifice. As Alex said, the etc folder in Windows only contains a few networking-related files, which should be left alone. The only exception to that in terms of spyware/adware/viruses is the "hosts" file. Malicious programs can add entries to your hosts file which will alter/cripple your browsing by messing with URL-to-IP address mappings. If such entries have been added, they should be removed; the only entry in the default hosts file is:

127.0.0.1 localhost


Having dealt extensively with malware issues both here and in my "real life" job as a computer consultant, I can definitely say that although there are many places malicious programs do get their hooks into your system, I've never found the etc folder to be one of those places.

Member Avatar for Cain

The only one I can think of is c:\windows\system32\drivers\etc

i did check this out.. in my case (W2K) it was located in
C:WINNT\system32\drivers\etc
hosts lmhosts and so on were found. even the comments were very unixesque.. thats
scary. microsoft incorperated a littlebit of a unix style architecture under its
transparent skin during the late 80s and early 90s.. (they copywrighted lmhosts LOL)
even the comments look like they're straight out of a programmers personal $HOME/bin directory..

Member Avatar for alc6379

i did check this out.. in my case (W2K) it was located in
C:WINNT\system32\drivers\etc
hosts lmhosts and so on were found. even the comments were very unixesque.. thats
scary. microsoft incorperated a littlebit of a unix style architecture under its
transparent skin during the late 80s and early 90s.. (they copywrighted lmhosts LOL)
even the comments look like they're straight out of a programmers personal $HOME/bin directory..

Yup. Reason for that is the bulk of Microsoft's original TCP/IP code actually came from BSD.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.