Step-by-step guide to deleting a Trojan that modifies your hosts file

A Trojan that tampers with the Windows hosts file is one of the more stubborn infections that an Australian household or small business can pick up. The threat is not flashy, since there is no locked screen or encrypted archive demanding payment, yet it quietly reroutes browsers away from genuine banking, search, and security portals toward look-alike phishing infrastructure. Because the trick lives inside a plain text file that the operating system trusts, the malware can survive casual scanning and persist through some reinstall attempts.

Cleaning this kind of infection requires a methodical approach: staging the system offline, reversing malicious hosts entries, removing the dropper, and then auditing the rest of the surface area the intruder touched.

How the hosts-modifying Trojan works on a Windows or Mac machine

The hosts file is a small mapping list the operating system checks before any DNS lookup. A trojan that targets it simply appends thousands of lines pointing well-known domains — google.com, microsoft.com, common Australian banking portals, antivirus update servers — to attacker-controlled IP addresses.

The result is subtle: typing the correct address still lands on a convincing copy. On a Mac or Windows laptop connected through the National Broadband Network in a Sydney apartment or a Perth office, the malicious redirect is invisible unless the page is examined carefully. This is why a broader Trojan family often acts as a gateway for follow-up payloads, including credential stealers and secondary ransomware. Variations on the same theme can include wallpaper ransom note infections that replace the desktop background once a foothold is established.

Recognising the warning signs before you begin cleanup

Several indicators usually surface before the user fully realises the hosts file has been hijacked:

• Anti-malware utilities failing to download updates despite a working internet link
• Banking and email services refusing secure connections, or TLS warnings appearing on familiar domains
• The search engine returning unfamiliar results even after resetting browser defaults
• A sudden spike in pop-ups on sites that normally show none

In Australian homes where multiple devices share the same router, the problem is often mistaken for a flaky NBN connection or a faulty modem. Confirming whether the issue is network-related or host-based is the first useful diagnostic.

Preparing the machine: backups, offline staging, and tool gathering

Before touching the infected hosts file, capture a full image or at least a file-level backup to an external drive that stays disconnected afterwards. This protects any encrypted credentials or browser data you might still need to recover.

Next, disconnect from Wi-Fi and wired networks, then boot into Safe Mode with Networking on Windows, or restart into macOS Recovery for full disk access on a Mac. Pull a known-clean copy of the hosts file template from another verified machine if possible, and stage reputable portable scanners on a USB stick. Avoid downloading new tools from the infected browser, because the same hosts hijack will silently redirect your update source.

Removing the malware and restoring the hosts file

Open Notepad elevated on Windows, or TextEdit with sudo on macOS, then navigate to the hosts location, usually C:\Windows\System32\drivers\etc\hosts or /private/etc/hosts. A clean file contains only comment lines beginning with a hash mark and possibly a single 127.0.0.1 localhost entry. Anything beyond that, especially long blocks pointing mainstream sites to raw IP addresses, is hostile and should be removed.

After saving the restored file, flush the DNS cache using ipconfig /flushdns in Command Prompt on Windows or dscacheutil -flushcache; sudo killall -HUP mDNSResponder on macOS. Run a full scan with a reputable offline-capable engine to remove the dropper that wrote those entries. When hosts tampering is part of a larger intrusion, a Locky ransomware analysis explains how drop mechanisms differ from stand-alone trojans and why complete removal needs more than a hosts reset.

Auditing browsers, scheduled tasks, and startup items

Restoring the hosts file alone is rarely enough. Hosts-modifying trojans are known to drop registry Run keys, install scheduled tasks labelled as system services, and tamper with browser shortcut targets. In a Windows machine, review Task Scheduler, msconfig, and the Run registry hive for unfamiliar entries.

For Australian small businesses in sectors like legal, accounting, or healthcare, this audit matters more than most. The Office of the Australian Information Commissioner treats many of these side-channel intrusions as reportable incidents under the Notifiable Data Breaches scheme when customer data is exposed, and the reporting obligation falls on the business rather than the IT contractor.

Where Australian victims can report and get help

Reporting is a practical step, not a formality. The Australian Cyber Security Centre's ReportCyber portal accepts submissions from individuals and businesses, while ScamWatch, run by the ACCC, tracks the broader pattern of malicious advertising that often drops these trojans in the first place.

If the infection appears tied to a financial institution — Westpac, CBA, ANZ, NAB, or a regional credit union — contact the bank's fraud line directly using a number printed on the back of a card, not one displayed on a screen that may itself be hijacked. For ongoing protection, the ACSC's Essential Eight provides a baseline that maps well to the cleaning steps above.

Prevention habits that keep the hosts file clean

Long-term defence relies on routine. Keep browsers and operating systems updated, avoid granting administrator rights to standard accounts, and periodically compare the local hosts file against a known-clean baseline. A few everyday practices common across Australian households make a noticeable difference:

• Disabling third-party browser extensions by default and reviewing them quarterly
• Restricting PowerShell use for non-administrator accounts
• Storing critical backups on a NAS or external drive that is only powered on during scheduled sync windows
• Using a standard user account for email and web browsing on shared family laptops

These measures do not eliminate every threat, but they sharply reduce the chance that a trojan can write to a privileged location such as the hosts file without being noticed.