@Bill-Kindle said:
@ITcrackerjack said:
@Bill-Kindle Are you talking about the C:\Windows\System32\drivers\etc\hosts file? They deleted it? By default, I believe it's set to read-only for normal users. So unless you explicitly open it as admin to edit it you can't. So I suppose a rogue app (or just a poorly written one) could change it if running as administrator. I have seen that, but I don't remember what "legit" app it was. If I recall correctly, it was just the programmer being lazy.
Yes, they are a local admin by demand. I have no say because they are my boss. If I explain that it's because they disabled UAC, run as an admin they will probably lose it. (I've already hinted that to them, but for now I'm blaming Symantec because I'm only using them for another week before I cut over to Webroot).
But yes, it's that hosts file.
That may actually be a legit response. Anti-virus often monitor the hosts file, so maybe it quarantined the changed one and reverted to an older one?