{"id":4339,"date":"2026-06-08T17:56:14","date_gmt":"2026-06-08T14:56:14","guid":{"rendered":"https:\/\/support.withsecure.com\/en\/?post_type=support_article&#038;p=4339"},"modified":"2026-06-08T17:56:14","modified_gmt":"2026-06-08T14:56:14","slug":"how-does-the-protect-the-hosts-file-security-feature-work","status":"publish","type":"support_article","link":"https:\/\/support.withsecure.com\/fi\/support-articles\/how-does-the-protect-the-hosts-file-security-feature-work\/","title":{"rendered":"How does the &#8221;Protect the Hosts file&#8221; security feature work?"},"content":{"rendered":"<h3>Issue:<\/h3>\n<p>How does the <b>Protect the hosts file <\/b>security<b>\u00a0<\/b>feature work with WithSecure security product on a Windows host?\u00a0<br \/>What happens to an already modified hosts file when WithSecure security product is installed?\u00a0<\/p>\n<h3>Resolution:<\/h3>\n<p>The <b>Protect the Hosts file <\/b>security feature\u00a0monitors if there have been any changes made to the hosts file in a Windows system. If the feature detects a non-default hosts file, it will alert of a redirected hosts file and replace it with a hosts file with the following content:<\/p>\n<p><i>#<br \/># Copyright (c) 2007 F-Secure Corporation\u00a0<br \/>#\u00a0<br \/># This is a HOSTS file created during malware removal.\u00a0<br \/>#<br \/># Your original HOSTS file was infected and it was replaced\u00a0<br \/># by this file containing only clean default entries.\u00a0<br \/># The original HOSTS file may be restored from the product&#39;s<br \/># quarantine feature.<br \/>#<br \/>127.0.0.1\u00a0\u00a0 \u00a0localhost<br \/>::1\u00a0\u00a0 \u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0 \u00a0localhost<\/i><\/p>\n<p>If a hosts file has been modified before the installation of Client Security, the modified hosts file will be detected during the first system scan.<\/p>\n<p>If the hosts file is modified during a time when the\u00a0<b>Protect the hosts file\u00a0<\/b>feature has been disabled, the modified hosts file will be detected when the feature is turned back on.\u00a0<\/p>\n<p>Follow these steps to turn off the\u00a0<b>Protect the hosts file\u00a0<\/b>feature.<\/p>\n<p>For Policy Manager:<\/p>\n<ol>\n<li>Log in to Policy Manager Console<\/li>\n<li>Select the policy domain or host from the Domain Tree<\/li>\n<li>Go to the <b>Settings\u00a0<\/b>tab and select\u00a0<b>Advanced view\u00a0<\/b><b>\u200b\u200b\u200b\u200b\u200b\u200b\u200b<\/b>\n<ul>\n<li><strong>Note:<\/strong> Advanced view needs to be enabled from the settings<\/li>\n<\/ul>\n<\/li>\n<li>Navigate to: <b>F-Secure Anti-Spyware<\/b> &gt; <b>Settings<\/b> &gt; <b>Anti-Spyware Scanner<\/b> &gt; <b>Real-Time Scanning<\/b> &gt; <b>Real-Time Scanning Options<\/b> &gt; <b>Protect the &quot;hosts&quot; File\u00a0<\/b><\/li>\n<li>Disable the setting\u00a0<\/li>\n<li>Distribute the policy (Ctrl + D)<\/li>\n<\/ol>\n<p>For Elements Endpoint Protection:<\/p>\n<ol>\n<li>Log on to the WithSecure Elements Security Center portal (<a href=\"https:\/\/elements.withsecure.com\" target=\"_blank\" rel=\"noopener\">https:\/\/elements.withsecure.com<\/a>)<\/li>\n<li>Expand the <strong>Security Configurations<\/strong> tab and go to <strong>Profiles<\/strong><\/li>\n<li>Click on your profile to edit the settings<\/li>\n<li>Go to the <strong>Real-time scanning<\/strong> &gt; <strong>Protect Hosts File<\/strong><\/li>\n<li>Disable the setting<\/li>\n<li>Click <strong>Save and publish<\/strong><\/li>\n<\/ol>\n","protected":false},"excerpt":{"rendered":"<p>How does the <b>Protect the hosts file <\/b>security<b>\u00a0<\/b>feature work with WithSecure Elements Endpoint Protection and Client Security products on a Windows host?\u00a0<br \/>What happens to an already modified hosts file when WithSecure security product is installed?\u00a0<\/p>\n","protected":false},"template":"","support_article_product":[106],"class_list":["post-4339","support_article","type-support_article","status-publish","hentry"],"acf":{"source_foreign_id":"000014870","source_version":3,"source_system":"salesforce","source_date_updated":"2026-06-08 14:56:14","import_hash":"7693391f0a1f83f8f5bf76cb2df7243830d665cb","vanilla_article_id":32446,"vanilla_url":"https:\/\/community.withsecure.com\/en\/kb\/articles\/32446-how-does-the-protect-the-hosts-file-security-feature-work","vanilla_kb_id":30,"vanilla_category_id":103,"machine_translated":false,"reactions_helpful_yes":0,"reactions_helpful_no":0},"_links":{"self":[{"href":"https:\/\/support.withsecure.com\/fi\/wp-json\/wp\/v2\/support_article\/4339","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/support.withsecure.com\/fi\/wp-json\/wp\/v2\/support_article"}],"about":[{"href":"https:\/\/support.withsecure.com\/fi\/wp-json\/wp\/v2\/types\/support_article"}],"wp:attachment":[{"href":"https:\/\/support.withsecure.com\/fi\/wp-json\/wp\/v2\/media?parent=4339"}],"wp:term":[{"taxonomy":"support_article_product","embeddable":true,"href":"https:\/\/support.withsecure.com\/fi\/wp-json\/wp\/v2\/support_article_product?post=4339"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}