Corrupt /etc/hosts configuration file

Question

Corrupt /etc/hosts configuration file

I ran Etrecheck (after downloading the latest version) and it shows a corrupt /etc/hosts config file. I'm not sure what it is, but this is the first time I've seen this problem running Etrecheck.

The reason I ran Etrecheck was to see if there was a problem on the display side (wavy line while scrolling), so am surprised to see this message. In the past, I was getting a warning that the file size was not what it expected it to be (not sure which file).

Thank you.

Here is the complete Etrecheck report:

EtreCheck version: 3.1.4 (342)

Report generated 2016-12-05 10:17:40

Download EtreCheck from https://etrecheck.com

Runtime 4:05

Performance: Good

Click the [Support] links for help with non-Apple products.

Click the [Details] links for more information about that line.

Problem: Other problem

Hardware Information: ⓘ

iMac (21.5-inch, Late 2012)

[Technical Specifications] - [User Guide] - [Warranty & Service]

iMac - model: iMac13,1

1 2.9 GHz Intel Core i5 (i5-3470S) CPU: 4-core

16 GB RAM Upgradeable - [Instructions]

BANK 0/DIMM0

8 GB DDR3 1600 MHz ok

BANK 1/DIMM0

8 GB DDR3 1600 MHz ok

Bluetooth: Good - Handoff/Airdrop2 supported

Wireless: Unknown

Video Information: ⓘ

NVIDIA GeForce GT 650M - VRAM: 512 MB

iMac 1600 x 900

System Software: ⓘ

macOS Sierra 10.12.1 (16B2657) - Time since boot: less than an hour

Disk Information: ⓘ

APPLE HDD HTS541010A9E662 disk0 : (1 TB) (Rotational)

[Show SMART report]

EFI (disk0s1) <not mounted> : 210 MB

Macintosh HD (disk0s2) / [Startup]: 999.35 GB (947.47 GB free)

Recovery HD (disk0s3) <not mounted> [Recovery]: 650 MB

USB Information: ⓘ

HP Officejet Pro 8600

Apple Inc. FaceTime HD Camera (Built-in)

Apple Inc. BRCM20702 Hub

Apple Inc. Bluetooth USB Host Controller

Apple, Inc. Keyboard Hub

Apple Inc. Apple Keyboard

Western Digital My Passport 0748

Apple Inc. MacBook Air SuperDrive

Thunderbolt Information: ⓘ

Apple Inc. thunderbolt_bus

Configuration files: ⓘ

/etc/hosts - Corrupt!

Gatekeeper: ⓘ

Mac App Store and identified developers

Kernel Extensions: ⓘ

/Library/Extensions

[loaded] com.sophos.kext.oas (9.5.54 - SDK 10.11 - 2016-11-17) [Support]

[loaded] com.sophos.nke.swi (9.5.52 - SDK 10.11 - 2016-11-17) [Support]

System Launch Agents: ⓘ

[not loaded] 7 Apple tasks

[loaded] 188 Apple tasks

[running] 84 Apple tasks

System Launch Daemons: ⓘ

[not loaded] 41 Apple tasks

[loaded] 168 Apple tasks

[running] 102 Apple tasks

Launch Agents: ⓘ

[not loaded] com.adobe.AAM.Updater-1.0.plist (2016-10-30) [Support]

[running] com.sophos.uiserver.plist (2016-11-17) [Support]

Launch Daemons: ⓘ

[running] com.adobe.agsservice.plist (2016-10-30) [Support]

[loaded] com.barebones.textwrangler.plist (2012-12-30) [Support]

[running] com.sophos.common.servicemanager.plist (2016-11-17) [Support]

User Launch Agents: ⓘ

[loaded] com.adobe.AAM.Updater-1.0.plist (2016-10-30) [Support]

[loaded] com.adobe.ARM.[...].plist (2016-11-07) [Support]

[loaded] com.citrixonline.GoToMeeting.G2MUpdate.plist (2016-11-07) [Support]

User Login Items: ⓘ

iTunesHelper Application (2016-11-06)

(/Applications/iTunes.app/Contents/MacOS/iTunesHelper.app)

AdobeResourceSynchronizer Application Hidden

(/Applications/Adobe Reader.app/Contents/Support/AdobeResourceSynchronizer.app)

ElementsAutoAnalyzer Application

(/Applications/Adobe Elements 12 Organizer.app/Contents/ElementsAutoAnalyzer.app)

Internet Plug-ins: ⓘ

AdobePDFViewerNPAPI: 11.0.18 - SDK 10.6 (2016-11-07) [Support]

AdobePDFViewer: 11.0.18 - SDK 10.6 (2016-11-07) [Support]

QuickTime Plugin: 7.7.3 (2016-10-21)

AdobeAAMDetect: AdobeAAMDetect 1.0.0.0 - SDK 10.6 (2016-10-30) [Support]

User internet Plug-ins: ⓘ

CitrixOnlineWebDeploymentPlugin: 1.0.105 (2013-04-25) [Support]

Safari Extensions: ⓘ

AdBlock - BetaFish, Inc. - https://getadblock.com (2016-05-15)

3rd Party Preference Panes: ⓘ

None

Time Machine: ⓘ

Mobile backups: OFF

Auto backup: YES

Volumes being backed up:

Macintosh HD: Disk size: 999.35 GB Disk used: 51.88 GB

Destinations:

My Passport for Mac [Local]

Total size: 1.00 TB

Total number of backups: 236

Oldest backup: 12/28/12, 11:25 AM

Last backup: 12/4/16, 8:41 PM

Size of backup disk: Adequate

Backup size 1.00 TB > (Disk used 51.88 GB X 3)

Top Processes by CPU: ⓘ

6% SophosAutoUpdate

4% SophosScanD

3% kernel_task

3% WindowServer

2% backupd

Top Processes by Memory: ⓘ

928 MB kernel_task

262 MB SophosScanD

197 MB mdworker(6)

131 MB mds_stores

131 MB UserEventAgent(2)

Virtual Memory Information: ⓘ

9.51 GB Available RAM

6.41 GB Free RAM

6.49 GB Used RAM

3.11 GB Cached files

0 B Swap Used

Diagnostics Information: ⓘ

Dec 5, 2016, 10:10:59 AM Self test - passed

Dec 4, 2016, 12:31:57 PM ~/Library/Logs/DiagnosticReports/com.apple.WebKit.Plugin.64_2016-12-04-123157_[ redacted].crash

/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.We bKit.Plugin.64.xpc/Contents/MacOS/com.apple.WebKit.Plugin.64

Dec 4, 2016, 12:30:30 PM ~/Library/Logs/DiagnosticReports/com.apple.WebKit.Plugin.64_2016-12-04-123030_[ redacted].crash

Dec 4, 2016, 12:28:05 PM ~/Library/Logs/DiagnosticReports/com.apple.WebKit.Plugin.64_2016-12-04-122805_[ redacted].crash

Dec 4, 2016, 12:15:09 PM ~/Library/Logs/DiagnosticReports/com.apple.WebKit.Plugin.64_2016-12-04-121509_[ redacted].crash

iMac, macOS Sierra (10.12.1)

Posted on Dec 5, 2016 7:43 AM

Reply

Answer 1

MrElvey

Level 1

61 points

Mar 7, 2017 7:19 PM in response to tedfrombrunswick

It matters less and less. I've just noticed that my installation of Safari doesn't pay attention to the /etc/hosts file any more.

I have an ad.doubleclick.net entry in it, but it's being ignored. Which is frustrating me because ad.doubleclick.net has started causing errors as I browse because it's using a wonky untrusted SSL certificate.

Reply

Answer 2

Dec 5, 2016 2:35 PM in response to tedfrombrunswick

Same thing here. Previously I had an issue with "sudoers" not being the correct size.

Configuration files:ⓘ

/etc/hosts - Corrupt!

Reply

Answer 3

John Galt

Level 10

155,804 points

Dec 5, 2016 2:50 PM in response to tedfrombrunswick

Copy and Paste the following in a Terminal window:

cat /etc/hosts

Paste its results in a reply to this Discussion.

Reply

Answer 4

V.E.

Level 1

13 points

Dec 5, 2016 4:54 PM in response to John Galt

I too have this problem with EtreCheck saying my /etc/hosts file were corrupt...

Here is what the Terminal shows when I ask it for

cat /etc/hosts

--------------------------------------------------------

##

# Host Database

#

# localhost is used to configure the loopback interface

# when the system is booting. Do not change this entry.

##

127.0.0.1 localhost

255.255.255.255 broadcasthost

::1 localhost

fe80::1%lo0 localhost

--------------------------------------------------------

As a matter of fact, I do not see much difference (or rather - none at all) between my Terminal results and the way the /etc/hosts file is supposed to look like according to these instructions: Fixing a hacked /etc/hosts file

Should I worry about my hosts file being allegedly corrupt (according to EtreCheck) or what is actually the matter with it?

Thank you!

Reply

Answer 5

John Galt

Level 10

155,804 points

Dec 5, 2016 5:02 PM in response to V.E.

That looks OK to me, so I'd be inclined to disregard the message. The only qualified person to interpret the meaning of /etc/hosts - Corrupt! is its developer. He could probably explain its appearance.

Perhaps the file type is incorrect? Please try the following:

file /etc/hosts

The response should be

/etc/hosts: ASCII text

If that's correct, I suggest you don't worry about it.

Reply

Answer 6

V.E.

Level 1

13 points

Dec 5, 2016 5:12 PM in response to John Galt

Thank you for your prompt reply, John!

Yes, the Terminal response to file /etc/hosts looks indeed like this:

/etc/hosts: ASCII English text

(the term "English text" is, I suspect, the proper reply to the system language being German, right?)

Hmmm... Never seen this thing /etc/hosts - Corrupt! in any previous EtreCheck reports before...

Many thanks again!

Reply

Answer 7

John Galt

Level 10

155,804 points

Dec 6, 2016 6:21 AM in response to V.E.

(the term "English text" is, I suspect, the proper reply to the system language being German, right?)

I am not completely certain of that, but it may very well be the reason EtreCheck is erroneously concluding that Mac's Hosts file is corrupt. I surmise it is a localization bug, but only Mr. Etresoft can make that determination.

I may try to duplicate it by changing a Mac's language to German and running the latest EtreCheck version. If I get the same result as you, then I will conclude it's a bug that should be disregarded.

Reply

Answer 8

Barney-15E

Level 10

122,252 points

Dec 5, 2016 5:35 PM in response to tedfrombrunswick

Getting to the other point, I don't see anything that would cause a graphics problem, but AV software tends to surprise me with its ingenuity.

Try uninstalling Sophos and see if things get better.

Don't worry, your Mac will be as safe as it was with Sophos installed, but will run better.

Reply

Answer 9

etresoft

Level 9

56,668 points

Dec 6, 2016 6:22 AM in response to tedfrombrunswick

Hello ted,

Yes. That does appear to be a bug in EtreCheck 3.1.4. I am being too strict about the number of entries required for localhost and broadcasthost. As John Galt suggests, I would be the best person to contact about a potential problem in EtreCheck. I made this change because one person contacted me to report that EtreCheck was not detecting a clearly corrupt hosts file.

I also made a change to the detection of a modified /etc/sudoers file. This is an Apple bug, not an Etresoft bug. macOS updates will no longer ever update the sudoers file. So EtreCheck now accepts any previously (apparently) valid sudoers file.

EtreCheck 3.1.5 is already posted.

Reply

Answer 10

V.E.

Level 1

13 points

Dec 6, 2016 1:28 AM in response to etresoft

Yes, the latest version of EtreCheck (3.1.5) has fixed the problem of wrongly accusing the /etc/hosts file as being corrupt - thank you!

"So EtreCheck now accepts any previously (apparently) valid sudoers file."

Hmmm... My latest report (with v. 3.1.5) says it still has the wrong size:

Configuration files: ⓘ

/etc/sudoers, File size 2301 but expected 2299

Any way to fix this one too?

Many thanks!

Reply

Answer 11

Dec 6, 2016 6:20 AM in response to tedfrombrunswick

Thanks to all who replied to my post.

It seems the error was indeed with Etrecheck. They released a new version, which I just downloaded, and it now shows no problems. To those who still show errors or warnings, try downloading the newest version, or let Etrecheck know what issue you have and see if it's on their end.

Reply

Answer 12

etresoft

Level 9

56,668 points

Dec 6, 2016 6:47 AM in response to V.E.

Hello V.E.,

That is not a known, valid size. Some 3rd party software has modified it to give itself super-user permissions hen ever it wants. Unfortunately, that file has very restrictive permissions. EtreCheck can only check the size.

I suggest you start your own thread and include the contents of this file. We will be able to tell if it is legitimate or not or at least see whigh software now has control of your machine and all of your data.

Reply

Answer 13

V.E.

Level 1

13 points

Dec 6, 2016 6:54 AM in response to etresoft

Thank you so much for the prompt reply!

OK, I will start a new thread about /etc/sudoers having the wrong size (as noted by EtreCheck).

See you there and many thanks again!

Reply

Answer 14

V.E.

Level 1

13 points

Dec 6, 2016 7:21 AM in response to etresoft

Hello again, etresoft!

I just started a new thread about the size of /etc/sudoers being wrong.

The title is: "EtreCheck says /etc/sudoers has the wrong size - should I worry?"

Thanks again!

Reply

Answer 15

Dec 6, 2016 9:01 AM in response to tedfrombrunswick

I am happy EtreCheck found this. There happened to be a problem with the IPV6 portion of my host file. I opened up the file after looking at how the file was suppose to look via Apple's dev site and noticed I my IPv6 portion was a bit off. P.S - You can always just go to the directory and open the file (hosts) with an app you write/edit/read code with (I use TextWrangler; my personal preference). ➕

Reply