Help Hosts file keeps adding android.clients.google.com

[SuperiorBarchetta]

127.0.0.1 localhost

#127.209.254.223 android.clients.google.com
#74.125.93.113 android.clients.google.com
#127.178.244.27 android.clients.google.com
#127.178.244.27 android.clients.google.com
127.178.244.27 android.clients.google.com

The quote above is what my Hosts file looks like. It keeps being edited and it adds android.clients.google.com which is blocking Google Play and Snapchat and just about every other application I have. I tried many things to fix this already (as you can tell I've tried hashtagging or commenting the lines out but they keep getting automatically re-added.)

On Android 5.0 Lollipop
Sprint (rooted)

Please help!

 

[EarlyMon]

What ad blocker are you using?

 

[SuperiorBarchetta]

What ad blocker are you using?

I am using Adaway but I removed it since it edits the hosts file. After uninstalling all adblockers this is still occurring.

 

[EarlyMon]

I am using Adaway but I removed it since it edits the hosts file. After uninstalling all adblockers this is still occurring.

Did you turn ad blocking off before uninstalling Adaway?

And btw - I use Adaway and don't have this problem so it's not coming from there.



How about a screen shot of your apps with root permissions from SuperSU?

Or maybe check your SuperSU logs?

It's definitely not ok to have a system file block Google like that - and whatever is causing it may be nefarious.

 

[EarlyMon]

Wait a minute, I wasn't paying attention, I just went by your words.

android.google.yeah-yeah-yead isn't being blocked.

That's a hijack attempt.

You're being phished.

 

[EarlyMon]

Only 74.125.93.113 belongs to Google.

Grab Malwarebytes and scan fwiw.

Then put your phone in airplane mode - or at least turn off all mobile data and wifi - get to a pc and begin by changing your Gmail password.

Don't connect to the Internet until sorted out.

 

[SuperiorBarchetta]

Wait a minute, I wasn't paying attention, I just went by your words.

android.google.yeah-yeah-yead isn't being blocked.

That's a hijack attempt.

You're being phished.

How do I stop it?
I heard about people installing faulty versions of Freedom. I uninstalled that. Would you know where to get reliable versions of Freedom or Network Spoofer? (and I uploaded a screenshot) and 2 things I removed from having permissions (and uninatalled) Network Spoofer / Freedom 1.07c

 

[SuperiorBarchetta]

Okay, I changed the passwords for literally everything I have. And also, I ran Malwarebytes on my phone and it found nothing. I uninstalled a 2 apps (Network Spoofer and Freedom) and I'm going to try and just browse around and see if it gets blocked again. (Also, I forgot to mention, when I am on Google Chrome it says "err_network_refused" on almost every site I go on. But That was before. I'll see how it is now.

 

[SuperiorBarchetta]

Only 74.125.93.113 belongs to Google.

Grab Malwarebytes and scan fwiw.

Then put your phone in airplane mode - or at least turn off all mobile data and wifi - get to a pc and begin by changing your Gmail password.

Don't connect to the Internet until sorted out.

Oh, and what do you mean, "fwiw"? I don't know what that means.

 

[EarlyMon]

Fwiw means for what it's worth.

Turn off any acceleration in Chrome, that forces things through Google proxies and you won't get the whole Internet.

That's settings, Data Saver, off.

 

[EarlyMon]

There are a number of Freedom apps.

If you mean the one that lets you get apps for free then you opened yourself up to a vast world of malware.

If that's the case, and it were the alternate universe me where I would use that Freedom, I would delete every app I got that way, every app I don't recognize installed into /data/app, and clear cache and Dalvik.


Any sideloaded paid games you got for free - lose them.

 

[SuperiorBarchetta]

There are a number of Freedom apps.

If you mean the one that lets you get apps for free then you opened yourself up to a vast world of malware.

If that's the case, and it were the alternate universe me where I would use that Freedom, I would delete every app I got that way, every app I don't recognize installed into /data/app, and clear cache and Dalvik.


Any sideloaded paid games you got for free - lose them.

Thank you for all of your help. Saved me. Phone is completely fine now.

 

[EarlyMon]

Go ahead and put Adaway back - in addition to ads it can block some malware sites.

 

[arkansawdave74]

It had me, too. It was Freedom for sure. I had already suspected it because it added to my hosts file every time I used it. I hope I'm rid of the threat, but I don't know what to do with my hosts file... Could you tell me what to do, please? My Google Apps can't connect, and adding a hash to the new entries isn't helping now that I've gotten rid of freedom. Here's a screen shot...

 

[arkansawdave74]

Root Explorer wasn't granted permission to add the hash... Just appeared to edit the file... Re-granted root permission and my g-apps are working again. Is it safe to leave the hosts file as it is?

 

[EarlyMon]

A minimal but correct hosts file will say -

127.0.0.1 localhost

Spaces or tab after the address is fine, any separation (we call it whitespace) will do.

If I read you right - you've removed Freedom and the problem persists.

Per my earlier post, if you've also removed every app Freedom has touched and been involved in - then I can only assume that the infection is deeper and you're next bet would be a factory data reset.

Unless you have other apps gotten from outside the Play Store and you want to remove just those.

Because of how nefarious this type of infection can be, if it were me, I'd go for the reset - but it's your option to work up to that.

 

[arkansawdave74]

Thank you for your quick response. I don't think the problem is persisting, but it's too early to know for sure. I ran malwarebytes and it didn't like king user so, just to be safe, I uninstalled it and grabbed superuser. When I attempted to save the edited hosts file I had edited with Root Explorer by adding the hash mark, it said "Saved", so I assumed Superuser had granted the permission without prompting me. I was wrong. Root Explorer lied. It didn't save the change... It just said it did. After double-checking, as soon as I granted root permission to Root Explore and added the hash, everything seems to be okay

 

[EarlyMon]

And make sure that first localhost entry is not commented out (that's what putting the # at the beginning does).

You're likely to see some really weird bugs with that commented out.

 

[afroag]

Only 74.125.93.113 belongs to Google.

Grab Malwarebytes and scan fwiw.

Then put your phone in airplane mode - or at least turn off all mobile data and wifi - get to a pc and begin by changing your Gmail password.

Don't connect to the Internet until sorted out.

So does adding a # in front of that line remove the effect of that address? I was having an issue where the latest Gmail is not synching on my Custom ROM. Its Hyperdrive 4.4.4 and it comes with an adaway host file which I edited to have only contain:

127.0.0.1 localhost
#74.125.93.113 android.clients.google.com
#127.43.65.252 android.clients.google.commtalk.google.com

I don't think it fixed anything. I just removed Gmail updates and now its synching. Should I remove the # in front of the 74.125.93.113 line?

 

[arkansawdave74]

Wow! I totally forgot about this thread. Mine kept screwing up until I got rid of freedom. I used modded playstore for quite a while after and didn't have any kind of issues that I ever noticed.

 

[afroag]

Wow! I totally forgot about this thread. Mine kept screwing up until I got rid of freedom. I used modded playstore for quite a while after and didn't have any kind of issues that I ever noticed.

My problem is my Custom ROM came with an adaway hostfile. Adaway is no longer on the google play store so I can't uninstall/install it. Adaway isn't on the ROM either, at least in app form.

I have been having trouble getting my Gmail, picassa, and contacts to sync. What I did do was rollback gmail and luckily it didn't update itself to the latest version. I went ahead and disabled auto update for good measure.

I then used Root Explorer to edit my host file to say:
127.0.0.1 localhost
#74.125.93.113 android.clients.google.com
#127.43.65.252 android.clients.google.commtalk.google.com

I don't think the later made a difference. I think the main difference was removing the latest update to Gmail

 

[NameLessHaxc]

Change the hosts file to: apple.clients.google.com

 

[Firedsoldier1337]

I think i know why this happens...... for those who use Freedom for free offline iap's disable offline license verification and re-edit the hosts file which was edited by freedom and that should work to fix your problem