Windows 10 hosts file used by another process

My etc\hosts file was locked by ZoneAlarm Firewall

To unlock, I had to uncheck the "Lock hosts file" in ZoneAlarm firewall settings menu

Just came across and solved this issue, after a little faffing, so thought I'd offer notes.

I used SysInternals Process Explorer, Run as Administrator, to find the process that was locking the file (by using Find > Find Handle or DLL). Note that when I ran it without Administrator permissions it couldn't see the system-level WRSA process.

In my case it was WRSA.exe, which is Webroot Secure Anywhere. Disabling the protection unlocked the file and I was able to overwrite it easily. In some versions of webroot you will have to open "Advanced Settings > Shields" and un-check the option for blocking edits to the hosts file.

It's completely right that anti-virus software should protect files such as hosts, of course. Malware loves that sort of thing.

I could eventually find the culprit. It was a program called "Tiny Firewall" (a windows firewall rule management software) that caused the problem.

I am not exactly sure what does it do to the hosts file because none of the available software could show a lock on the file. I could find that it is somehow involved with the file using process monitor (Sysinternals). I quit the UI and stopped the process (would not allow to stop, killed the process-tree and set to manual service).

P.S.: This is a feature of Tiny Firewall (protection of hosts file) and you can simply turn it off from its settings.