The online racing simulator
Host File - Protection Against Ads/Malware
(7 posts, started )
Host File - Protection Against Ads/Malware
I wrote a little tool today, born out of my own frustrations with the internet. It is for Windows XP SP1 and SP2 only.

There's two ways to approach this, the simple way and the complex way - pick the post you want to read based on your computer knowledge then skip to the last bit.

The Complex Way
A hosts file is a list of URL's stored on your computer with corresponding IP addresses. When you enter a URL, such as http://www.lfsforum.net your browser asks your "Domain Name Server" (which is provided by your ISP) for the IP address of that server. An IP address is a series of techy geeky numbers which route your internet based data and get the right information, basically, it's like the door number on your house.

A hosts file changes this procedure a little bit by first getting your browser to check a list of web URL's stored on your own machine, specifically, stored in the hosts file. (Note for Mac users: "UNLUCKY!"*).

We can use this to take some control back from the freaks on the internet who use it to bombard us with pop up adverts, spyware, viruses and malware.

Most malliscious and unwanted software, pop ups and web pages work by URL and not IP because of a beautiful thing called name servers and shared hosting - but that's all far too in depth even for the complex explanation - so basically unless a nasty hacker type advert person buys their own server on their own IP (and gets it black listed pretty quickly) they are forced to use a URL to host their nasty works.

We can use the hosts file to blacklist those URL's by redirecting all requests to a special IP address called localhost, or 127.0.0.1. This special address loops back to your own machine, so ...

When I send a request to www.nastypopupadvertserver.com/advert1.html my browser first looks at my hosts file, if it sees the URL in it's database then it sends the request to: 127.0.0.1/advert1.html

Or in other words, it asks my own machine for the file advert1.html, which I dont have, so it doesnt do anything.

eh voila, problem solved... Except there's a problem.

Where are all these nasty websites? Well that's where the hosts file project comes in. There's thousands of people out there all competing to be the one who first reports a new URL as a nasty advert server, and a team of moderators who hand check each URL submitted. The results are then published on a website.

Problem solved right? Well no, because remember to go get it is a nightmare, and you have to fiddle around to find where to save the file and flaff about with filename extensions and all in all it's just a plain pig that I maybe get around to doing once every 6 months or so, and that just isn't enough.

So I wrote a program to do it for me.

Simple Explanation
This will help protect your computer from pop ups, malware, viruses and other annoying internet related junk. It is not memory resident and will not effect the performance of your PC.

The Last Bit
As I mentioned before this is only for Windows XP, other versions of Windows can use a hosts file but the path to save the file is different and my program doesnt support that.

There is however a little glitch with using a hosts file in Windows XP (and also 2000 for that matter) it stems out of Microsoft's insistence that caching of domain names is more important than the general funcitonality of your computer - and when you have several thousand domain names stored locally it can all get out of hand.

To counter this, if you wish to use this tool, turn off DNS caching. It's a non-essential service that will not effect performance in a negative way because Microsoft wrote it so badly, in my experience it actually degrates performance - it reduces DNS lookup times to sites you've already visited today and replaces it with net drop outs in the background - theoretically in downtime - but not so great for games players.

To disable DNS Caching: Right click my computer and click Manage.
Expand Services and Applications
Click Services
Right click DNS Client and goto Properties
Stop the service and change startup type to Disabled.

Now all you need is my little program to download your hosts file, the current database is about 1,5mb in size so it's probably unfair on the person who pays the bandwidth bill to stick it in your startup.

Instead stick the program on your desktop, quicklaunch, start menu, or where-ever else is convenient. It's a self contained .exe file with no other supporting files and is only half meg in size and then run it once a week.

It aint pretty, but it does the job.

http://www.simtouringcarcup.com/hostFileGrabber.zip

*Re: Mac users - Technically it's possible, but a balls up at Apple in the priority assignment of DNS lookups makes it a pig - you're going to need to delve into the Unix shell to use a hosts file, so I say again, "UNLUCKY!".
#2 - filur
Quote :When cleaning Malware/Spyware from a PC, it is much easier to check a clean Hosts File then one filled with thousands of lines of addresses.

I'd go for something like Junkbuster.

Also not a good idea for people running their own webserver (on localhost) to use the hosts file for blocking purposes.
#3 - ajp71
Thanks will give it a try, is there a link to this hosts file project? What exaactly is added to it all Ads or just spy/malware?
You can find more about hosts files here:
http://en.wikipedia.org/wiki/Hosts_file

The host file I use is this one, which seems pretty comprehensive:
http://hostsfile.mine.nu/

I ought to look around really, there may be more rigorously updated or larger hosts files listed on those Wikipedia sites.

Quote :Also not a good idea for people running their own webserver (on localhost) to use the hosts file for blocking purposes

I can't see it making a difference. It effects outbound requests only and doe not re-route localhost. The only mess up might be if you had the same filename as an add or nasty adware file - but that's remote.
#5 - filur
Quote from Becky Rose :I can't see it making a difference. It effects outbound requests only and doe not re-route localhost. The only mess up might be if you had the same filename as an add or nasty adware file - but that's remote.

It does (of course) re-route to localhost, for example, i use the hosts file to set some internal "domains" which only i can access, with corresponding virtual hosts in apache (localhost!).

Thus, 2000 re-routes from these entries in the hosts file would create 2000 lines of errors in my log.
Which is why you could reroute them to your router if you wanted to, or an other computer on your network? But IMO host files are a very false sense of security seeing Malware actively changes networks due to this kind of stuff being posted.
#7 - ebola
This has been known about for years and some spyware just recreate a blank hosts file so not foolproof by any means. In fact spyware makers used this first by redirecting bank and AV update servers.

Plus when you immunise with Spybot Search and Destroy it also does this for you.

Host File - Protection Against Ads/Malware
(7 posts, started )
FGED GREDG RDFGDR GSFDG