When various types of Internet advertisements became invasive, some people used the hosts file as a means to bypass the ads. People would add an entry to their hosts file that redirected an ad server away from the intended destination. Or, using our analogy from above we could redirect the New York Times traffic to your home address.
This redirection can be accomplished by adding a line such as the following to the hosts file:
127.0.0.1
www.xyz.com # ad server for XYZ company
In the above example, when your web browser encountered a request for “
www.xyz.com”, it would look in the hosts file and find the entry 127.0.0.1. This IP address is a universal address assigned to the localhost that is your PC. So, rather than going to the true IP address for the XYZ ad server, the request would stop at your PC and the ad wouldn't appear. You can also add a # sign and comment to identify the site.
This same process is also used by various anti-spyware packages. Instead of redirecting ad servers, they protect you by preventing access to various sites. Typically, these are sites that have spyware, malware or adult-orientated material. Some of these programs also lock the hosts file or alert you if there have been changes.
Because the file can redirect traffic, some malicious programs have tried to insert entries into this file for their purposes. One morning, you type http://www.nytimes.com/ and you're now staring at some adult site in Eastern Europe. Sorry, the hosts file doesn't do any verification. If there is an entry for the New York Times that maps to an IP address in Eastern Europe, well that's where your browser will go. As this example illustrates, you can be hijacked as you can use any IP address and not just 127.0.0.1.
