Printable View
Ok, so I thought I'd update my hosts file with a load of servers that give you nasties:
127.0.0.1 coolwwwsearch.com
127.0.0.1 coolwebsearch.com
127.0.0.1 hi.studioaperto.net
etc...
However, the pages still load.
I noticed that there's two other hosts files:
hosts.bho
host (recognised as an iCalendar file)
could these be interfering?
???? Your blocking your own computer ????Quote:
127.0.0.1 coolwwwsearch.com
127.0.0.1 coolwebsearch.com
127.0.0.1 hi.studioaperto.net
127.0.0.1 is the internal IP of your own machine. You need to put in the IP address of the offending site/server.
Edit> http://www.thinkgeek.com/cubegoodies/toys/6806/
erm...no, its associating the offending host name with my IP..so it goes to my localhost instead of them.
just realised it could be because of a proxy (web cache) so i'll try bypassing it for local addresses
edit: that didn't seem to work.
Dude.... Using 127.0.0.1 won't work.
And just to add, 127.0.0.1 is only the loopback interface... It has no purpose other than testing (that I'm going to get into for this)... All network functions run through either a static IP, or a DHCP assigned IP that is assigned to whatever network device you are using.
Edit: Moxnix, I got a shirt that says that. I have to upgrade it to IPv6 though...
Your syntax is correct. Something I just learned is that Firefox doesn't pay any attention to the host file. What browser are you using?
edit:
I wrote a tutorial on this a few days ago-
http://www.antionline.com/showthread...hreadid=258919
127.0.0.1 63.236.18.118
127.0.0.1 mjxads.internet.com
These entries in your host file will block ads from AO, so I would expect your syntax is correct also. To get rid of other variables, clear your temp browser files, hit refresh, and let us know what browser you got.
*sigh*
This is the type of thread that really burns my ass...
This is absolutely correct. In fact, most P2P cowboys here remember the good ol' days of Kazaa. Well they used to publish a *very* lengthly HOST file which would send all traffic associated with a particular worthless site to the loopback address. This technique works with *most* applications that follow standard name resolution practices (i.e. host file first, then DNS, etc.). My advise to a few of you would be to get your facts in line before you put on your "1337" hats and go around wielding questionable information.Quote:
erm...no, its associating the offending host name with my IP..so it goes to my localhost instead of them.
I'm using IE6.
I got rid of the other hosts files and cleared the temp Internet files but still no luck.
I suppose putting them in the restricted sites zone would be pretty much as good.
hi
Well my FireFox does pay attention to the host file........I am using ForeFox .9 ....and editing the host file does block the advertisements.......Quote:
Something I just learned is that Firefox doesn't pay any attention to the host file. What browser are you using?
--Good Luck--
IE6 uses the hosts file for name resolution. You have something else going on. Certain spyware apps can cause this issue. Have you scanned your host with a spyware cleaner yet? I'm assuming a few things here, starting with your HOSTS file being formatted correctly.
I've heard that winXP caches dns lookups, so maybe you need
to reboot to flush it.
:cool:
It couldn't be one of my anti-spyware programs could it? You know, with their hosts file protection? However, I thought this just made it read only.
I've scanned with spybot and adaware, but will try in safe mode. That will give me a restart too so should clear the cache.
The cache is cleared by doing this at the command prompt:
ipconfig /flushdns
No reboot required.
Yes, it could be your anti-spyware software doing this to you. Disable it and try your tests again.
Quote:
------------
I noticed that there's two other hosts files:
hosts.bho
host (recognized as an iCalendar file)
------------
yes this is definitely the cause. resolving to 127.0.0.1 or 0.0.0.0 would work on any url. but your already infected and have some absolutely free marketing research tools directing your browser to their ip address negating the need for ip resolution. you would get there even without a dns server. in fact some adware even has a cache of web pages stored in a file on your computer to help enhance your internet experience even when you not on line.
(i just love to use their euphemisms)
you need to get cwshreader and run a good adware/spyware remover
you also need to get all the ie updates and disable active scripting.
Sorry, i meant to say. I later checked those two files, the .bho was a backup, and all it contains is:
127.0.0.1 localhost
the other one was automatically generated for Internet Connection Sharing. It only has one IP, which is commented out.
Disabling the hosts protection on Spybot and SpywareBlaster didn't change it. I'm about to give up on it and just use the Restricted Sites instead, as well as relying on SpywareBlaster.
bho = browser helper object...did you name it that?
Exactly my point. Something else is hooking the box for resolution. Now, there are *tons* of awful BHOs out there so follow the advise and run a good spyware removal tool. As Tedob1 has noted, bhos are not friendly things.
Are you formating it correctly? i.e. 127.0.0.1 yahoo.com or www.yahoo.com
Don't use http in the line.
As per my earlier post, i've run spybot and adaware, and also in safe mode. They came up clean.
Also, how could the .bho file be hijacking me when it only contained: 127.0.0.1 localhost
Anyway, I deleted all the backups and restarted but no luck.
Now here's something I remember reading...that the Hosts file must be in upper case, i.e. HOSTS.
At the time I couldn't see how that would affect it, but now i look in the ETC folder, all the other files are upper case, but Hosts is not.
if you have spybot (and i am assuming you do since you said you did a scan with it) then you can do a search for "hosts" spybot comes with one that you can use to replace the one that windows uses...
If you don't want to do this, maybe could you post your hosts file (if it doesn't contain anything personal, which it shouldn't) and we can take a look at it just to make sure that is correct...
windows, for the most part, is not case sensitive, so you shouldn't have to worry about the uppercase/lowercase names because i know that mine is lowercase and it does work
finally, if you are trying to make it so that spyware doesn't install itself, i use a combination of the spybot immunize and Javacool's SpywareBlaster
Yeah, I used Spybot to create the hosts file.
I also have its immunisation and SpywareBlaster installed.
I'm sure it's not to do with the file itself, and my system comes up free of spyware.
I would have thought it would be because I have to use a web cache, but I set IE to ignore proxy settings for local addresses.
Well i've given up and downloaded Firefox. I reckon that with Adaware, Spybot, SpywareBlaster, a popup blocker, nasties in the Restricted sites...etc etc, there's not much else i can do!
hosts.bho may have been added by your anti-spyware program. if it is a back-up of the original one that comes with windows it would look like this:
# Copyright (c) 1993-1999 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host
127.0.0.1 localhost
but if you keep finding yourself at the "coolwebsearch" site then you've been hi-jacked. some of the pages that foward you to a cws link do so with an ip address so you can't use the hosts file to block it. much like AO doeas with its ad server. you have to block the ip using your firewall.
cwshreader is spacifically made to clean coolwebsearch crap (CoolWebSearchShreader). you might also download hijackthis and post the log if you still need help.
http://www.spywareinfo.com/~merijn/
http://209.133.47.200/~merijn/ (in case cws blocks the url)
just saw you quit...nevermind
It was definately a backup, and I also checked with CWShredder.
Thanks for all your help guys....damn computers eh
I am on Fox .8, and it is most definately ignoring the host file, unless something else is a factor here. No proxy is in the way, the cache is cleared too. Hmmm