[suggestion] Change HOSTS file format

Printable View

2009-01-21, 00:46
m00nbl00d

[suggestion] Change HOSTS file format

I guess you guys are aware that a huge HOSTS file needs the DNS Client to be disabled or set to manual, and then be used when needed.

I guess you guys are also aware that, if we're talking about a computer network, then DNS Client needs to be enabled, otherwise things just won't work.

Until a while back, the only way would be not to use such a huge HOSTS file and keep DNS Client enabled.

But, someone made a finding that if we optimize the HOSTS file like this:

127.0.0.1 maliciousdomain1 maliciousdomain2 [...], up to nine entries in each line

It would be possible to keep DNS Client enabled, while having a huge HOSTS file.

I've noticed that Spybot acts crazy if the HOSTS file is optimized that way.

I hope you guys make Spybot also place HOSTS entries like that, or give it has an option. Otherwise it won't be possible to have that HOSTS file optimized that way and run Spybot, 'cos Spybot will crash when performing scans.

Regards
2009-01-26, 15:54
PepiMK

Quote:

Originally Posted by m00nbl00d

I guess you guys are also aware that, if we're talking about a computer network, then DNS Client needs to be enabled, otherwise things just won't work.

Actually depends on the OS and network type if that is so or not ;)

I'm not sure why a different format should behave differently, but we will test a few things. Might be that this slows down immunization, since tests for existing domains need to be a bit more complex (or construction of the new file would be).
2009-01-26, 22:42
m00nbl00d

Quote:

Originally Posted by PepiMK

Actually depends on the OS and network type if that is so or not ;)

Yes, but, I was talking in a more general way. ;)

So, the best is to have a product that covers all fronts. :)

Quote:

Originally Posted by PepiMK

I'm not sure why a different format should behave differently, but we will test a few things. Might be that this slows down immunization, since tests for existing domains need to be a bit more complex (or construction of the new file would be).

I'm aware that such could be a problem, but, nothing that couldn't be done, and test a few things.
It will make Spybot not crash, if scanning the system with it, if the HOSTS file is in the format I mentioned.

Its something I experienced.

I appreciate the feedback from you guys!

Keep up with the good work.

Regards
2009-01-28, 18:42
PepiMK

Hmmm... I just tried a few host file modifications, but could not get Spybot to crash on those multi-entry-lines so far. Do you have any example hosts file maybe?

Still need to ensure that detection in multi-entry-lines works, will do that next :)
2009-02-10, 02:24
m00nbl00d

Quote:

Originally Posted by PepiMK

Hmmm... I just tried a few host file modifications, but could not get Spybot to crash on those multi-entry-lines so far. Do you have any example hosts file maybe?

Still need to ensure that detection in multi-entry-lines works, will do that next :)

Sorry for being late answering you...

Yes, it seems Spybot doesn't crash. Even with my heavy HOSTS file. ;) That's odd... Maybe, when it crashed, a few months ago, when I first started using the HOSTS file the way I mentioned, it was due to the fact I was using one other method to put it like that, and somehow, it messed with the HOSTS file (perhaps, something I missed in it), hence making Spybot crash during scan. Now, I use a small program, which will do it.. And it didn't crash. So, great thing...

Next, I will place a few entries in the HOSTS file blocking security vendor domains and see if Spybot is able to detect them and clean it.

I'll give some news later on.

Regards
2009-06-26, 21:43
Kinobe
I'm sorry about digging up an old thread. I discovered this thread via Google while researching about the "optimized" hpHosts HOSTS file maintained by Steven Burn.

In regards to an "optimized" HOSTS file that m00nbl00d mentioned in the original post above, some follow-up information in this thread seems lacking (and I also use Spybot S&D) so I am contributing some more info. :)

According to the hpHosts Download page, using a large HOSTS file can be particularly problematic, especially when the Windows DNS Client Service is enabled. That apparently is their rationale for providing an "optimized" HOSTS file. (Read the hpHosts Download page for more details.)

Quote:

Originally Posted by PepiMK

Do you have any example hosts file maybe? ...

Here are direct links to the "optimized" Hosts file maintained by hpHosts' Steven Burn.
- Primary: http://support.it-mate.co.uk/downloa...-optimized.zip
  Mirrors:
I am considering switching to the "optimized" hpHosts' file instead of their standard format file. However, I want to avoid any problems/conflicts with my computer's configuration if possible.

I do not wish to "hijack" this thread so I ask only two questions that I think are in line with the original poster's concerns. :)
1. Does Spybot S&D play well with a large "optimized" HOSTS file (9 hosts per line, as described in the original post)?
2. If so, then does (or will) Spybot's "Immunize" feature append entries to the HOSTS file in the same "optimized" format?
2009-07-17, 16:18
m00nbl00d
Quote:
Originally Posted by Kinobe

I'm sorry about digging up an old thread. I discovered this thread via Google while researching about the "optimized" hpHosts HOSTS file maintained by Steven Burn.

In regards to an "optimized" HOSTS file that m00nbl00d mentioned in the original post above, some follow-up information in this thread seems lacking (and I also use Spybot S&D) so I am contributing some more info. :)

According to the hpHosts Download page, using a large HOSTS file can be particularly problematic, especially when the Windows DNS Client Service is enabled. That apparently is their rationale for providing an "optimized" HOSTS file. (Read the hpHosts Download page for more details.)

Here are direct links to the "optimized" Hosts file maintained by hpHosts' Steven Burn.

Primary: http://support.it-mate.co.uk/downloa...-optimized.zip
Mirrors:

http://www.montanamenagerie.org/host...-optimized.zip
http://hosts-file.malwareteks.com/hosts-optimized.zip
http://temerc.com/hphosts/hosts-optimized.zip
http://avant.it-mate.co.uk/dl/Tools/...-optimized.zip
http://www.calendarofupdates.com/upd...detail&f_id=23

I am considering switching to the "optimized" hpHosts' file instead of their standard format file. However, I want to avoid any problems/conflicts with my computer's configuration if possible.

I do not wish to "hijack" this thread so I ask only two questions that I think are in line with the original poster's concerns. :)

Does Spybot S&D play well with a large "optimized" HOSTS file (9 hosts per line, as described in the original post)?
If so, then does (or will) Spybot's "Immunize" feature append entries to the HOSTS file in the same "optimized" format?
Thank you for adding that additional information.

Regarding your two questions.

1 - Yes, it seems to be playing well with a large optimized HOSTS file.
2 - As of now, Spybot will add entries like the old fashioned way, because Spybot is not programmed to add them like I mentioned.

So, it would be great for Spybot 2.0 to offer that feature.
2009-08-05, 05:37
Kinobe

Thanks for replying, m00nbl00d.

After reading your reply, I started using the hpHosts "optimized" HOSTS file with my laptop and I even immunized a couple times with Spybot since then.

So far, seems to be working. :)

I recently tested that configuration in my laptop at a particular local public network where I previously had trouble with the 2GB+ "normal" format hpHosts HOSTS file and I am happy to say I was able to use the Internet. It wasn't quite as responsive as I would like but it worked (tolerable for now).

I think the particular problem with that network is the DHCP lease time is only 3 MINUTES. I know that's a very short time. So far, I don't think the public network administrator will really "listen" to me. That's the body language I got anyway when I mentioned it on more than one occasion.

With a huge HOSTS file, I think my computer's DNS resolver cache could never finish its operation before the DHCP would reset. I was only very sporadically able to connect to a web site until I replaced the huge HOSTS file with the default from MS. Then Internet things were "snappy" fast.

=======

Anyway, I also vote for the Spybot developers adding the "9 hosts per line" immunization option to a future release of Spybot Search & Destroy. In the meantime, I'll live with the "half optimized/half normal" HOSTS file for awhile. :)

=======

Thanks again for your response.