host file help

[burrellbuzzman]

I searched on google and found this thread, i don't really understand it, i am a bit of a novice.

http://forums.spybot.info/showthread.php?t=20443

My problem began when I read about a win7 article choking ram on toms hardware and saw someone say look at resource monitor, i did this with no problems with my ram. anyway i looked at resource monitor and clicked on the "network" tab and i see under "network activity" that firefox.exe, with PID 984, and Address with www.007guard.com... so i presume firefox is contected to this site?

I rememeber a while ago when i was looking under the security settings on firefox that this address was blocked, however when i just checked after seeing www.007guard.com on my networking list, all the sites in the box have vanished? (i can't remember exactly what this box was) does this mean firefox is no longer protecting me?

i used spybot a while ago and set up immunisation, however i have uninstalled it on this computer due to conflicts, but still run it on some of my other machines. as far as i can remember this was before i started to use firefox. I am a bit of a novice and see people talking about HOST files on your forums and indeed i have a host file with, what i presume are immunisations... also from time to time on rescourse monitor, i have seen the sidebar connected to www.007guard.com aswell as Avast my virus software...

As the post i suggested up above, suggests the first part of the host file is missing, is this the case with mine?

# Copyright (c) 1993-2009 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host

# localhost name resolution is handled within DNS itself.
# 127.0.0.1 localhost
# ::1 localhost
# Start of entries inserted by Spybot - Search & Destroy
127.0.0.1 www.007guard.com
127.0.0.1 007guard.com
127.0.0.1 008i.com
127.0.0.1 www.008k.com
127.0.0.1 008k.com


It goes on with a long list of websites, any help would be greatly appreiciated

Rob

[Zenobia]

Hi.
The first part of your hosts file isn't missing.
These two lines are commented out,though,which apparently is normal in Windows 7.

# 127.0.0.1 localhost
# ::1 localhost

http://serverfault.com/questions/468...dns-itself-why

That is why your hosts file looks different to the one listed in quotes in the second post below:
http://forums.spybot.info/showpost.p...78&postcount=2
So,you ought to leave that be.
You aren't actually being connected to the 007guard.com site.

I rememeber a while ago when i was looking under the security settings on firefox that this address was blocked, however when i just checked after seeing www.007guard.com on my networking list, all the sites in the box have vanished? (i can't remember exactly what this box was) does this mean firefox is no longer protecting me?

That was most likely part of Spybot immunization,actually,and not something added by Firefox.Spybot adds those sites to Tools->Options->Security->Warn me when sites try to install add-ons,under Exceptions,when you immunize.

Since you've uninstalled Spybot on the computer you're using due to conflicts,would you like to leave the Spybot hosts file entries in your hosts file,or would you like to remove them?
Leaving them in will do no harm,and your browser will still not be able to go to the bad sites,even with Spybot uninstalled.It's up to you.

[Zenobia]

Leaving them in will do no harm,and your browser will still not be able to go to the bad sites,even with Spybot uninstalled.It's up to you.

Actually,come to think of it,I'm uncertain if the sites will still be unaccessable,where 127.0.0.1 localhost is commented out.

I found a couple sites saying blocking with the hosts file wasn't working in Windows 7,but nothing with a solution,or mentioning the 127.0.0.1 localhost
and ::1 localhost being commented out.Sorry.

[burrellbuzzman]

Hey, thanks for the reply!

well i thought that i would tamper with the host file... maybe not a great idea for a bit of a novice when it comes to these things, but what better way to learn!

what i did first of all, was put "127.0.0.1 localhost" in like this...

# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host

# localhost name resolution is handled within DNS itself.
# 127.0.0.1 localhost
# ::1 localhost
# Start of entries inserted by Spybot - Search & Destroy
127.0.0.1 localhost
127.0.0.1 www.007guard.com
127.0.0.1 007guard.com
127.0.0.1 008i.com
127.0.0.1 www.008k.com
127.0.0.1 008k.com

and saved it, but on win 7 the document is just a "file" ?? anyway i kept the original as it was and stored it on the desktop in case i got something wrong and then saved the new hosts file as a notepad doc or whatever it was and this seemed to remedy the problem in resouce monitor and saying that firefox.exe was connected to "Rob-PC" i guess because that's the local host?

Anyway in the end because i was unsure about the file formats, i ran spybot on my vista machince and noticed a difference between the orginal host file in my first post and the one on my vista machine, and the on on my vista machine was the same file format as before... so i thought what i would do was copy that file to my usb stick and just drop it into the drivers/etc folder

the new file looks like this...

# Copyright (c) 1993-2006 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host

127.0.0.1 localhost
::1 localhost
# Start of entries inserted by Spybot - Search & Destroy
127.0.0.1 www.007guard.com
127.0.0.1 007guard.com
127.0.0.1 008i.com

Checked resouce monitor again and firefox.exe was again connected to "Rob-PC" so i think it's all sorted?

but as for firefox... i don't understand! because i must have had at the very least the orginal host file that spybot immunised before i installed firefox and it had a list of blocked websites... but now it doesn't have any, but what i think is odd is that i physically saw this list! and when i installed firefox on my sisters laptop which doesn't have spybot, therefore no immunisations, thinkins i would find a list of blocked sites... i couldn't find any! much like my firefox?? so i'm not quite sure... oh well

Again thanks for the support

Rob

[burrellbuzzman]

but as for firefox... i don't understand! because i must have had at the very least the orginal host file that spybot immunised before i installed firefox and it had a list of blocked websites... but now it doesn't have any, but what i think is odd is that i physically saw this list! and when i installed firefox on my sisters laptop which doesn't have spybot, therefore no immunisations, thinkins i would find a list of blocked sites... i couldn't find any! much like my firefox?? so i'm not quite sure... oh well

Ahh just re-read your first post, ill see what's going on, with firefox on my other machince!!

[burrellbuzzman]

Bingo! it was spybot that blocked those sites in firefox!

Is there any way of setting spybot to run on demand? so i can protect my win7 computer without spybot running to conflict with my other software?

[Zenobia]

Hi.

and saved it, but on win 7 the document is just a "file" ?? anyway i kept the original as it was and stored it on the desktop in case i got something wrong and then saved the new hosts file as a notepad doc or whatever it was and this seemed to remedy the problem in resouce monitor and saying that firefox.exe was connected to "Rob-PC" i guess because that's the local host?

Anyway in the end because i was unsure about the file formats, i ran spybot on my vista machince and noticed a difference between the orginal host file in my first post and the one on my vista machine, and the on on my vista machine was the same file format as before... so i thought what i would do was copy that file to my usb stick and just drop it into the drivers/etc folder

Ok,Hosts should just be Hosts,with no extension(hosts.txt,hosts.exe,etc.)
So,I figure the first Hosts file was saved as Hosts.txt?And,then,the Hosts file you copied from your Vista machine to the Windows 7 machine with the USB stick,that was probably just Hosts,with no extension?
Could you go back to the Drivers/Etc. folder and let me know if it is that way?

Bingo! it was spybot that blocked those sites in firefox!

Yes,that's another part of Spybot's immunization.
http://forums.spybot.info/showthread.php?t=281

Is there any way of setting spybot to run on demand? so i can protect my win7 computer without spybot running to conflict with my other software?

Yes,you certainly can.If you decide to reinstall Spybot on the Windows 7 computer,just uncheck 'Use Resident Teatimer' when installing Spybot.You can also choose to not use Resident SDhelper when installing if you wish,though that is unlikely to interfere with anything.

And,you can choose to Immunize or not during set-up,depending on whether you still want to use Immunization,or just have Spybot as a malware scanner only.
Or,after reading the link I posted above,if there is one part of immunization you'd like to use,and another you'd rather not use,you can Immunize or Unimmunize different sections after Spybot is set up,from the Immunize page,as you like,too.

[burrellbuzzman]

Sweet, took your advice andinstalled spybot as an on demand scanner,

I included a picture of the drivers/etc folder so you can see what it looks like, this is what it looked like when it had commented out the local host as described in my first post and then when i tampered with it becaused i had edited it, i could only save it as a ".txt" file... when i compied the hosts file from my vista machine and inserted it in, it was the same as the picture above

Thanks, Rob

[Zenobia]

Okey-doke.Thanks for showing me the drivers/etc folder.

I included a picture of the drivers/etc folder so you can see what it looks like, this is what it looked like when it had commented out the local host as described in my first post

The first part of your hosts file isn't missing.
These two lines are commented out,though,which apparently is normal in Windows 7.

It's normal on Windows 7 for local host in the Hosts file to be commented out.I just want to be sure you understood that.
It shouldn't be any biggie for you to have the Vista hosts file in there that I know of,however,so I see no real pressing reason to change it back,it should be fine.And is that the original Windows 7 hosts file I see backed up below the new hosts file in your etc folder?

Glad you installed Spybot as an on-demand scanner.

[burrellbuzzman]

i presume that the back ups are of the windows vista host file that i put in the drivers/etc folder...

only because when i ran spybot, on my win 7 comp, firefox wasn't immunised so i just re ran the immunisation on here so possibly it just updated the original vista hosts file that i slipped into the folder.

I havn't had any problems so i guess i am all fixed

If you need to know anything else let me know and again thanks for the time of answering my questions really appreciated, the support here is world class! thanks

Rob