Results 1 to 8 of 8

Thread: [suggestion] Change HOSTS file format

  1. #1
    Member
    Join Date
    Jan 2009
    Posts
    78

    Default [suggestion] Change HOSTS file format

    I guess you guys are aware that a huge HOSTS file needs the DNS Client to be disabled or set to manual, and then be used when needed.

    I guess you guys are also aware that, if we're talking about a computer network, then DNS Client needs to be enabled, otherwise things just won't work.

    Until a while back, the only way would be not to use such a huge HOSTS file and keep DNS Client enabled.

    But, someone made a finding that if we optimize the HOSTS file like this:

    127.0.0.1 maliciousdomain1 maliciousdomain2 [...], up to nine entries in each line

    It would be possible to keep DNS Client enabled, while having a huge HOSTS file.

    I've noticed that Spybot acts crazy if the HOSTS file is optimized that way.

    I hope you guys make Spybot also place HOSTS entries like that, or give it has an option. Otherwise it won't be possible to have that HOSTS file optimized that way and run Spybot, 'cos Spybot will crash when performing scans.

    Regards

  2. #2
    Member of Team Spybot PepiMK's Avatar
    Join Date
    Oct 2005
    Location
    Planet Earth
    Posts
    3,601

    Default

    Quote Originally Posted by m00nbl00d View Post
    I guess you guys are also aware that, if we're talking about a computer network, then DNS Client needs to be enabled, otherwise things just won't work.
    Actually depends on the OS and network type if that is so or not

    I'm not sure why a different format should behave differently, but we will test a few things. Might be that this slows down immunization, since tests for existing domains need to be a bit more complex (or construction of the new file would be).
    Just remember, love is life, and hate is living death.
    Treat your life for what it's worth, and live for every breath
    (Black Sabbath: A National Acrobat)

  3. #3
    Member
    Join Date
    Jan 2009
    Posts
    78

    Default

    Quote Originally Posted by PepiMK View Post
    Actually depends on the OS and network type if that is so or not
    Yes, but, I was talking in a more general way.

    So, the best is to have a product that covers all fronts.

    Quote Originally Posted by PepiMK View Post
    I'm not sure why a different format should behave differently, but we will test a few things. Might be that this slows down immunization, since tests for existing domains need to be a bit more complex (or construction of the new file would be).

    I'm aware that such could be a problem, but, nothing that couldn't be done, and test a few things.
    It will make Spybot not crash, if scanning the system with it, if the HOSTS file is in the format I mentioned.

    Its something I experienced.

    I appreciate the feedback from you guys!

    Keep up with the good work.

    Regards

  4. #4
    Member of Team Spybot PepiMK's Avatar
    Join Date
    Oct 2005
    Location
    Planet Earth
    Posts
    3,601

    Default

    Hmmm... I just tried a few host file modifications, but could not get Spybot to crash on those multi-entry-lines so far. Do you have any example hosts file maybe?

    Still need to ensure that detection in multi-entry-lines works, will do that next
    Just remember, love is life, and hate is living death.
    Treat your life for what it's worth, and live for every breath
    (Black Sabbath: A National Acrobat)

  5. #5
    Member
    Join Date
    Jan 2009
    Posts
    78

    Default

    Quote Originally Posted by PepiMK View Post
    Hmmm... I just tried a few host file modifications, but could not get Spybot to crash on those multi-entry-lines so far. Do you have any example hosts file maybe?

    Still need to ensure that detection in multi-entry-lines works, will do that next
    Sorry for being late answering you...

    Yes, it seems Spybot doesn't crash. Even with my heavy HOSTS file. That's odd... Maybe, when it crashed, a few months ago, when I first started using the HOSTS file the way I mentioned, it was due to the fact I was using one other method to put it like that, and somehow, it messed with the HOSTS file (perhaps, something I missed in it), hence making Spybot crash during scan. Now, I use a small program, which will do it.. And it didn't crash. So, great thing...

    Next, I will place a few entries in the HOSTS file blocking security vendor domains and see if Spybot is able to detect them and clean it.

    I'll give some news later on.


    Regards

  6. #6
    Junior Member
    Join Date
    Jun 2007
    Posts
    8

    Default

    I'm sorry about digging up an old thread. I discovered this thread via Google while researching about the "optimized" hpHosts HOSTS file maintained by Steven Burn.

    In regards to an "optimized" HOSTS file that m00nbl00d mentioned in the original post above, some follow-up information in this thread seems lacking (and I also use Spybot S&D) so I am contributing some more info.

    According to the hpHosts Download page, using a large HOSTS file can be particularly problematic, especially when the Windows DNS Client Service is enabled. That apparently is their rationale for providing an "optimized" HOSTS file. (Read the hpHosts Download page for more details.)

    Quote Originally Posted by PepiMK View Post
    Do you have any example hosts file maybe? ...
    Here are direct links to the "optimized" Hosts file maintained by hpHosts' Steven Burn.



    I am considering switching to the "optimized" hpHosts' file instead of their standard format file. However, I want to avoid any problems/conflicts with my computer's configuration if possible.

    I do not wish to "hijack" this thread so I ask only two questions that I think are in line with the original poster's concerns.


    1. Does Spybot S&D play well with a large "optimized" HOSTS file (9 hosts per line, as described in the original post)?
    2. If so, then does (or will) Spybot's "Immunize" feature append entries to the HOSTS file in the same "optimized" format?

    Last edited by Kinobe; 2009-06-26 at 22:50. Reason: Clarified.

  7. #7
    Member
    Join Date
    Jan 2009
    Posts
    78

    Default

    Quote Originally Posted by Kinobe View Post
    I'm sorry about digging up an old thread. I discovered this thread via Google while researching about the "optimized" hpHosts HOSTS file maintained by Steven Burn.

    In regards to an "optimized" HOSTS file that m00nbl00d mentioned in the original post above, some follow-up information in this thread seems lacking (and I also use Spybot S&D) so I am contributing some more info.

    According to the hpHosts Download page, using a large HOSTS file can be particularly problematic, especially when the Windows DNS Client Service is enabled. That apparently is their rationale for providing an "optimized" HOSTS file. (Read the hpHosts Download page for more details.)


    Here are direct links to the "optimized" Hosts file maintained by hpHosts' Steven Burn.



    I am considering switching to the "optimized" hpHosts' file instead of their standard format file. However, I want to avoid any problems/conflicts with my computer's configuration if possible.

    I do not wish to "hijack" this thread so I ask only two questions that I think are in line with the original poster's concerns.


    1. Does Spybot S&D play well with a large "optimized" HOSTS file (9 hosts per line, as described in the original post)?
    2. If so, then does (or will) Spybot's "Immunize" feature append entries to the HOSTS file in the same "optimized" format?

    Thank you for adding that additional information.

    Regarding your two questions.

    1 - Yes, it seems to be playing well with a large optimized HOSTS file.
    2 - As of now, Spybot will add entries like the old fashioned way, because Spybot is not programmed to add them like I mentioned.

    So, it would be great for Spybot 2.0 to offer that feature.

  8. #8
    Junior Member
    Join Date
    Jun 2007
    Posts
    8

    Default

    Thanks for replying, m00nbl00d.

    After reading your reply, I started using the hpHosts "optimized" HOSTS file with my laptop and I even immunized a couple times with Spybot since then.

    So far, seems to be working.

    I recently tested that configuration in my laptop at a particular local public network where I previously had trouble with the 2GB+ "normal" format hpHosts HOSTS file and I am happy to say I was able to use the Internet. It wasn't quite as responsive as I would like but it worked (tolerable for now).

    I think the particular problem with that network is the DHCP lease time is only 3 MINUTES. I know that's a very short time. So far, I don't think the public network administrator will really "listen" to me. That's the body language I got anyway when I mentioned it on more than one occasion.

    With a huge HOSTS file, I think my computer's DNS resolver cache could never finish its operation before the DHCP would reset. I was only very sporadically able to connect to a web site until I replaced the huge HOSTS file with the default from MS. Then Internet things were "snappy" fast.

    =======

    Anyway, I also vote for the Spybot developers adding the "9 hosts per line" immunization option to a future release of Spybot Search & Destroy. In the meantime, I'll live with the "half optimized/half normal" HOSTS file for awhile.

    =======

    Thanks again for your response.

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •