Modify Host File Which One ?

[vince32837]

I was thinking about replacing the existing host file with a super host file on my 2 XP Pro machines that some sites suggest to block popups..

When I go down the directory path to: c:\windows\system32\drivers\etc\ there are 3 files contained that have the word "host" in the title:

1) "hosts" with no extension
contents - 1 line "127.0.0.1 localhost"

2) "host.bho"
contents- 1 line "127.0.0.1 localhost"

3) "lmhosts.sam"
contents-100 lines or so starts off with-
__________________________________________________
# Copyright (c) 1993-1999 Microsoft Corp.
#
# This is a sample LMHOSTS file used by the Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to computernames
# (NetBIOS) names. Each entry should be kept on an individual line.
# The IP address should be placed in the first column followed by the
# corresponding computername. The address and the computername
# should be separated by at least one space or tab. The "#" character
# is generally used to denote the start of a comment (see the exceptions
# below).
#
# This file is compatible with Microsoft LAN Manager 2.x TCP/IP lmhosts
# files and offers the following extensions:
#
# #PRE
# #DOM:<domain>
# #INCLUDE <filename>
# #BEGIN_ALTERNATE
# #END_ALTERNATE
# \0xnn (non-printing character support)
#
# Following any entry in the file with the characters "#PRE" will cause
# the entry to be preloaded into the name cache. By default, entries are
# not preloaded, but are parsed only after dynamic name resolution fails.
__________________________________________________
The "#" symbol is on every line in the file...

So if I want to use a new super host file, do I backup "lmhosts" and just replace it? what are files 1) and 2) doing for me?

Thanks Vince

 

[braddds]

Personally I use Spybot S&D which has a "hosts" routine that backs up and replaces the original with one already modified for such purposes...it's less messy than doing it yourself.

You can find other freeware programs that'll do the same thing, just you search for them!

Cheers

 

[gpalmer711]

To answer your question you would need to replace the Hosts file without an extension. It would be best to back it up first.

One thing to note though is that by using the hosts file some nasty people can really screw up you browsing. For example if there was an entry for tek-tips.com and the Ip address next to it was 66.102.9.99 then you would be sent to the google site instead of Tek-Tips. Using your imagination i'm sure you can guess how some people use this.

Braddds advice is great in this sense as Spybot is a respected piece of software.

Greg Palmer

----------------------------------------
Any feed back is appreciated.

 

[linney]

It is the first file in your list that would be modified. The .bho one is not one that I have ever come across before, it may have been put there by one of your installed programs. I suggest you don't worry about LmHosts.sam (a genuine Windows file) and leave it alone.

The trouble with using the Hosts file to block anything is if they get any entry wrong (there are hundreds if not thousands of them) it will cause that site to be unavailable to you. In the past problems have occurred with connecting to Windows Update and some Anti Virus sites, because they were accidentally blocked. The lists are always being amended and added to.

Most decent firewalls have inbuilt pop up blockers as does Google if you use their Tools.

http://www.accs-net.com/hosts/what_is_hosts.html

 

[vince32837]

Thanks guys for the quick reply;

Both PC's are behind an SMC router w/ cable modem. I have Spybot Search and Destroy. I never knew that Spybot had that host file replace option?? I have outpost firewall pro 2.1, and adaware installed too. I guess the popups have not been that bad.

The thing really killing my browsing experience is homepage capturing by searchcentral.com or navigant.com (note- Mcaffee anti-virus running in background)

router: has mac filter on, SPI ON

I have disabled xp restore point. Run adaware, spybot, hijaack this. Deleted all their findings.. Next day or two clean pc. After that, yahoo.com has been replaced w/ searchcentral...etc. again. endless loop tired of it...

note- My son uses AOL chat, are malware guys coming through that window?

I was going to try a spyware real-time monitor programs, like spyguard etc. Any of guys have luck with these apps?

I'm looking for a good line of defense, any suggestions?

I installed firefox browser yesterday, it seems clean? Maybe I need to give up on IE6?

thanks Vince

 

[gpalmer711]

Download Hijack This from

http://tomcoyote.org/hjt/

This software will allow you to see what software starts with your PC and Internet Explorer.

It also allows you to remove these items.

If you want assistance with its results you can either post us a copy of your start-up log or take a look at this website.

http://www.spywareinfo.com/~merijn/htlogtutorial.html

Greg Palmer

----------------------------------------
Any feed back is appreciated.

 

[linney]

Are you running SpyBot in Advanced Mode as opposed to Easy Mode? (See your Settings). Under the Immunize page you should have options to prevent tampering with the IE Start Page. And under the Tools/ Browser Pages, there are further options to change start and search pages back to what they should be (you have to highlight the entry to bring up the change button and drop down menu).

 

[vince32837]

I went ahead and replaced the host file with the superhost file given at

http://www.mvps.org/winhelp2002/hosts.htm.

That cleared up a lot. Except for homepage capture by searchnav.com I ran spybot in advanced mode. It cleared all but 1 spyware, please reboot the app stated, after reboot, killed the last entry. I also installed spyware blaster. SO far so good on both PC's. I will go back into spybot options and do as linney suggests.

I had installed "regprot" a few days ago, it supposed to protect the registry from being modded without your permission. Every 15 sec, it states key wants to be added to registry allow or deny?

Is a separate registry protect program required or is this nonsense?

Thanks for all your help so far,
Vince

 

[linney]

RegProt (from DiamondCS) is an older program that will give you that problem in XP for Limited Users as they do not have the necessary permissions to write to the Registry. It will work OK for Administrators, but requires disabling for other users, you could circumvent this problem by starting RegProt from the Admin Users Startup folder(s) rather than a Registry setting which is starting it for every user.

 

[vince32837]

linney ,

Thanks for the info,

Vince