Mysterious hosts file activity

I have been using the MVPS.org hosts file, and I use it except when I do online shopping with a dividend credit card (that uses some of these third party companies to keep track of what sites I go to and how much I spend). Lately, however, even though I've tried to go to these sites with my hosts file disabled, I still can't get to them, and I get the same error pages in my browsers (IE and Firefox give me the same results). I deleted the hosts file, but even so, I still cannot access any of these sites (such as doulbleclick.net or what not). I thought that maybe I put it somewhere else, and so I searched for this file and I couldn't find it. Google Desktop search only gave me a link to the traditional place for it, but when I tried to access it, said that it couldn't find it, that I might have already deleted it. Any suggestions on how to find this mysterious file? I'd really like to get some bonus dollars from my credit card company.

 

For XP, the hosts file is in C:\Windows\System32\Drivers\etc. Log in as Administrator first before doing anything, as only Administrators have write access to this file.

 

Err, as I said, its been deleted, but I still can't get to any site that it has blocked. And I do log in with admin rights on this computer.

 

psaulm119--If you cannot access these sites, even after deleting the HOSTS file, it may be that the HOSTS file is not what is blocking you.
Do you have any particular reason to have narrowed the cause to the MVPS.org HOSTS file?
What do the error messages say?
If you want, tell us what one or more of the blocked sites are so we can check. (I use the MVPS.org HOSTS file.)
Perhaps your firewall. Or are you using McAfee security apps?
Is this something new? If so, perhaps a System Restore to a date before the problem started.

Have you checked for spyware, viruses, trojans, etc.?

Certainly doubleclick.net, for example, will be blocked by the HOSTS file, but as mentioned, if you have deleted the HOSTS file, then HOSTS is not what is blocking access.

 

Jim, I like your logic. I actually would hope that its not some former file haunting my computer. Seriously, the reason why I'm still suspecting that there is a host file operating on my system is that I could access sites like this before I got my hosts file--in fact, it was to block popunders from their sites that I installed htis MVPS hosts file anyways. After installing it, I would (almost) never get them. And when I have done any "dividend dollar" shopping, I would have to disable the hosts file. Honestly, I'll check my cookie blocking options next time I log in, but I sincerely doubt that this would be it.

One of the sites is ad.doubleclick.net; another is coolwebsearch.com. I can get to them on my laptop, but not my desktop (which is giving me the problem described above).

I would think it would be spyware, but usually the spyware tries to block you from going to the Spybot/Microsoft sites, not to these commercial sites.

Thanks for the reply. I will look at my cookie settings and do a spyware scan, but I'm a bit doubtful at this point. I'll report back tomorrow with the conclusions from trying those. Thanks again.

 

Hi Paul,

When you're trying to get access > IE's tools > view tab > Privacy report. Shows what's being accepted and blocked.

Look in IE > Tools > Internet options > Security tab > Restricted sites > Sites bar. That's where I block things like double click.

Regards - Charles

 

OK Charles, I'll look at that when I get home. I've been having this problem with mozilla as well, but its always worth a look.

 

psaulm119--There are other programs that block access to sites, especially sites like doubleclick and coolwebsearch. I think Spybot's Immunize is one.
However, no one should really want to go there anyway.
As mentioned earlier, if you post the URL of one of the sites where you having the problem, we can see what happens when we try to access.
Also how are you trying to get to these sites? Is it from a link? Does the link have anything to do with doubleclick and coolwebsearch. Or do you expect to go to another site? What appears in the Status Bar (bottom of the screen just above the TaskBar) when you hover over the link? Does that mention doubleclick and coolwebsearch?
It could be that the link is requiring you to go through doubleclick or coolwebsearch to get to the site you really want. You will see something like http://www.coolwebsearch.com/http://www.goodsite.com. Do not click the link. Just manually type http://www.goodsite.com into the Address bar|Enter.

I still do not think HOSTS is the problem.

 

Jim, as I said above, two sites are ad.doubleclick.net and coolwebsearch.com.

I have used Spybot before. I will go look at their FAQs to see how to disable that feature.

As far as how I get there, your example is correct. I am trying to go to www.goodsite.com, but before I do, I want my computer to talk to www.badsite.net. Normally of course I don't want this, but like I said, when shopping online my credit card gives me bonuses if I purchase through this program that sends a message about my shopping to these sites. So in this instance, I do want to go to these sites--actually, I don't ever really want to go to them, but I do want my computer to be able to talk to them. For this reason, I really don't want to just click on www.goodsite.com.

Like I said, I'm hoping that its not a HOSTS file. I'll see if there are any leftover settings from Spybot.

 

psaulm119--I may be wrong, but I really do not think you want to go to www.badsite.
I assume you are using a link and the link is requiring you to go through www.badsite in order to get to www.goodsite.
Do you use the Status Bar (check IE View|Status Bar)? That should show you what the real URL for www.goodsite is. Perhaps review what I suggested earlier about entering goodsite's URL manually into the Address bar. If that works, you should create a Favorite so you can use it in the future and not use the link.
This type of redirection occurs quite often on search engine shopping sites. You have to separate www.goodsite's URL from the redirection URL that requires you go www.badsite to get to www.goodsite.
P.S. A personal comment. If www.goodsite requires you to go through www.badsite, I wonder how "good" www.goodsite is.

 

Jim, I'm not sure you understand why I am trying to connect to www.badsite.com. As I said before, I'm doing this to earn dividends on my credit card. For this reason, typing in the url manually or using a link in my favorites aint gonna cut it. I need to let these sites know that I'm going to shop at goodsite.com, in order to earn the dividends. This is how my credit card company knows that I really have gone to these sites and spent x dollars.

Regardless of whether or not anyone thinks this is a good idea, I do have something blocking access to sites on my computer and I'm trying to find out what it is.

 

SpywareBlaster will block those sites along with several hundred others (currently 5,643 total). You'll find the list by opening the IE browser > Tools > Internet Options > Security > Restricted Sites > Sites Button.

Perhaps you have it or some similar program running to block those sites that are considered Spyware/Malware.

 

Hate to upset the apple cart here, but I've been having some major hardware problems today and I will be reinstalling Windows, if indeed my hdd isn't fried. Kind of makes this discussion moot. At any rate, I do appreciate the suggestions given here.

 

Paul, sorry to here about your hardware problem.

If you're going to re install the OS, then look at this thread http://www.windowsbbs.com/showthread.php?t=53236 and think about patitioning the HD into OS only and data if you haven't done so already.

Regards - Charles

 

You don't need to disable or remove all the blocks that Spybot and/or Spywareblaster make.
Go to IE, Tools, Internet options, seurity tab, highlight restricted zone click on sites, scroll down to coolwebsearch and/or doubleclick and you can remove them from your restricted sites list selectively. That way you are still protected from the other badsites.

Sites in restricted zone can't download cookies or activeX etc. this overrides any cookies settings.

 

Yeah I did indeed verify that the hdd is bad--refuses to boot in mine, and 3 other computers at work, all of which boot fine with other hdd. No biggie, just grabbed a 160 gb Seagate from Circuit city for $40 AFTER rebates (famous last words). Anyways, I guess I'll never know the secret to this mystery but thats ok. Hey thanks folks for your comments.

Charles, am I correct in assuming that the main advantage to partitioniing the hd is an easier reinstallation of Windows, b/c you don't have to re-install your data, just the OS and the programs? Or are there other advantages? I will be primarily working with one drive here, my 160 gb. I only keep the data I want backed up in 2 or 3 places, so its not that difficult to copy it. At any rate, I'd still make copies of all this data anyways, whether or not I partition my new hdd. Since I do have a 20 gig hdd handy, I can always use this as a backup for my data. Or are there other advantages of partitioning--like preserving my data in the event of an attack of virii?

 

Which brings up another question that might seem incredibly stupid, but for the fact that I've never done this before. If I want to use my 20 gig hdd as a backup, I can do this by simply formating it as FAT 32 or NTFS, correct? Or would I actually have to install an OS onto it as well? If I would need an OS, I could concievably use the same copy of XP Home that I'll be putting on my 160 gig, couldn't I?

 

Hi Paul,

Charles, am I correct in assuming that the main advantage to partitioniing the hd is an easier reinstallation of Windows, b/c you don't have to re-install your data, just the OS and the programs?
Yes, the advantages of partitioning are seperating the data from the OS for re installation, read Christer's thread on moving the Documents and Settings folder which contains My Documents/My Pictures/the Favorites folder to the data partition.

And drive imaging of the OS. No advantage realy in imaging data which is a whole lot more dymanic than the OS. Normal backup procedures, whether elaborate, synchronus or by set time intervals manually or otherwise, should be used on data.

Malware, by and large, attack the OS. If you do get a data file that's cleaned by AV's or other cleaning tools, that's a lot better than losing a system file from the cleaning process.

If I want to use my 20 gig hdd as a backup, I can do this by simply formating it as FAT 32 or NTFS, correct? Or would I actually have to install an OS onto it as well?
No need to install an OS. The backup drive becomes anther partition on another drive. If you look at the picture I uploaded in that thread, H & I are backup drives where the drives have one partition each.

I dual boot which is why there is an OS on D, but I could have set drive D up as two data partitions.

Regards - Charles

 

Helpful as always, Charles. OK. Your answers bring up a couple of other questions.

1. You have mentioned the practice of imaging a hdd. Are these images compacted? I will be using a 20-gig as a backup; is it possible to back up/create an image of 30 gigs of data on a 20-gig hdd? I say this, because my 30-gig right now has less than 10 gigs remaining, and I "m not sure that the OS itself would push that amount above 10, so I really do think (if I will be using this 20 gig as a backup), that the data would have to be compressed in some sort of way.

2. From the sound of the guy in the thread that you linked to, restoring from these images is quicker than simply copying files from one hdd to another. How easy is it to create these images? I've never done this before, but I'm really thinking it will make sense to do this, given that I'm gonig to be doing this more often now, since we have so much data (images mostly), that backing up everything every 6 months just isn't going to be good enough any more. Is making these images quick and easy?

 

Hmmm the FAQs to DriveImage XML say that the images that it creates can only be transferred to (created on) partitions that are as big or bigger than the originals. The assumption then is that this data is not compresed at all.