What is the hosts file?

Discussion in 'Software' started by eclayton, Jul 29, 2004.

  1. eclayton

    eclayton Sgt. Shorts-cough

    Can someone tell me what the hosts file is and does?
     
  2. Matacumbie

    Matacumbie Rocky Top

    eclayton,

    Found this, let me know if you want the link for the long version.

    The short answer is that the Hosts file is like an address book. When you type an address like www.yahoo.com into your browser, the Hosts file is consulted to see if you have the IP address, or "telephone number," for that site. If you do, then your computer will "call it" and the site will open. If not, your computer will ask your ISP's (internet service provider) computer for the phone number before it can "call" that site. Most of the time, you do not have addresses in your "address book," because you have not put any there. Therefore, most of the time your computer asks for the IP address from your ISP to find sites.

    If you put ad server names into your Hosts file with your own computer's IP address, your computer will never be able to contact the ad server. It will try to, but it will be simply calling itself and get a "busy signal" of sorts. Your computer will then give up calling the ad server and no ads will be loaded, nor will any tracking take place. Your choices for blocking sites are not just limited to blocking ad servers. You may block sites that serve advertisements, sites that serve objectionable content, or any other site that you choose to block.


    Steve
     
  3. eclayton

    eclayton Sgt. Shorts-cough

    Thanks, Matacumbie,

    So where is the Hosts file located?

    I wouldn't mind having that link either! :)
     
  4. Matacumbie

    Matacumbie Rocky Top

  5. acejones

    acejones A Different Title

    eric,

    my hosts file is in C:\WINDOWS\system32\drivers\etc (posted mine, b/c i thought they were supposed to be in C:\WINDOWS\system32\drivers)

    oh yeah...windows xp
     
  6. Ken3

    Ken3 MajorGeek

    Eric - if I remember right you're using Win2000, so from Ace's post replace "windows" with "winnt" and there it is. You can also do a Find on "hosts" to get at it quicker.
     
  7. Maxwell

    Maxwell Folgers

  8. eclayton

    eclayton Sgt. Shorts-cough

    Wow, dude, you have a good memory! But, we just recently got XP! :D

    Okay, so, if I use the list that Nick posted, and I'm using Spyware blaster, do I just copy and paste those files in the hosts file section of Spyware Blaster? There are also some that are supposed to go into the restricted pages......seems I have my work cut out for me if I do this, but from the sounds of it, it's worth it......

    Do I have this right?
     
  9. Maxwell

    Maxwell Folgers

    I have SpywareBlaster version 3.2 but doesn't have a "hosts" section but it does have a means of backing up your hosts file. I usually just download and put the hosts file in place manually plus I protect it by making it read-only.
     
  10. eclayton

    eclayton Sgt. Shorts-cough

    Okay, that makes sense, but I'm still not sure how to edit my hosts file.

    Can someone walk me through it step by step?
     
  11. eclayton

    eclayton Sgt. Shorts-cough

    Well, maybe I figured this out.
    I opened the second link on Nicks post, downloaded the zip file, then copied it and pasted it over top of my old hosts file in C:Windows/system32/drivers/etc

    I hope that was right.......
     
  12. bigbazza

    bigbazza R.I.P. 14/12/2011 - Good Onya Geek

    ec, check out my post today in http://forums.majorgeeks.com/showthread.php?t=38366 in answer to laurieB's question on hosts file. Lots of old MG links there that expand on what is posted here. Beware laurieB 's post hijacked part way through. Look for my post today. bazza.

    ===

     
  13. Maxwell

    Maxwell Folgers

    Hang on Eric, did you already have a hosts file? What was in it? Did you keep a backup in case there was something significant in it? Occasionally you may have had some valid address translations in there to do with your e-mail client - see caveats at http://www.mvps.org/winhelp2002/hosts.htm

    However, the new hosts will protect you from adverts, etc.
     
  14. eclayton

    eclayton Sgt. Shorts-cough

    I don't think I had a hosts file, because I never made one. Anyway, it's done now! :( :)

    How do I go about adding the actual addresses of the sites that I want to browse faster? How do i find the number of the site, say, for Major Geeks?

    I appreciate everyone's help, I'm learning alot here, it's fun! :)
     
  15. da chicken

    da chicken MajorGeek

    Everyone has one. It's just a text file. You can actually just open it up with Notepad or another pure text editor (but not a word procesor like WordPad or MS Word).

    The default one looks like this:
    Code:
    # Copyright (c) 1993-1999 Microsoft Corp.
    #
    # This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
    #
    # This file contains the mappings of IP addresses to host names. Each
    # entry should be kept on an individual line. The IP address should
    # be placed in the first column followed by the corresponding host name.
    # The IP address and the host name should be separated by at least one
    # space.
    #
    # Additionally, comments (such as these) may be inserted on individual
    # lines or following the machine name denoted by a '#' symbol.
    #
    # For example:
    #
    #      102.54.94.97     rhino.acme.com          # source server
    #       38.25.63.10     x.acme.com              # x client host
    
    127.0.0.1       localhost
    Open up a command prompt (Start --> Run --> "cmd"). From here, type "nslookup <domain name>". So for www.majorgeeks.com, it will look like this:
    Code:
    C:\>nslookup [url]www.majorgeeks.com[/url]
    Server:  you.dns.server.here.com
    Address:  xxx.xxx.xxx.xxx
    
    Non-authoritative answer:
    Name:    [url]www.majorgeeks.com[/url]
    Address:  67.19.72.100
    The first part will look different, since I masked what my DNS server is. Now you go to Notepad and open up C:\winnt\system32\drivers\etc\hosts. Add the following line to the end of the file:

    Code:
    67.19.72.100 [url]www.majorgeeks.com[/url]
    Save the file and you're done. You don't have to reboot or anything.
     
  16. eclayton

    eclayton Sgt. Shorts-cough

    Very Cool! Thanks so much for the detailed info, it was easy to do. I went ahead and did it with MG, then went to do it with Yahoo......Yahoo has a few addresses. Do I need to enter each line seperately?
     
  17. da chicken

    da chicken MajorGeek

    Yes. You have to have a line break between each entry (i.e., only one per line), and there must be at least one space between the IP address and the domain name. Also, you can't use wildcards in a hosts file, so *.majorgeeks.com wouldn't be valid, even if www.majorgeeks.com and forums.majorgeeks.com were on the same server. (www.mg.c and forums.mg.c aren't even on the same network, so take note of that if you add both to your hosts file; they have different IP addresses
    .)
     
  18. ANHEDONIC

    ANHEDONIC Will Title For Food

    hmmm i'm confused... i thought peopel just edited their hosts file to block certain sites... what was the benefit of Eric adding the majorgeeks IP? :confused:

    my particular hosts file doesn't have any addy's but it was set to "read only" in properties...
     
  19. lesley

    lesley Private E-2

    Have read this post with great interest and I have located the hosts file on my C drive (am using windows CP home).

    When I opened the hosts file with notepad and added a URL (had obtained the nslookup details) and then went to save it, I had to save as a new file, did not save the file I had opened up. Does this mean that "nothing" is happening? Will my saved file override the original file or is the original file without my additional entry being used??

    thanks for your help
     
  20. da chicken

    da chicken MajorGeek

    Well, whenever you try to resolve a domain name, Windows checks the local DNS cache before anything else. There are two ways to get into the DNS cache: 1) be in the hosts file (a static cache), 2) be a domain name that was previously resolved this session (a dynamic cache).

    So, whenever a web browser or other piece of software requests DNS name resolution, it can find frequently used domain names in the dynamic or static cache. By default, the static cache only has the one entery for localhost, so the dynamic cache is the only one used.

    However, there's some problems with the dynamic cache. First, the size of the cache is limited. So eventually you'll start popping out old domains for new ones. Second, domain names not from the hosts file only stay in the cache for a set amount of time (known as a time-to-live) before being removed from the cache. Additionally, if you restart the system the dynamic cache automatically gets reset.

    The hosts file (static cache) doesn't have a fixed limit (and, to the best of my knowledge, doesn't take up any of the dynamic's size limit) and the entries never expire, so Windows never has to go out and ask the DNS server where www.google.com is, for example.

    There's a few problems with the hosts file, however. First, you have to edit the file manually. It's not automatic like the dynamic cache, so it requires a lot of user action to configure. Second, because it's static it doesn't take into account DNS changes. If the IP for www.google.com happens to change, for example, you will not be able to access that website until you manyally edit the hosts file again.

    Still, the hosts file does have a wide number of uses. because it can point to the wrong IP address, a lot of ad sites and spy sites can be added to hosts file and told to point to the IP address 127.0.0.1, a special IP address called the loopback (actually, it's any address with the first octect of 127). It always means "this machine". So if you point all these bad sites at the loopback IP, they go nowhere and just time out.

    However, there are also some types of malware that purposefully alter the hosts file. What if you put in an entry that pointed www.google.com to the Bonzi Buddy homepage? Therefore, a lot of spyware protection programs make the hosts file read-only to help prevent this kind of DNS cache poisoning.

    If you want to see the contents of the DNS cache, you can open up a command prompt and type "ipconfig /displaydns". You can empty the dynamic cache by entering "ipconfig /flushdns".

    On this page, scroll down to #2 and you'll see some registry hacks to improve the performance of the Windows dynamic DNS cache (but I've never used them so I can't exactly recommend it).
     
  21. da chicken

    da chicken MajorGeek

    Correct.

    The file must be called "hosts" (no extention). That's the only file used, and if it isn't named that, it's not being used.

    In all likelyhood, your hosts file has been set to read-only by a spyware protection program. You'll have to browse to the file, right click it, choose properties and uncheck the read-only option.
     
  22. eclayton

    eclayton Sgt. Shorts-cough

    Man, chicken, thanks for the detailed post. I had read how it works in some of the above links, but that was a very good recap, and helped clarify quite a bit for me. When I get home later today, I'm going to check out some of that other stuff you posted! Thanks again, sounds like we're all learing quite a bit here!


    Have a great day, I'll be back later with more questions!! :D

    Eric
     
  23. pegg

    pegg MajorGeek

    I had posted this in another thread once when someone was questioning something they found in their host file (re: Kazaa)...
    Note that it says: inserted by Spybot...

    I didn't do any of this...Spybot did automatically...is this something eclayton is asking (maybe I missed it, I read everything quickly)
     
  24. bigbazza

    bigbazza R.I.P. 14/12/2011 - Good Onya Geek

    Hope I'm not hijacking this thread but I have some questions on HOST files.

    Did a "find" on my W98SE laptop, found the HOSTS file in C:\windows. Size is 195kb.

    Also found 4 labelled hostsYYYYMMdd-time.backup files. Applicable Dates and time appear on these 4 files. Each of these 4 backups are 797kb in size.

    Obviously I created them at various times.

    My questions are:- 1. Why the disparity in size. 2. Why should I keep them? I would rather delete them if not required. 3. Any hint on how they might have come about. Thanks. bazza
     
  25. Maxwell

    Maxwell Folgers

    Answers are:

    1. Different number of lines that show IP address and web address association and different comment lines.

    2. Only necessary to keep these if there are possible problems (e.g., corruption by malware or some legitimate software not working). It is insurance.

    3. SpywareBlaster allows you to create backups. Pegg shows that SpyBot S&D does something maybe backups as well.
     
  26. bigbazza

    bigbazza R.I.P. 14/12/2011 - Good Onya Geek

    maxwell, thanks for your reply. :)

    I still can't figure out why my backups are 4 times the size of my current HOSTS file, though. :confused: Bazza

    ===

     
  27. Maxwell

    Maxwell Folgers

    Perhaps whatever created them has encrypted the contents or padded it out with spaces. Have you looked to see what's in them? Anything obviously different?
     
  28. da chicken

    da chicken MajorGeek

    Why not just open the files up in notepad? They're all text files. Might as well see what the fuss is about, eh?

    I know that the backups created by SpywareBlaster are encrypted backups. That might account for the size discrepancy.

    Spybot doesn't alter your hosts file unless you direct it to, and you can turn it off. In Spybot, make sure that Advanced mode is on, and click Tools. Make sure hosts is checked, and click on that. At the top, you'll see two buttons: Add Spybot list and Remove Spybot list. Also note that theres a restore backup button, so those backups you had are likely from Spybot. (I don't see how to *create* a backup, however. Seems to do it whenever you click one of the buttons.)

    As for the backups you have, I'd throw them in a .zip file (if you were on WinXP, I'd say enable file compression on them). They ought to be plain text, so they should compress pretty well.
     
  29. lesley

    lesley Private E-2

    da chicken,

    thanks for the clarification.

    yes I had let a spybot set it at read only.

    Lesley
     
  30. bigbazza

    bigbazza R.I.P. 14/12/2011 - Good Onya Geek

    Thanks for the prodding, guys. Opened up the normal HOSTS file and the HOSTS***backup in Wordpad. 1 too big for Notepad. I haven't counted the entries in both but they are all in plain text. No encryption, apparently. Backup version includes some entries as per below, not the normal 127.nn. type numbers. Have you come across these before? Is there any simple way (or program) of combining my normal HOSTS file with the ones listed in my most recent backup file, sorting them by name and deleting the duplicates. Does it matter if the same name is there twice. I assume it doesn't, just slows things down a bit. Bazza

    5377608764 spywareinfo.com
    5377608764 www.spywareinfo.com
    5377608764 lavasoftsupport.com
    5377608764 www.lavasoftsupport.com
    5377608764 www.approvedlinks.com
    5377608764 searching-the-net.com
    5377608764 www.searching-the-net.com


     
  31. da chicken

    da chicken MajorGeek

    Those hosts entires seem to be related to CoolWebSearch. Might want to run CWShredder. Although you said those were in the backups, so they might be from before you removed them.

    You'll note that 5377608764 doesn't go anywhere if you type it into a browser, so you wouldn't be able to get to those sites from the domain names if you had that hosts file.
     
  32. bigbazza

    bigbazza R.I.P. 14/12/2011 - Good Onya Geek

    Thanks da chicken for your reply. I run CWS fairly regularly, latest version I have is v1.59.1. Can't remember CWS finding anything in the past but it well could have. Yes, they are in the backups and not in my current HOSTS file. Bazza

    ===

     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds