Thursday, August 2, 2012

Editing Your Hosts File Can Kill Web Bugs and Spyware!

Look in your windows directory on your PC for a file called "HOSTS" (not "HOSTS.bak" or "HOSTS.SAM", just plain "HOSTS" w/o any extension on it). Open this file in notepad so you can edit it. Please be aware that some versions of Windows keep the HOSTS file buried somewhere deep under the system or system32 directory so you might have to perform a "find file" search to locate it on your machine.

In this file you will see a line that contains an IP address followed by the word "localhost". It should look something like this -

Web Hosting

127.0.0.1 localhost

Now, on a new line, simply copy the same IP address followed by a tab spacing and put in the domain for "didtheyreadit.com". You should now have an entry that looks something like this -

127.0.0.1 didtheyreadit.com

Save the file and that's it. What will now happen is that instead of going out on the internet to find the domain name "didtheyreadit.com", this entry in your HOSTS file will force your machine into thinking that this domain resides on your own machine. Unable to find anything meaningful when it makes the search, it will just give up trying and you will have stopped the bug dead in its tracks. No fuss, no muss.

This trick also works for other applications that reach out across the internet and report your activities to servers. One example would be if you were to be a user of DAP (Download Accelerator Plus) which goes out across the internet to retrieve ad images to display within the program. Simply update your HOSTS file with the address that DAP is trying to connect to and assign it to your localhost IP and presto, no more ads in the application. (well, almost no more because DAP saves a copy of these ads on your hard drive and you will have to delete them as well to completely eliminate them)

Pretty much all you have to do for any such application like this is to figure out the domain that it is trying to connect to on the net and you now have the power to kill its activities as you see fit. Works for spyware, adware, you name it.

Another use for this trick is if you are a webmaster. I often wind up getting a new account that already has a website going but they want me to redo the site and host it on one of my servers and cancel the account where they are. In order to not have to shut down their existing account while I am developing their new site, I will create an account for their new site on my server and modify the HOSTS file on my computer so that their domain name points to the IP address of my server. This way I can have a private connection to their new site's location for development purposes and when I need to drop by the customer's office to show them the progress of their new site, I simply modify the HOSTS file (temporarily of course) on their machine and they can view their new site as well.

One final note and that is that often a trojan or virus will rewrite your HOSTS file so that certain domain names will appear there in an attempt to hijack your surfing activities. For example you may see an entry in it for Google.com associated with an IP address. This is likely there to hijack your attempts to connect to Google and steer you to the IP address in the HOSTS file instead.

It is a good idea to occasionally check your HOSTS file to prevent yourself from becoming a victim of phishing. For example, imagine a trojan or activeX component infected your machine and put in an entry in your HOSTS file that redirected your connection to PayPal's login page to a spoof page that looks just like PayPal's page. The address bar at the top of your browser is unchanged but you are not at the real PayPal site. Instead, when you enter your login details, thinking that you are logging into your account, you are instead submitting your data to some hackers machine in China somewhere. Scary, isn't it?

A clever person could get around this to some extent by making a batch file that rewrites your HOSTS file with a clean valid copy every time your start your machine.

Editing Your Hosts File Can Kill Web Bugs and Spyware!

No comments:

Post a Comment