Anyone seen this before - hosts file hack?

Toggle sidebar Toggle sidebar
Y

yruffostsif

Senior member
Sep 8, 2003
233
0
0
Couldn't resolve www.google.com all of a sudden, found this garbage in my hosts file. Now I just have to figure out how it got there.

127.127.127.127 elite
64.191.59.85 www.google.com
64.191.59.85 google.com
64.191.59.85 www.altavista.com
64.191.59.85 altavista.com
64.191.59.85 search.yahoo.com
64.191.59.85 uk.search.yahoo.com
64.191.59.85 ca.search.yahoo.com
64.191.59.85 jp.search.yahoo.com
64.191.59.85 au.search.yahoo.com
64.191.59.85 de.search.yahoo.com
64.191.59.85 search.yahoo.co.jp
64.191.59.85 www.lycos.de
64.191.59.85 www.lycos.ca
64.191.59.85 www.lycos.jp
64.191.59.85 www.lycos.co.jp
64.191.59.85 alltheweb.com
64.191.59.85 web.ask.com
64.191.59.85 ask.com
64.191.59.85 www.ask.com
64.191.59.85 www.teoma.com
64.191.59.85 search.aol.com
64.191.59.85 www.looksmart.com
64.191.59.85 search.msn.com
64.191.59.85 ca.search.msn.com
64.191.59.85 fr.ca.search.msn.com
64.191.59.85 search.fr.msn.be
64.191.59.85 search.fr.msn.ch
64.191.59.85 search.latam.yupimsn.com
64.191.59.85 search.msn.at
64.191.59.85 search.msn.be
64.191.59.85 search.msn.ch
64.191.59.85 search.msn.co.in
64.191.59.85 search.msn.co.jp
64.191.59.85 search.msn.co.kr
64.191.59.85 search.msn.com.br
64.191.59.85 search.msn.com.hk
64.191.59.85 search.msn.com.my
64.191.59.85 search.msn.com.sg
64.191.59.85 search.msn.com.tw
64.191.59.85 search.msn.co.za
64.191.59.85 search.msn.de
64.191.59.85 search.msn.dk
64.191.59.85 search.msn.es
64.191.59.85 search.msn.fi
64.191.59.85 search.msn.fr
64.191.59.85 search.msn.it
64.191.59.85 search.msn.nl
64.191.59.85 search.msn.no
64.191.59.85 search.msn.se
64.191.59.85 search.ninemsn.com.au
64.191.59.85 search.t1msn.com.mx
64.191.59.85 search.xtramsn.co.nz
64.191.59.85 search.yupimsn.com
64.191.59.85 uk.search.msn.com
64.191.59.85 search.lycos.com
64.191.59.85 www.lycos.com
64.191.59.85 www.google.ca
64.191.59.85 google.ca
64.191.59.85 www.google.uk
64.191.59.85 www.google.co.uk
64.191.59.85 www.google.com.au
64.191.59.85 www.google.co.jp
64.191.59.85 www.google.jp
64.191.59.85 www.google.at
64.191.59.85 www.google.be
64.191.59.85 www.google.ch
64.191.59.85 www.google.de
64.191.59.85 www.google.dk
64.191.59.85 www.google.fi
64.191.59.85 www.google.fr
64.191.59.85 www.google.com.gr
64.191.59.85 www.google.com.hk
64.191.59.85 www.google.ie
64.191.59.85 www.google.co.il
64.191.59.85 www.google.it
64.191.59.85 www.google.co.kr
64.191.59.85 www.google.com.mx
64.191.59.85 www.google.nl
64.191.59.85 www.google.co.nz
64.191.59.85 www.google.pl
64.191.59.85 www.google.pt
64.191.59.85 www.google.com.ru
64.191.59.85 www.google.com.sg
64.191.59.85 www.google.co.th
64.191.59.85 www.google.com.tr
64.191.59.85 www.google.com.tw
64.191.59.85 google.at
64.191.59.85 google.be
64.191.59.85 google.de
64.191.59.85 google.dk
64.191.59.85 google.fi
64.191.59.85 google.fr
64.191.59.85 google.com.hk
64.191.59.85 google.ie
64.191.59.85 google.co.il
64.191.59.85 google.it
64.191.59.85 google.co.kr
64.191.59.85 google.com.mx
64.191.59.85 google.nl
64.191.59.85 google.co.nz
64.191.59.85 google.pl
64.191.59.85 google.com.ru
64.191.59.85 google.com.sg
64.191.59.85 www.hotbot.com
64.191.59.85 hotbot.com
 
T

THUGSROOK

Elite Member
Feb 3, 2001
11,847
0
0
replace them with this ;)

127.0.0.1 localhost
127.0.0.1 207-87-18-203.wsmg.digex.net
127.0.0.1 Garden.ngadcenter.net
127.0.0.1 Ogilvy.ngadcenter.net
127.0.0.1 ResponseMedia-ad.flycast.com
127.0.0.1 Suissa-ad.flycast.com
127.0.0.1 UGO.eu-adcenter.net
127.0.0.1 VNU.eu-adcenter.net
127.0.0.1 a32.g.a.yimg.com
127.0.0.1 ad-adex3.flycast.com
127.0.0.1 ad.adsmart.net
127.0.0.1 ad.ca.doubleclick.net
127.0.0.1 ad.de.doubleclick.net
127.0.0.1 ad.doubleclick.net
127.0.0.1 ad.fr.doubleclick.net
127.0.0.1 ad.jp.doubleclick.net
127.0.0.1 ad.linkexchange.com
127.0.0.1 ad.linksynergy.com
127.0.0.1 ad.nl.doubleclick.net
127.0.0.1 ad.no.doubleclick.net
127.0.0.1 ad.preferences.com
127.0.0.1 ad.sma.punto.net
127.0.0.1 ad.uk.doubleclick.net
127.0.0.1 ad.webprovider.com
127.0.0.1 ad08.focalink.com
127.0.0.1 adcontroller.unicast.com
127.0.0.1 adcreatives.imaginemedia.com
127.0.0.1 adex3.flycast.com
127.0.0.1 adforce.ads.imgis.com
127.0.0.1 adforce.imgis.com
127.0.0.1 adfu.blockstackers.com
127.0.0.1 adimage.blm.net
127.0.0.1 adimages.earthweb.com
127.0.0.1 adimg.egroups.com
127.0.0.1 admedia.xoom.com
127.0.0.1 adpick.switchboard.com
127.0.0.1 adremote.pathfinder.com
127.0.0.1 ads.admaximize.com
127.0.0.1 ads.bfast.com
127.0.0.1 ads.clickhouse.com
127.0.0.1 ads.enliven.com
127.0.0.1 ads.fairfax.com.au
127.0.0.1 ads.fool.com
127.0.0.1 ads.freshmeat.net
127.0.0.1 ads.hollywood.com
127.0.0.1 ads.i33.com
127.0.0.1 ads.infi.net
127.0.0.1 ads.jwtt3.com
127.0.0.1 ads.link4ads.com
127.0.0.1 ads.lycos.com
127.0.0.1 ads.madison.com
127.0.0.1 ads.mediaodyssey.com
127.0.0.1 ads.msn.com
127.0.0.1 ads.ninemsn.com.au
127.0.0.1 ads.seattletimes.com
127.0.0.1 ads.smartclicks.com
127.0.0.1 ads.smartclicks.net
127.0.0.1 ads.sptimes.com
127.0.0.1 ads.tripod.com
127.0.0.1 ads.web.aol.com
127.0.0.1 ads.x10.com
127.0.0.1 ads.xtra.co.nz
127.0.0.1 ads.zdnet.com
127.0.0.1 ads01.focalink.com
127.0.0.1 ads02.focalink.com
127.0.0.1 ads03.focalink.com
127.0.0.1 ads04.focalink.com
127.0.0.1 ads05.focalink.com
127.0.0.1 ads06.focalink.com
127.0.0.1 ads08.focalink.com
127.0.0.1 ads09.focalink.com
127.0.0.1 ads1.activeagent.at
127.0.0.1 ads10.focalink.com
127.0.0.1 ads11.focalink.com
127.0.0.1 ads12.focalink.com
127.0.0.1 ads14.focalink.com
127.0.0.1 ads16.focalink.com
127.0.0.1 ads17.focalink.com
127.0.0.1 ads18.focalink.com
127.0.0.1 ads19.focalink.com
127.0.0.1 ads2.zdnet.com
127.0.0.1 ads20.focalink.com
127.0.0.1 ads21.focalink.com
127.0.0.1 ads22.focalink.com
127.0.0.1 ads23.focalink.com
127.0.0.1 ads24.focalink.com
127.0.0.1 ads25.focalink.com
127.0.0.1 ads3.zdnet.com
127.0.0.1 ads3.zdnet.com
127.0.0.1 ads5.gamecity.net
127.0.0.1 adserv.iafrica.com
127.0.0.1 adserv.quality-channel.de
127.0.0.1 adserver.dbusiness.com
127.0.0.1 adserver.garden.com
127.0.0.1 adserver.janes.com
127.0.0.1 adserver.merc.com
127.0.0.1 adserver.monster.com
127.0.0.1 adserver.track-star.com
127.0.0.1 adserver1.ogilvy-interactive.de
127.0.0.1 adtegrity.spinbox.net
127.0.0.1 antfarm-ad.flycast.com
127.0.0.1 au.ads.link4ads.com
127.0.0.1 banner.media-system.de
127.0.0.1 banner.orb.net
127.0.0.1 banner.relcom.ru
127.0.0.1 banners.easydns.com
127.0.0.1 banners.looksmart.com
127.0.0.1 banners.wunderground.com
127.0.0.1 barnesandnoble.bfast.com
127.0.0.1 beseenad.looksmart.com
127.0.0.1 bizad.nikkeibp.co.jp
127.0.0.1 bn.bfast.com
127.0.0.1 c3.xxxcounter.com
127.0.0.1 califia.imaginemedia.com
127.0.0.1 cds.mediaplex.com
127.0.0.1 click.avenuea.com
127.0.0.1 click.go2net.com
127.0.0.1 click.linksynergy.com
127.0.0.1 cookies.cmpnet.com
127.0.0.1 cornflakes.pathfinder.com
127.0.0.1 counter.hitbox.com
127.0.0.1 crux.songline.com
127.0.0.1 erie.smartage.com
127.0.0.1 etad.telegraph.co.uk
127.0.0.1 fp.valueclick.com
127.0.0.1 gadgeteer.pdamart.com
127.0.0.1 gm.preferences.com
127.0.0.1 gp.dejanews.com
127.0.0.1 hg1.hitbox.com
127.0.0.1 image.click2net.com
127.0.0.1 image.eimg.com
127.0.0.1 images2.nytimes.com
127.0.0.1 jobkeys.ngadcenter.net
127.0.0.1 kansas.valueclick.com
127.0.0.1 leader.linkexchange.com
127.0.0.1 liquidad.narrowcastmedia.com
127.0.0.1 ln.doubleclick.net
127.0.0.1 m.doubleclick.net
127.0.0.1 macaddictads.snv.futurenet.com
127.0.0.1 maximumpcads.imaginemedia.com
127.0.0.1 media.preferences.com
127.0.0.1 mercury.rmuk.co.uk
127.0.0.1 mojofarm.sjc.mediaplex.com
127.0.0.1 nbc.adbureau.net
127.0.0.1 newads.cmpnet.com
127.0.0.1 ng3.ads.warnerbros.com
127.0.0.1 ngads.smartage.com
127.0.0.1 nsads.hotwired.com
127.0.0.1 ntbanner.digitalriver.com
127.0.0.1 ph-ad05.focalink.com
127.0.0.1 ph-ad07.focalink.com
127.0.0.1 ph-ad16.focalink.com
127.0.0.1 ph-ad17.focalink.com
127.0.0.1 ph-ad18.focalink.com
127.0.0.1 realads.realmedia.com
127.0.0.1 redherring.ngadcenter.net
127.0.0.1 redirect.click2net.com
127.0.0.1 regio.adlink.de
127.0.0.1 retaildirect.realmedia.com
127.0.0.1 s2.focalink.com
127.0.0.1 sh4sure-images.adbureau.net
127.0.0.1 spin.spinbox.net
127.0.0.1 static.admaximize.com
127.0.0.1 stats.superstats.com
127.0.0.1 sview.avenuea.com
127.0.0.1 thinknyc.eu-adcenter.net
127.0.0.1 tracker.clicktrade.com
127.0.0.1 tsms-ad.tsms.com
127.0.0.1 v0.extreme-dm.com
127.0.0.1 v1.extreme-dm.com
127.0.0.1 van.ads.link4ads.com
127.0.0.1 view.accendo.com
127.0.0.1 view.avenuea.com
127.0.0.1 w113.hitbox.com
127.0.0.1 w25.hitbox.com
127.0.0.1 web2.deja.com
127.0.0.1 webads.bizservers.com
127.0.0.1 www.PostMasterBannerNet.com
127.0.0.1 www.ad-up.com
127.0.0.1 www.admex.com
127.0.0.1 www.alladvantage.com
127.0.0.1 www.burstnet.com
127.0.0.1 www.commission-junction.com
127.0.0.1 www.eads.com
127.0.0.1 www.freestats.com
127.0.0.1 www.imaginemedia.com
127.0.0.1 www.netdirect.nl
127.0.0.1 www.oneandonlynetwork.com
127.0.0.1 www.targetshop.com
127.0.0.1 www.teknosurf2.com
127.0.0.1 www.teknosurf3.com
127.0.0.1 www.valueclick.com
127.0.0.1 www.websitefinancing.com
127.0.0.1 www2.burstnet.com
127.0.0.1 www4.trix.net
127.0.0.1 www80.valueclick.com
127.0.0.1 z.extreme-dm.com
127.0.0.1 z0.extreme-dm.com
127.0.0.1 z1.extreme-dm.com
 
M

mikecel79

Platinum Member
Jan 15, 2002
2,858
1
81
Did you recently have surferbar on your machine? This piece of crap software is none to do that,
 
Muse

Muse

Lifer
Jul 11, 2001
40,238
9,859
136
What happens when you do this? Please excuse my ignorance. What exactly is the function of the hosts file. On my Win2000 box it's here:

D:\WINNT\system32\drivers\etc

The only uncommented line in mine (new install) is the first one for localhost. Will entering all these lines block or unmask adware sites? TIA...

Edit: Just did a google search on "hosts file" and came up with a lot of stuff. Here's a site that explains what it is.

Edit 2: OK, I guess this means that no matter what funny stuff goes on at certain sites, they can't _redirect_ you to adware sites because those are blocked by these entries in your hosts file. Is that the gist of it? I'm pasting this stuff in mine. Thanks.

Edit 3: If this is true though, why don't the redirectors send you to a specified IP address instead of a site name like ad.doubleclick.net ?? I mean that would seem to circumvent the hosts file, or is that consulted anyway to see if there's an entry for it somehow? That would seem to require looking at the DNS anyway, right?


Originally posted by: THUGSROOK
replace them with this ;)

127.0.0.1 localhost
127.0.0.1 207-87-18-203.wsmg.digex.net
127.0.0.1 Garden.ngadcenter.net
127.0.0.1 Ogilvy.ngadcenter.net

- snip -
Click to expand...

 
Muse

Muse

Lifer
Jul 11, 2001
40,238
9,859
136
Where do you get a nice set of translations that you DO want? Such as www.google.com for instance that you can add to the list one ones you don't want?
 
W

Walleye

Banned
Dec 1, 2002
7,939
0
0
i have a much much longer hosts file, that blocks about 50,000 add ...things.

it's too long to post here.

if you want it, pm me, and include email. :)
 
I

InlineFive

Diamond Member
Sep 20, 2003
9,599
2
0
Originally posted by: yruffostsif
Couldn't resolve www.google.com all of a sudden, found this garbage in my hosts file. Now I just have to figure out how it got there.

127.127.127.127 elite
64.191.59.85 www.google.com
64.191.59.85 google.com
64.191.59.85 www.altavista.com
64.191.59.85 altavista.com
64.191.59.85 search.yahoo.com
64.191.59.85 uk.search.yahoo.com
64.191.59.85 ca.search.yahoo.com
64.191.59.85 jp.search.yahoo.com
64.191.59.85 au.search.yahoo.com
64.191.59.85 de.search.yahoo.com
64.191.59.85 search.yahoo.co.jp
64.191.59.85 www.lycos.de
64.191.59.85 www.lycos.ca
64.191.59.85 www.lycos.jp
64.191.59.85 www.lycos.co.jp
64.191.59.85 alltheweb.com
64.191.59.85 web.ask.com
64.191.59.85 ask.com
64.191.59.85 www.ask.com
64.191.59.85 www.teoma.com
64.191.59.85 search.aol.com
64.191.59.85 www.looksmart.com
64.191.59.85 search.msn.com
64.191.59.85 ca.search.msn.com
64.191.59.85 fr.ca.search.msn.com
64.191.59.85 search.fr.msn.be
64.191.59.85 search.fr.msn.ch
64.191.59.85 search.latam.yupimsn.com
64.191.59.85 search.msn.at
64.191.59.85 search.msn.be
64.191.59.85 search.msn.ch
64.191.59.85 search.msn.co.in
64.191.59.85 search.msn.co.jp
64.191.59.85 search.msn.co.kr
64.191.59.85 search.msn.com.br
64.191.59.85 search.msn.com.hk
64.191.59.85 search.msn.com.my
64.191.59.85 search.msn.com.sg
64.191.59.85 search.msn.com.tw
64.191.59.85 search.msn.co.za
64.191.59.85 search.msn.de
64.191.59.85 search.msn.dk
64.191.59.85 search.msn.es
64.191.59.85 search.msn.fi
64.191.59.85 search.msn.fr
64.191.59.85 search.msn.it
64.191.59.85 search.msn.nl
64.191.59.85 search.msn.no
64.191.59.85 search.msn.se
64.191.59.85 search.ninemsn.com.au
64.191.59.85 search.t1msn.com.mx
64.191.59.85 search.xtramsn.co.nz
64.191.59.85 search.yupimsn.com
64.191.59.85 uk.search.msn.com
64.191.59.85 search.lycos.com
64.191.59.85 www.lycos.com
64.191.59.85 www.google.ca
64.191.59.85 google.ca
64.191.59.85 www.google.uk
64.191.59.85 www.google.co.uk
64.191.59.85 www.google.com.au
64.191.59.85 www.google.co.jp
64.191.59.85 www.google.jp
64.191.59.85 www.google.at
64.191.59.85 www.google.be
64.191.59.85 www.google.ch
64.191.59.85 www.google.de
64.191.59.85 www.google.dk
64.191.59.85 www.google.fi
64.191.59.85 www.google.fr
64.191.59.85 www.google.com.gr
64.191.59.85 www.google.com.hk
64.191.59.85 www.google.ie
64.191.59.85 www.google.co.il
64.191.59.85 www.google.it
64.191.59.85 www.google.co.kr
64.191.59.85 www.google.com.mx
64.191.59.85 www.google.nl
64.191.59.85 www.google.co.nz
64.191.59.85 www.google.pl
64.191.59.85 www.google.pt
64.191.59.85 www.google.com.ru
64.191.59.85 www.google.com.sg
64.191.59.85 www.google.co.th
64.191.59.85 www.google.com.tr
64.191.59.85 www.google.com.tw
64.191.59.85 google.at
64.191.59.85 google.be
64.191.59.85 google.de
64.191.59.85 google.dk
64.191.59.85 google.fi
64.191.59.85 google.fr
64.191.59.85 google.com.hk
64.191.59.85 google.ie
64.191.59.85 google.co.il
64.191.59.85 google.it
64.191.59.85 google.co.kr
64.191.59.85 google.com.mx
64.191.59.85 google.nl
64.191.59.85 google.co.nz
64.191.59.85 google.pl
64.191.59.85 google.com.ru
64.191.59.85 google.com.sg
64.191.59.85 www.hotbot.com
64.191.59.85 hotbot.com
Click to expand...

Wow, does this mean Google cheats and uses hoards of search-engines? I wouldn't have thought of it...

-Por
 
C

CTho9305

Elite Member
Jul 26, 2000
9,214
1
81
It means the evil person redirected all major serach engines through his proxy, so he could spy on searches or modify results of searches.
 
C

CTho9305

Elite Member
Jul 26, 2000
9,214
1
81
By the way, the "127.0.0.1" trick puts loads of crap into your access log if you run a webserver. Try 0.0.0.0.
 
Muse

Muse

Lifer
Jul 11, 2001
40,238
9,859
136
Originally posted by: CTho9305
By the way, the "127.0.0.1" trick puts loads of crap into your access log if you run a webserver. Try 0.0.0.0.
Click to expand...

Oh, cool. Here's the list above with replacements:

0.0.0.0 localhost
0.0.0.0 207-87-18-203.wsmg.digex.net
0.0.0.0 Garden.ngadcenter.net
0.0.0.0 Ogilvy.ngadcenter.net
0.0.0.0 ResponseMedia-ad.flycast.com
0.0.0.0 Suissa-ad.flycast.com
0.0.0.0 UGO.eu-adcenter.net
0.0.0.0 VNU.eu-adcenter.net
0.0.0.0 a32.g.a.yimg.com
0.0.0.0 ad-adex3.flycast.com
0.0.0.0 ad.adsmart.net
0.0.0.0 ad.ca.doubleclick.net
0.0.0.0 ad.de.doubleclick.net
0.0.0.0 ad.doubleclick.net
0.0.0.0 ad.fr.doubleclick.net
0.0.0.0 ad.jp.doubleclick.net
0.0.0.0 ad.linkexchange.com
0.0.0.0 ad.linksynergy.com
0.0.0.0 ad.nl.doubleclick.net
0.0.0.0 ad.no.doubleclick.net
0.0.0.0 ad.preferences.com
0.0.0.0 ad.sma.punto.net
0.0.0.0 ad.uk.doubleclick.net
0.0.0.0 ad.webprovider.com
0.0.0.0 ad08.focalink.com
0.0.0.0 adcontroller.unicast.com
0.0.0.0 adcreatives.imaginemedia.com
0.0.0.0 adex3.flycast.com
0.0.0.0 adforce.ads.imgis.com
0.0.0.0 adforce.imgis.com
0.0.0.0 adfu.blockstackers.com
0.0.0.0 adimage.blm.net
0.0.0.0 adimages.earthweb.com
0.0.0.0 adimg.egroups.com
0.0.0.0 admedia.xoom.com
0.0.0.0 adpick.switchboard.com
0.0.0.0 adremote.pathfinder.com
0.0.0.0 ads.admaximize.com
0.0.0.0 ads.bfast.com
0.0.0.0 ads.clickhouse.com
0.0.0.0 ads.enliven.com
0.0.0.0 ads.fairfax.com.au
0.0.0.0 ads.fool.com
0.0.0.0 ads.freshmeat.net
0.0.0.0 ads.hollywood.com
0.0.0.0 ads.i33.com
0.0.0.0 ads.infi.net
0.0.0.0 ads.jwtt3.com
0.0.0.0 ads.link4ads.com
0.0.0.0 ads.lycos.com
0.0.0.0 ads.madison.com
0.0.0.0 ads.mediaodyssey.com
0.0.0.0 ads.msn.com
0.0.0.0 ads.ninemsn.com.au
0.0.0.0 ads.seattletimes.com
0.0.0.0 ads.smartclicks.com
0.0.0.0 ads.smartclicks.net
0.0.0.0 ads.sptimes.com
0.0.0.0 ads.tripod.com
0.0.0.0 ads.web.aol.com
0.0.0.0 ads.x10.com
0.0.0.0 ads.xtra.co.nz
0.0.0.0 ads.zdnet.com
0.0.0.0 ads01.focalink.com
0.0.0.0 ads02.focalink.com
0.0.0.0 ads03.focalink.com
0.0.0.0 ads04.focalink.com
0.0.0.0 ads05.focalink.com
0.0.0.0 ads06.focalink.com
0.0.0.0 ads08.focalink.com
0.0.0.0 ads09.focalink.com
0.0.0.0 ads1.activeagent.at
0.0.0.0 ads10.focalink.com
0.0.0.0 ads11.focalink.com
0.0.0.0 ads12.focalink.com
0.0.0.0 ads14.focalink.com
0.0.0.0 ads16.focalink.com
0.0.0.0 ads17.focalink.com
0.0.0.0 ads18.focalink.com
0.0.0.0 ads19.focalink.com
0.0.0.0 ads2.zdnet.com
0.0.0.0 ads20.focalink.com
0.0.0.0 ads21.focalink.com
0.0.0.0 ads22.focalink.com
0.0.0.0 ads23.focalink.com
0.0.0.0 ads24.focalink.com
0.0.0.0 ads25.focalink.com
0.0.0.0 ads3.zdnet.com
0.0.0.0 ads3.zdnet.com
0.0.0.0 ads5.gamecity.net
0.0.0.0 adserv.iafrica.com
0.0.0.0 adserv.quality-channel.de
0.0.0.0 adserver.dbusiness.com
0.0.0.0 adserver.garden.com
0.0.0.0 adserver.janes.com
0.0.0.0 adserver.merc.com
0.0.0.0 adserver.monster.com
0.0.0.0 adserver.track-star.com
0.0.0.0 adserver1.ogilvy-interactive.de
0.0.0.0 adtegrity.spinbox.net
0.0.0.0 antfarm-ad.flycast.com
0.0.0.0 au.ads.link4ads.com
0.0.0.0 banner.media-system.de
0.0.0.0 banner.orb.net
0.0.0.0 banner.relcom.ru
0.0.0.0 banners.easydns.com
0.0.0.0 banners.looksmart.com
0.0.0.0 banners.wunderground.com
0.0.0.0 barnesandnoble.bfast.com
0.0.0.0 beseenad.looksmart.com
0.0.0.0 bizad.nikkeibp.co.jp
0.0.0.0 bn.bfast.com
0.0.0.0 c3.xxxcounter.com
0.0.0.0 califia.imaginemedia.com
0.0.0.0 cds.mediaplex.com
0.0.0.0 click.avenuea.com
0.0.0.0 click.go2net.com
0.0.0.0 click.linksynergy.com
0.0.0.0 cookies.cmpnet.com
0.0.0.0 cornflakes.pathfinder.com
0.0.0.0 counter.hitbox.com
0.0.0.0 crux.songline.com
0.0.0.0 erie.smartage.com
0.0.0.0 etad.telegraph.co.uk
0.0.0.0 fp.valueclick.com
0.0.0.0 gadgeteer.pdamart.com
0.0.0.0 gm.preferences.com
0.0.0.0 gp.dejanews.com
0.0.0.0 hg1.hitbox.com
0.0.0.0 image.click2net.com
0.0.0.0 image.eimg.com
0.0.0.0 images2.nytimes.com
0.0.0.0 jobkeys.ngadcenter.net
0.0.0.0 kansas.valueclick.com
0.0.0.0 leader.linkexchange.com
0.0.0.0 liquidad.narrowcastmedia.com
0.0.0.0 ln.doubleclick.net
0.0.0.0 m.doubleclick.net
0.0.0.0 macaddictads.snv.futurenet.com
0.0.0.0 maximumpcads.imaginemedia.com
0.0.0.0 media.preferences.com
0.0.0.0 mercury.rmuk.co.uk
0.0.0.0 mojofarm.sjc.mediaplex.com
0.0.0.0 nbc.adbureau.net
0.0.0.0 newads.cmpnet.com
0.0.0.0 ng3.ads.warnerbros.com
0.0.0.0 ngads.smartage.com
0.0.0.0 nsads.hotwired.com
0.0.0.0 ntbanner.digitalriver.com
0.0.0.0 ph-ad05.focalink.com
0.0.0.0 ph-ad07.focalink.com
0.0.0.0 ph-ad16.focalink.com
0.0.0.0 ph-ad17.focalink.com
0.0.0.0 ph-ad18.focalink.com
0.0.0.0 realads.realmedia.com
0.0.0.0 redherring.ngadcenter.net
0.0.0.0 redirect.click2net.com
0.0.0.0 regio.adlink.de
0.0.0.0 retaildirect.realmedia.com
0.0.0.0 s2.focalink.com
0.0.0.0 sh4sure-images.adbureau.net
0.0.0.0 spin.spinbox.net
0.0.0.0 static.admaximize.com
0.0.0.0 stats.superstats.com
0.0.0.0 sview.avenuea.com
0.0.0.0 thinknyc.eu-adcenter.net
0.0.0.0 tracker.clicktrade.com
0.0.0.0 tsms-ad.tsms.com
0.0.0.0 v0.extreme-dm.com
0.0.0.0 v1.extreme-dm.com
0.0.0.0 van.ads.link4ads.com
0.0.0.0 view.accendo.com
0.0.0.0 view.avenuea.com
0.0.0.0 w113.hitbox.com
0.0.0.0 w25.hitbox.com
0.0.0.0 web2.deja.com
0.0.0.0 webads.bizservers.com
0.0.0.0 www.PostMasterBannerNet.com
0.0.0.0 www.ad-up.com
0.0.0.0 www.admex.com
0.0.0.0 www.alladvantage.com
0.0.0.0 www.burstnet.com
0.0.0.0 www.commission-junction.com
0.0.0.0 www.eads.com
0.0.0.0 www.freestats.com
0.0.0.0 www.imaginemedia.com
0.0.0.0 www.netdirect.nl
0.0.0.0 www.oneandonlynetwork.com
0.0.0.0 www.targetshop.com
0.0.0.0 www.teknosurf2.com
0.0.0.0 www.teknosurf3.com
0.0.0.0 www.valueclick.com
0.0.0.0 www.websitefinancing.com
0.0.0.0 www2.burstnet.com
0.0.0.0 www4.trix.net
0.0.0.0 www80.valueclick.com
0.0.0.0 z.extreme-dm.com
0.0.0.0 z0.extreme-dm.com
0.0.0.0 z1.extreme-dm.com
 
Muse

Muse

Lifer
Jul 11, 2001
40,238
9,859
136
Originally posted by: Walleye
i have a much much longer hosts file, that blocks about 50,000 add ...things.

it's too long to post here.

if you want it, pm me, and include email. :)
Click to expand...

I tried Walleye's hosts file and boy did I have problems! It's real big, around 1.8 MB, and immediately after pasting all that stuff in there my system slowed to a complete crawl - Windows 2000, SP4 with all the critical updates, installed less than a week ago. The system was so FU that I Ghosted back my image from two days ago. I mean things got real nasty. I tried pasting in again, not sure that it was the hosts file that was screwing things up, but things got just as screwy. Doesn't matter if you have IE open or not. I went in in Safe Mode and restored the original hosts file and rebooted and all is OK again. I'm talking about 10+ minutes boot times, impossible to shut down without closing all open apps one by one with the End Program dialog box, constant 100% CPU utilization. Maybe there's a typo in Walleye's hosts file, dunno.
 
Muse

Muse

Lifer
Jul 11, 2001
40,238
9,859
136
I think I know what happened, at least this is what I think. I used Metapad to edit the hosts file and paste in Walleye's hosts file contents, leaving the commented out stuff in the original hosts file. Metapad, I think, introduces some formatting that Windows choked on bigtime. I bet if I redid this using Notepad I wouldn't have those crazy results. I had problems in Anandtech Forums when I edited text in Metapad and pasted into a text region just like the one I'm typing in now. It came to light that the invisible format codes were to blame.
 
K

Krugger

Senior member
Mar 22, 2001
820
0
0
the story is actually explained if you visit that ip. theres a note telling you what happened and sending you to tweakxp.com, who has another note... weird stuff.
 
C

CTho9305

Elite Member
Jul 26, 2000
9,214
1
81
Originally posted by: Krugger
the story is actually explained if you visit that ip. theres a note telling you what happened and sending you to tweakxp.com, who has another note... weird stuff.
Click to expand...

That wasn't there when the poster first put up the thread. I bet the ISP or whatever found out and replaced the page.
 
rkoenn

rkoenn

Senior member
Aug 4, 2000
433
6
81
I had this problem this morning. Didn't even think of what it was until someone pointed me here. This has been a big help. I had some complexities though. First, the host file my XP system was using was in \Windows\Help directory, while I think it is normally in the \Windows\System32drivers\etc directory. This concerns me further since it means something further has been done to my system and my virus program has detected nothing and that the worm that messed with my system seems to have redirected the logical location of the host file. I have looked at services and found nothing odd but it is probably hidden there as well. Since fixing the original problem IE seems to be functioning normally again. One thing to note about how I might have gotten it. I have a home network connected to Road Runner through a router. I have already noted that the router in the basic mode is not much of a firewall by getting a virus into a shared dirctory I allowed for writing to. I have had that in the past and now only share for read purposes. However, yesterday while working on a customers system, I opened a new directory and made it write capable. I think the trojan or worm got in from there although I could find nothing odd in that directory. I have my system, at least IE, running normally, it seems. But I would sure like to make certain whatever did it is gone for good. I will keep an eye out for odd files and particularly the hosts file. Tweak XP site doesn't appear to have figured out what caused it, only an interim fix to get IE working again. I checked Symantec and can't seem to find anything mentioned. So if anyone learns any more please post.

Finally, I believe the worm/trojan also changed the address of my DNS servers in my TCP network settings. Both the ones I had entered appeared to be gond and a new one I had never heard of before was there. Very insidious worm/trojan.
 
You must log in or register to reply here.

TRENDING THREADS

COMPANY
RESOURCES
FOLLOW
Top Bottom