Frustrating problem with hosts file

[JustGeorge]

I downloaded/installed the mvps hosts file and can still access websites and see ads that are supposed to be blocked. I've tried disabling the DNS client, deleting temp internet files etc but it still lets them through. Its random too. I placed in on about 16 XP Pro machines and some have the problem and some don't. No viruses/malware are present on any machine. Anything I'm missing? Just an FYI I didn't use the batch file that comes with the mvps hosts file, I just renamed the original host to "hosts.bak" and copied the mvps version to the proper directory.

[+BudMan MVC]

Did you flush the dns cache after putting in the host file?

if your wanting to block hosts by pointing them to 127.0.0.1 -- why don't you just place the entries in your local DNS? When you mention 16 machines -- sounds like your in work environment.. Where do these machines point for dns? Do you have AD setup? Or do they point at your router or your ISP?

Its always easier to put blocks like this in 1 place vs local on each machine, etc.

[JustGeorge]

You're right its a work environment but only for the PCs setup for kids to use. Are servers forward DNS requests to OpenDNS in order to be CIPA compliant. The mvps hosts file blocks alot of ads/garbage so I thought I would experiment with it on those computers as an additional layer of protection since they're at high risk of infection (kids will be kids). There is alot of stuff in that hosts file that would have to be manually entered into OpenDNS's blacklist....

I was under the impression that disabling the DNS client service would also flush it? It returns an error if you attempt to flush it after disabling the service.

[sc302 Veteran]

if you are more worried about infection vs productivity look at windows steady state.

[JustGeorge]

  sc302 said:

if you are more worried about infection vs productivity look at windows steady state.

I'm actually planning on doing that, but I have to wait till the school year is over to start setting all the PCs up for it. Grrr...I wish kids would just leave **** alone! :)

[+BudMan MVC]

you don't have to put the entries all the way up at opendns, you can just put them in your local dns.

A quick way to check if items are being read from the host file is to view the chache, so leave the dns client running and then flush the cache.. you should still see the items in your host file with a very large TTL

example

C:\>ipconfig /flushdns

Windows IP Configuration

Successfully flushed the DNS Resolver Cache.

C:\>ipconfig /displaydns

Windows IP Configuration

1.0.0.127.in-addr.arpa

----------------------------------------

Record Name . . . . . : 1.0.0.127.in-addr.arpa.

Record Type . . . . . : 12

Time To Live . . . . : 599428

Data Length . . . . . : 4

Section . . . . . . . : Answer

PTR Record . . . . . : localhost

localhost

----------------------------------------

Record Name . . . . . : localhost

Record Type . . . . . : 1

Time To Live . . . . : 599428

Data Length . . . . . : 4

Section . . . . . . . : Answer

A (Host) Record . . . : 127.0.0.1

Once you have put the entries in your host file, you should see them in your local cache -- example

C:\>ipconfig /displaydns

Windows IP Configuration

1.0.0.127.in-addr.arpa

----------------------------------------

Record Name . . . . . : 1.0.0.127.in-addr.arpa.

Record Type . . . . . : 12

Time To Live . . . . : 599326

Data Length . . . . . : 4

Section . . . . . . . : Answer

PTR Record . . . . . : localhost

Record Name . . . . . : 1.0.0.127.in-addr.arpa.

Record Type . . . . . : 12

Time To Live . . . . : 599326

Data Length . . . . . : 4

Section . . . . . . . : Answer

PTR Record . . . . . : test

test

----------------------------------------

Record Name . . . . . : test

Record Type . . . . . : 1

Time To Live . . . . : 599326

Data Length . . . . . : 4

Section . . . . . . . : Answer

A (Host) Record . . . : 127.0.0.1

test.test.com

----------------------------------------

Record Name . . . . . : test.test.com

Record Type . . . . . : 5

Time To Live . . . . : 599326

Data Length . . . . . : 4

Section . . . . . . . : Answer

CNAME Record . . . . : test

localhost

----------------------------------------

Record Name . . . . . : localhost

Record Type . . . . . : 1

Time To Live . . . . : 599326

Data Length . . . . . : 4

Section . . . . . . . : Answer

A (Host) Record . . . : 127.0.0.1

if they are not getting put in there - then your having an issue reading your host file..

Edited September 18, 2009 by BudMan

[sc302 Veteran]

instead of screwing with host files you could have done this if doing it on a individual pc basis

http://www1.k9webprotection.com/

but if you do that you could also install steady state.

[Joel]

Do you not have a firewall in this place?

[JustGeorge]

  Joel said:

Do you not have a firewall in this place?

Yes, a Watchguard Firebox. They nickel and dime the hell out of you for additional features so upgrading that isn't an option.

[sc302 Veteran]

expensive.....cheaper solutions would be

barracuda web filter (gateway content filter and antimalware scanner this does not take the place of a desktop antivirus and/or antimalware but I have noticed very few issues after this filter was put in)

http://www.k12usa.com/secureapp.asp

blue coat content filter

websense content filter

webbalended content filter

There are a lot designed for schools and businesses. Some are cheaper than others, some are more expensive. In the schools I have dealt with selling a content filter was easy and necessary with the content filter you get monitoring as well, easy to bring up user logs to tell exactly what user went to what site on which computer/ip they logon to and they can't clear that history. It really is an easy sell to the board/your manager/pricipal.

I highly recommend the barracuda webfilter, very easy to setup and support is really good.

take a look at the demo here http://webfilter.barracuda.com/cgi-mod/index.cgi

logon: guest

password: webfilter

key points:

basic-main page: infection activity (shows you what pcs are infected and what they are infected with)

basic-web log tab: shows user activity

basic-report log tab: can run reports on many different options (go through it)

block/accept-content filter tab: self explanitory

block/accept-execptions: custom rules which applies to individual groups/users/ip addresses

block/accept-domains: custom domains which applies to the whole orginization

The only thing they get you on is the subscription and warranty, no other things to nickel and dime you on. 1500 for the low end box add ~400 for a 1 year sub that brings you to 1900, but you may qualify for additional discounts being that you are a school. That you would have to work out with barracuda corp (not sure if the resellers would give you a deal, as most are money hungry and will end up cutting into their profits). Barracuda offers a 30 day eval where they send you an appliance for 30 days and if you don't like it you can send it right back. Remember at that price you are getting a antimalware/antivirus/content filter dedicated device.

[Joel]

  VRam said:

Yes, a Watchguard Firebox. They nickel and dime the hell out of you for additional features so upgrading that isn't an option.

It's a feature to have website blocking?

[JustGeorge]

  Joel said:

It's a feature to have website blocking?

Yep website filtering is extra. Thanks for everyone's input :)