Go Back   Tech Support Forum > Security Center > General Computer Security

facebook entries removed from hosts

This is a discussion on facebook entries removed from hosts within the General Computer Security forums, part of the Tech Support Forum category. As a simple way to prevent house guests from using facebook on my computers, I've added a bunch of urls


Closed Thread
 
Thread Tools Search this Thread
Old 12-24-2011, 04:25 PM   #1
Registered Member
 
Join Date: Apr 2008
Location: Canada
Posts: 7
OS: WinXP SP2 / Vista Prem SP1



As a simple way to prevent house guests from using facebook on my computers, I've added a bunch of urls to my hosts files. However, two entries are consistently removed from the hosts file without my knowledge or intervention.
127.0.0.1 facebook.com
127.0.0.1 ww w.facebook.com

How is it possible that these two entries are removed from my hosts file? I have a pretty new Windows install along with eset nod32 and a firewall.

thanks
Attached Thumbnails
Click image for larger version

Name:	facebook-hosts.png
Views:	40
Size:	12.8 KB
ID:	102454  

__________________
shmish is offline  
Old 03-23-2012, 10:11 PM   #2
Registered Member
 
Join Date: Mar 2012
Posts: 5
OS: Windows 7


Red Faced

I have the exact same problem. I am the IT guy at our school. The kids are getting to Facebook using https in the URL. I can't block that easily so I am now blocking them by adding 127.0.0.1 www. facebook. com and 127.0.0.1 facebook.com to the hosts file. This works for only a very short time because I later find the facebook entries in the hosts file have been removed!

I countered by making me, the admin, the owner, going into the hosts file permissions and making the hosts file a read only file. Guess what? The first time I test it, Facebook is blocked. A day later, the facebook entries are always gone.

I even went into the correct DOS 'etc' sub-directory and did an ATTRIB hosts +R to make it read only for everyone including me. ATTRIB *.* showed an R placed on the file 'hosts'. Guess what? It blocks me when I test it, but a day later, Facebook. com and www. facebook. com are removed!

I'm stymied. Any help would be appreciated. I gotta block these kids! ! ! !

__________________
bstrom1953 is offline  
Old 03-24-2012, 11:14 PM   #3
Registered Member
 
Join Date: Aug 2011
Posts: 255
OS: Windows


Welcome!!


Sounds like they are removing the entries THEMSELVES!!!

Possible to block FB at the ROUTER WHERE THEY CANT GET TO??? (Just set a perm rule to block access to that IP (69.63.187.19))


Facebook is NO GOOD,a spying operation............


GOOD LUCK!!
__________________
Dude111 is offline  
Old 03-26-2012, 09:26 AM   #4
TSF Enthusiast
 
Join Date: Dec 2010
Location: State College PA area
Posts: 1,628
OS: Windows 7 Home Premium, Ubuntu v. 11.04

My System


I would agree that the only good reason the entries are being removed is somebody knows about HOSTS and is editing it themselves.

I would also agree that blocking the site more directly is a better solution. Block it from a firewall.
__________________
CompTIA A+, Network+ certified
epshatto is offline  
Old 03-27-2012, 10:42 PM   #5
Registered Member
 
Join Date: Apr 2008
Location: Canada
Posts: 7
OS: WinXP SP2 / Vista Prem SP1



Quote:
Originally Posted by epshatto View Post
I would agree that the only good reason the entries are being removed is somebody knows about HOSTS and is editing it themselves.
Not with me. I have my own PC that only I use for days/weeks at a time. Two specific entries in the HOSTS file are routinely and systematically removed. I did extensive testing with malware removal programs and there doesn't appear to be any malicious software present.

It's not really important to me that www.facebook is removed from HOSTS, but I would sure like an explanation as to why this happens.
__________________
shmish is offline  
Old 03-28-2012, 02:56 AM   #6
Registered Member
 
Join Date: Aug 2011
Posts: 255
OS: Windows


Maybe the browser is auto resetting the file???

Try making it READ ONLY and see if it happens then,IF IT DOES,you know whats going on!

Right click and choose PROPERTIES and check "READ ONLY" that will stop any AUTO RESETTING of this file...... (It wont stop manual editing though)


Good luck!
__________________
Dude111 is offline  
Old 03-29-2012, 10:59 AM   #7
TSF Enthusiast
 
Join Date: Dec 2010
Location: State College PA area
Posts: 1,628
OS: Windows 7 Home Premium, Ubuntu v. 11.04

My System


I'm pretty sure the only explanation is that somebody is taking it out, unless you think there's a zero-day exploit out there which is searching for facebook entries in a local HOSTS file and removing them, which would do nothing other than...let you look at facebook. Kind of a weird malware behavior don't you think?

I guess you can either believe the simplest and most logical explanation or not...your choice.
__________________
CompTIA A+, Network+ certified
epshatto is offline  
Old 03-30-2012, 07:59 AM   #8
Registered Member
 
Join Date: Apr 2008
Location: Canada
Posts: 7
OS: WinXP SP2 / Vista Prem SP1



It is all very strange. I'm talking about my home computer - my 7 year old daughter has no idea what a HOSTS file is, nor does my wife. So these entries are definitely not being removed manually. I've experienced the entries being removed automagically while working at my PC. I would remove them, do stuff on the PC for a while, and check later and two entries would be gone.

I've also gone through extensive malware testing, as shown here.

As well, I first noticed this after a fairly new windows 7 install. I'm not dealing with a couple of years worth of backlogged files and programs.

I think later today I'll check out my laptop.
My suspicion is that this problem would be a lot more common except that almost no one would bother or want to put www.facebook in their HOSTS file.
__________________
shmish is offline  
Old 03-30-2012, 10:59 AM   #9
Moderator Offline
 
Basementgeek's Avatar
 
Join Date: Feb 2005
Location: Ohio, USA
Posts: 11,889
OS: XP Pro SP3/Vista Ultimate SP2/Win7 64 bit



Hi:

You are receiving good help at Bleeping, so stay with them for at least the time being. No sense having 2 different forums trying to work on the same problem at the same time.

You may have a program on you PC thats is preventing your changes from holding.

I myself would try booting in the safe mode, make your changes, then boot in the normal mode and see if they hold.

This post for the time being at least.

BG

__________________

ASAP member since 2006

Four boxes keep us free: the soap box, the ballot box, the jury box, and the cartridge box.

Basementgeek is offline  
Closed Thread

Thread Tools Search this Thread
Search this Thread:

Advanced Search

Similar Threads
Thread Thread Starter Forum Replies Last Post
Laptop barely works, can't access task manager
No access to a Windows install disc or a boot CD Computer takes way too long to start. Takes way too long to restart and shut down. The internet shuts off after a couple of hours and I have to restart the computer. Pop-up keeps appearing even when a web page isn't open....
BalloonBottle Resolved HJT Threads 21 07-25-2011 03:36 PM
Window Recovery Virus
I have control of my computer now but I have lost access to a lot of files. I can't find any system tools, such as system restore in my start menu. They all seem to be hidden. This shows up in my MSCONFIG start Menu "oVlLshwOTG" and I'm sure it is a process stopped by RKill. I have run spybot...
amsron Virus/Trojan/Spyware Help 46 06-04-2011 10:24 PM
Videos and Adobe FlashPlayer
Hello, Recently, suddenly when I would go to my YouTube Channel, the videos I was trying to watch would pause very frequently, to the point where I could barely watch them. Then I tried uninstalling and re-installing the Adobe Flash Player, and also Adobe Air. I wasnt sure if Adobe Air had...
claudiathompson Windows XP Support 42 04-16-2011 02:38 AM
Possible Virus/Trojan?
I'm having issues with ZoneAlarm not being able to activate anti-virus/anti-spyware. I've updated the a.v. database as well as the app itself to the latest versions but still cannot get av/as to activate. It remains disabled and the option to turn it on is grayed out. I'm also unable to get...
Dan V. Resolved HJT Threads 35 03-28-2011 09:29 AM
Possible worm/rootkit?
Hi /all- Recently I Have been having alot of slowdowns, lots of hanging programs/crashes, and most annoyingly people on my contact lists are recieving emails from me with ad's and links, that I did not send. ("uncoincedently" started about the time I let my siblings use my rig/user :upset: next...
BHM Resolved HJT Threads 7 02-15-2011 07:01 AM

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is on
Smilies are on
[IMG] code is on
HTML code is Off
Trackbacks are Off
Pingbacks are Off
Refbacks are Off


Post a Question


» Site Navigation
 > FAQ
  > 10.0.0.2


All times are GMT -7. The time now is 04:51 PM.


Copyright 2001 - 2014, Tech Support Forum

Windows 7 - Windows XP - Windows Vista - Trojan Removal - Spyware Removal - Virus Removal - Networking - Security - Top Web Hosts