![](http://content.invisioncic.com/Mmalware/set_resources_28/84c1e40ea0e759e3f1505eb1788ddf3c_pattern.png)
elementaos
Honorary Members-
Posts
34 -
Joined
-
Last visited
Content Type
Events
Profiles
Forums
Everything posted by elementaos
-
I am saying simple obvious truth.
-
I don't think so. I know that hosts is for hostname resolution, and this can be used for name resolution negotiation too. But in windows 10 localhost is defined somewhere else. Computer already knows what localhost is. In windows xp it's not. In windows xp if we remove hosts file or turn it into comment, it won't know what localhost is.
-
And in windows 10 it is not even used to define localhost like in previous systems. It says: Localhost was not commented out (#) in windows xp for example. Additional reason why this file is not needed in windows 10. And maybe best to leave that file but restrict all permissions to everyone for it, so it won't waste performance and hdd. Well, at least for us who use hosts method for blocking... Windows is useful only in presence of 3rd party software like notepad++, chrome or firefox, adblockers... Even Microsoft figured out that for example Chrome is better than Edge.
-
And one more thing: when hostsman is opened and closed, this hosts files is regenerated (2 bytes i think). So we must remove it again if we don't want to experience consequences. Even when there is not hosts file there is some activity which searches for that file repatedly for example from firefox. But if it finds that file, even if 2 bytes only, then that activity is increased many times, enough to be felt. Only on win10. Although there is also constant hdd activity with hosts file on winxp, there is no speed/performance consequences. Weird win10. But even having constant hdd activity is not good, at least for such small files like hosts. That's why i reccommend something like dns cache but fast. Like virtual disk on physical ram or acrylic or other 3rd party dns caches... Dns cache prevents constant reading of hdd, but it takes many hours for hosts to read. Probably bad programming by microsoft.
-
And i actually had to disable dns client in windows 10, although i previously said it must not be disabled because windows 10 will become slower even with small hosts file. Well, if we remove hosts file, then no problems. I had to do it because if dns client is running and i use acrylic dns proxy and change dns config via quicksetdns to avoid using acrylic, then again use dns for acrylic, then sites unblocked via avoiding use of acrylic are cached in windows dns and almost like acrylic doesn't work for these sites. Even sometimes when i use ipconfig /flushdns. When dns client is disabled, everything is normal, changes are immediate. Also luckily quicksetdns allows to export this enabling or disabling of various settings using cmd, which can be exported to individual bat files and run from desktop or taskbar or start menu. Just want to warn everybody: NEVER USE HOSTS FILE ON WINDOWS 10 WITH DNS CLIENT DISABLED OR SYSTEM WILL BE SLOW, EXCEPT IF YOU REMOVE HOSTS FILE. NEVER USE LARGE (3rd party) HOSTS FILE ON WINDOWS 10 EXCEPT IF YOU ARE USING 3RD PARTY DNS CACHE TOOL (Acrylic in my example). EVEN IF DNS CLIENT IS ENABLED (MEANING EVEN IF YOU SKIP ABOVE MISTAKE) IT WILL TAKE HOURS TO CACHE THAT HOSTS FILE (NORMAL ADVICE WHY PEOPLE RECOMMEND DISABLIND DNS CLIENT).
-
And because my primary dns is of acrylic and secondary normal one, I can just switch them in second to only my normal one when i want to avoid using it, using nirsoft quicksetdns. No need to stop whole acrylic dns or to exclude individual hosts sources or lines.
-
And luckily it supports adding many hosts files and will block those normal 127.0.0.1 so no need to convert them to 0.0.0.0. Verified these immediately blocked connections using proxifier. Actually why do i use one hosts? Hosts-file.net already offers separated hosts files by type. So better use that. So when i wanna download warez just exclude warez hosts file. Also make one my file where i put newly discovered bad hostnames.
-
Finally found a solution for windows 10. Acrylic DNS Proxy. Just set my ipv4 dns in network adapter to 127.0.0.1 and extracted hosts.txt file from zip from hosts-file.net to C:\Program Files\Acrylic DNS Proxy. Then put this into AcrylicHosts.txt: "@ hosts.txt". And purged and started acrylic dns from start menu. Your freedom app could not start for some reason, beacuse it is complicated. So added my normal isp dns as secondary dns server which your-freedom can use. And everything works smoothly. It takes few seconds to load file into ram on service start, and it doesn't waste hdd anymore. Also they support *, ?, and regex which is similar to adblockers. So tried entering one blocked site and yes it is blocked. It wont skip to secondary real dns server which i only set so yf can work. No worry. ? A bit more unneccessary info: And it shows 0 cpu usage in task manager, and only 27 MB RAM. No need for complicating through virtual disk and junction or anything. Although I had to set my real dns manually in acrylic configuration file instead of default google dns, the same one i had to manually use before in all my network adapters, meaning nothing new, because my isp is blocking google or any other but theirs dns, well, at least for this unusual type of connection (using your freedom and dns tunneling via mms apn instead of internet apn in mobile phone). Also i do not use ipv6 because this odd type of connection i use everyday doesnt support it (actually isp mms apn doesnt support it, so nothing weird there). But that would be off topic...
-
No, tried proxifier and proxycap. They can block using stars and questionmarks too, which is advantage. But they can accept only very little hostnames. Even if i edit their settings file manually, they just freeze and refuse to start. If I do that via app, app cuts out 99% of hostnames. I figured out on windows 10 we must not ever disable dns client. No wonder why it can't be disabled using anything but Autoruns by sysinternals. It's not meant to work that way, unlinke in previous oses. When it is not disabled, still useless, because reading of my file takes about 1 hour, and if i would edit even one symbol it would reread whole file. Luckily i may use proxifier for few most important hosts and some adblocker, maybe it will be faster if its settings or whole browser data folder in virtual drive, that would at least speed up adblockers. HostsSerer doesn't change anything.
-
Nothing works on windows 10. Sometimes its idm or svchost or firefox or malwarebytes or edge who use 95% cpu. All try to access hosts repeatedly. Whole os becomes unusable. Maybe something in windows 10 design. XP has no problems. Although constant reading of file occurs in both os-es, in xp it is slow enough and no high cpu usage. So weird yeah. Actually putting file into ram like this causes pc to be even more slow, because cpu can work faster because hdd is not slowing it down from accessing file. Good old xp. I will try to investigate this more when i have more time. I do not use win7 because it doesnt support s2 and s3 sleep state for my hardware, even after installing specific update that fixes it, or after installing all updates. It's good trick to put something into ram to make it faster. For example easy2boot installs xp this way, and installation is very fast. I can put some game or web browser data folder to speed them up.
-
Extremely Bad Virus or something
elementaos replied to elementaos's topic in Resolved Malware Removal Logs
Well, I removed that mining virus manually from temp folder long time ago, and few processes from startup. But few days ago i tried to illegally activate windows 10 using kmspico from google search results, and all such software was fake. Removed it but looks like it left something. Later I found original kmspico on mydigitallife forum. I quarantined these files now. summary.txt -
Yeah I will try more methods sometimes later, to compare which is the best. I found currently best solution. First made virtual drive on drive letter Z and copied whole etc folder there. Then removed "c:/windows/system32/drivers/etc/" folder. Used ImDisk RamDisk Configuration, and using junction made "c:/windows/system32/drivers/etc/" to point to "Z:/etc" where Z is my virtual 20 MB drive. Stored that drive into img file and made it autostart on every boot from that file. Also made it to synchronize all changes from ram drive to img file on shutdown/logoff if changed anything. So everything is now automatic, no need to setup anything manually on each boot. There is already visible speed increase in HostsMan, for example when it counts entries, previously it took about 3 seconds. Now 1 second max. Editing is fast too. Everything works as expected. This is on xp, now gonna try on win10 to see if firefox will stop being slow. And yeah, there is no more hard disk activity being observed in procmon, not even on virtual drive. I put virtual drive in physical memory, not in virtual memory of course. I tried previously to change this key in regedit: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\DataBasePath: "%SystemRoot%\System32\drivers\etc" to "Z:\etc" to avoid using junction but it didn't work.
-
Well, the reason I decided to use hosts file method few days ago was because adblockers have the same problem. Adblockplus slows down my browsers, especially firefox. I am using firefox 52.8 ESR for my win xp and win 10. I currently have both installed on my laptop. Adblockplus easylist is large in size, and looks like is getting larger every day. It's few MB. Also I don't like it because it freezes whenever i browser its options, for example just to write one custom filter, it takes about a minute because of slowdowns between each click. Hosts at least will block everything system-wide. I mean all these adblockers, addons, hosts rely on some large database meaning they use hdd. So now I tried on windows xp. Installed and disabled dns client. I used exactly same firefox as in windows 10 (i do not use quantum version because of need for some old plugins like unmht...) and because using junction app i can let browser in both os-es use same data folder. And results are exactly same in xp. Except that browser is not slow. Meaning I observed in procmon that 3 GB are already read in about 20 minutes of using internet. This looks like stupid idea to me. Wastes hard disk, and must be more or less slow. Maybe it is not slow on xp because file is defragmented or because windows 10 has some stupid processes/services/whatever. I am 100% sure it is same with all of you, you all waste hard disk, probably about 10-50 GB just to read hosts file. In xp, probably just like for your win7, it is unnoticable - meaning its fast. In win10 I noticed firewall was turned on and defender service was on although i disabled it in group policy. So I additionaly disabled it in autoruns by sysinternals, and disabled firewall, and disabled those win10 notifications (that if clicked would reenable firewall)...but even then after restart situation is same. Also tried reenabling dns client, and looks like this just additionaly slows everything down, procmon shows hosts is beaing read very slowly but constantly. So useless. So I will try with my idea of putting hosts into ram using virtual ram disk and junction, so that i only have to read from hdd once (17 MB) instead of many GB. Not only this should improve speed but also save my hdd. And I hate windows 10, looks like everything is slower than in xp. More processes and services, problems with admin privilegies, problems with associations (almost no program capable of making associations by itself), more restrictions (very difficult to disable windows defender or dns client...). The only reason i am using it is because xp has no support for new apps and some https encryption algorhitms (well firefox has, but internet download manager doesn't, although internet download accelerator has, it is worse dm than idm)...although idm "made a solution" and microsoft "made update to supprot TLS 1.1 and 1.2 in xp" looks like this is just fake. Because these programs would have to be remade to support that. For example internet explore 8 by itself doesnt support such protocols and idm is relying on that, regardless of updates.
-
It's not yf or proxifier. Even when i completely close them, meaning when i do not have access to internet but have access to dns, the same happens with firefox.
-
Here is how your-freedom dns mode works, it somehow reads random hostnames, many times per second, each hostname is different then previous one. So this is the culprit? Can this specific app (it's actually java) somehow skip hosts file. Because it's useless, it won't find anything there useful for it. All it's hostnames are fake and random but similar. Used only to tunnel all traffic. There are options in my app.
-
Only one out of many svchost.exe uses some cpu, and it is service WdiSystemHost (Diagnostic System Host). But then regardless of that I noticed firefox does the same separately, and in less than 5 minutes it has already read about 376 MB of hosts, and svchost has read 17 MB (17948728 B, exactly same as file size). So this means svchost is OK? It's not reading anymore bytes once this size fullfiled as being read. Firefox increases forever :( And I said it happens with normal hosts too, just more difficult to detect, firefox reads more than file size of hosts. Could it be something weird with my network? For example I use your-freedom app to access free internet and it makes server at localhost port 80 and 1080. Then I use proxifier to force all apps to use that ip and port as proxy. And my your-freedom uses dns mode as real internet, meaning every day I use over GB of dns traffic. So called dns tunneling, probably illegal type of connection that can be used to access free internet worldwide. By the time i written this my hosts file read bytes are already 1 GB. Svchost didn't do any more reading than hosts file size. Only firefox.
-
Actually this happens even with my small 2 lines file.
-
I turned off windows defender completely using group policy. Yes I restarted pc at least 10 times since yesterday. Now when i made my new hosts file and added just 2 entries for test, it works fine. Hosts get blocked and procmon shows no activity with hosts file. Could it be that only large file gets problems or file from hosts-file.net has some bugs inside?
-
It can't be disabled in windows 10. Even msvp or hosts-file mentions that. Had to use their workaround by disabling it using Autoruns by Sysinternals. It is disabled tough, as reported in services in os or in hostsman. Did that yesterday.
-
Actually nothing helps, just tried using HostsMan. Converted all to 0.0.0.0 and 9 hosts per line... Tried restarting pc. But as soon as pc starts up there is high cpu and disk usage. And these 2 programs show that HOSTS file is being continually read. For 5 minutes already few GB get read although hosts file is now only about 12 MB. Something is wrong. Whole pc is slow even before opening any web browser. I made sure i do not replace localhost with 0.0.0.0 and tried removing it too, no difference. When i removed hosts file pc is fast again.
-
Interesting, thanks. I hope you remove duplicate lines when using hosts from 2 or more different sources, because many lines are same. You can use https://www.raymond.cc/blog/remove-duplicate-lines-with-textcrawler-scratchpad-or-notepad/
-
Extremely Bad Virus or something
elementaos replied to elementaos's topic in Resolved Malware Removal Logs
Screenshot was taken before removing it. It reappeared in some other app later so i removed it again. Comes in various software, most commonly with warez. -
I noticed my firefox is extremely slow when i use hosts by hosts-file.net. For each click it looks like it reads whole 17 MB hosts file. All webpages are extremely slow and freeze for about 10 seconds to minute after any click or in some cases movement. When I replaced hosts with windows original empty file, firefox became normally fast. Speed difference is about 10-60x. Seems stupid how this works. It's obviously better to have more websites blocked but it will slow down everything, so these two parameters are against each other. Why everybody reccommends and adds in app to disable dns cache? Would not enabled dns cache speed something up? I don't get it. What is dns cache purpose for hosts file? It caches hosts file into RAM? Then why disable it? Finally I think theoretically good solution would be to use 2 tools to speed up hosts file access, while not removing or reducing number of blocked pages. By making RAM disk let's say of 18 MB size. Then use junction by sysinternals to make symbolic link (or whatever that is called, just like in linux it exists) for hosts file to this ram disk. Especially useful for us who never turn off laptop but put it to sleep only. Or maybe automatize whole process for those who reset often. Good idea? Gonna try tommorow. Seems stupid to read 17 MB file for every click i make on firefox.
-
Extremely Bad Virus or something
elementaos replied to elementaos's topic in Resolved Malware Removal Logs
No, I removed it long time ago, just maybe xmr.pool.minergate.com should be added in hosts?