News for hackers. Stuff that matters.

A comment on Adblock via /etc/hosts. Parent comment

Re:Adblock via /etc/hosts by c0nsumer on Friday February 12, 2016 @10:29AM (#11087819)
Instead of Filemon I'd suggest firing up Process Monitor [1] with a filter of "path contains system32\drivers\etc\hosts" and then Filter -> Drop Filtered Events.

Let this run while you go about your normal work, then check back after you notice the change. Look through the Operation column for WriteFile or something similar, then see what Process Name did it. This'll let you figure out what's actually making the change and you can appropriately assign blame.

[1] https://technet.microsoft.com/en-us/sysinternals/processmoni...

[ Parent | on HN ]
Re:Adblock via /etc/hosts by rasz_pl on Friday February 12, 2016 @12:43PM (#11088922)
on the subject of sysinternals Process Monitor. Did you know procmon.exe REQUIRES Workstation service running in order to start. It uses it to enumerate something and will silently die without it. This is not documented anywhere and pretty bogus.

Older versions worked fine without this service. It was silently added somewhere between win7 and win8 releases.

[ Parent | on HN ]
Re:Adblock via /etc/hosts by c0nsumer on Monday February 15, 2016 @11:13AM (#11104099)
Hmm, interesting. No I didn't... I'll poke with this and maybe open a Premier ticket on it.
[ Parent | on HN ]