HOSTS File

Hi all,

To whom ever it may concern about HOSTS file, MVPS HOSTS entries and NIS please visit the following links and understand them carefully:

 

In my opinion, its like using Norton Connectsafe service and adblockers and scriptblockers together. I think this trio combination will give one more protection that editing a system file, which involves more risks.

ncv:
> See editor's note section

from that link:
"Editors Note: in most cases a large HOSTS file (over 135 kb) tends to slow down the machine."

That's equivalent to saying that running a realtime antivirus application "tends to slow down the machine."

It's true.  But those who are concerned about security do it anyway.

But the hosts file, unlike the antivirus, _saves_ time.  From the mvps.org website:
"Using a well designed HOSTS file can speed the loading of web pages by not having to wait for these ads, annoying banners, hit counters, etc. to load."

I'm sure those who complain about the mvps hosts file taking longer to do an occasional quick scan gladly accept the faster browsing.

There are multiple threads in this forum currently by users who say that they are getting between few and none quick scans.  So you can do the math on that.

Which made me wonder.  How often am I getting quick scans?  This particular computer is usually on around 14 hrs per day.

NIS history shows:
Tue  1
Mon  2
Sun  1
Sat  1
Fri  2
Thu  2

I would have thought that there would be more than that.

Hi joen,

 

As far as I'm concerned, I always had the Auto LU set to off permanently.

I always ran manual LU, had the idle timer set to 2 minutes, had the patience to wait 2 extra minutes after the Virus defs were installed, and I can assure you that each time a new set of Virus defs was installed, the Idle Quick Scan always trigereed and successfully completed.

If I have 3 new sets of Virus defs each day I'll have 3 idle Quick Scans, if 4 then 4 and so on...

I know that i have a particular set up (ALU disabled), but it always worked for me that way.

Hope this helps,

 

Regards,

Hello Apostolos,

I just wanted to add that my settings are set by default and I'm having Virus Defs and Quick scans as you, 2-3 Virus Defs a day and after each Virus Defs that is installed, a Quick Scan is performed while the computer is idle.

Regards,
Sandro

Norton does not prevent use of the Hosts file.  The main issue is that the scan of the Hosts file adds several minutes to the scan time and can use a lot of CPU cycles.  If you change the Hosts file frequently, this might be a major annoyance - if you update it only occasionally, then the only noticeable impact will be longer-than-usual Quick Scans.  At least that has been my experience.  I am not sure if bose was having additional issues.

 

 

Actually there are additional problems.  If I activate my hosts file, NIS.exe runs at 13% constantly and slows the system to a crawl.  Its not adding "a few" cpu cycles to a scan... it runs like that forever (34 days and counting)... until I disable the host file again.  Others have also reported this issue.

See post from Buddel here:

http://community.norton.com/t5/Norton-Internet-Security-Norton/High-and-almost-Constant-CPU-usage/td-p/1043071/page/2

Are you getting this 13% figure from the Norton GUI, or from another monitor, such as Task Manager or Process Explorer?

NIS13.pngBoth.

It does nothing but constantly scan my HOSTS file.

hostsunlock.png

What is the CPU measurement with the Norton GUI closed, just reading from Task Manager?

stays the same regardless of Norton Gui open or not.

13%

sao:
> It does nothing but constantly scan my HOSTS file.

We have the mvps hosts file on all our computers.
We have NIS on three computers.
We have never had a problem with NIS scanning the hosts file constantly.

Your problem is likely your HostsMan app, not the hosts file per se.

from the HostsMan website, http://www.abelhadigital.com/hostsman

"HostsMan is a freeware hosts file manager and editor.

Features
Built-in hosts file updater
Enable/Disable hosts file
Built-in hosts editor
Hosts file backup manager
Exclusion list"

What version of HostsMan are you using?

Try excluding HostsMan from NIS detection.

NIS gui:
settings -> Antivirus and sonar exclusions -> Items to exclude from auto-protect, sonar, and download intelligence detection

 

What  version of NIS are you using?  21.x.y.z

I am running the newest HOSTMAN program... 4.3.100.  Process mon verifies it is scanning the HOSTS file, not the HOSTMAN application.

It will scan the file for about 4-6 hours, then stop until HOSTMON does its daily update, the NIS starts all over again for another 4-6 hours.

 

NIS version 21.2.0.38

  processmon.png

Hi, that said, can anyone of you kill the hostman process and related services (modifying service settings in CP related to hostman, changing startup from automatic to manual. Either use task manager or MSCONFIG from run) for a while and see if the problem still occur?
You may revert it after that.
Post back the inferences…

ncv:
>  kill the hostman process and related services ...
> changing startup from automatic to manual

Good advice to try.

I've never used HostsMan before.

Sao, are you using _multiple_ hosts files?
(HostsMan says that it can handle that.)

There are two problems.

1) HostsMan continuously touches the hosts file (apparently).  That sends NIS into a frenzy of continuously scanning the hosts file.  Rinse, lather, repeat.

Solution: don't use HostsMan if you use NIS.

A man goes to the doctor.
Man: "Doctor, it hurts when I go like this."  (Raises and lowers elbow, flexing shoulder.)
Doctor:  "Don't go like that."


2) NIS insists on scanning the hosts file every time it's been touched.

Solution: NIS should allow a configuration choice _not_ to do that.

Joen, thats what I meant. Thanks for taking that a level up! :).
I was trying to see if NIS and hostman tries to or fight with each other to manage HOSTS file.

yes this is the behavior which is happening.

The latest HostsMan version is V4.4.101. 

 

Personally I do not run HostsMan continuously.  I run it manually once per day to update my Hosts file (with about 35,000 entries) and then shut down HostsMan.  NIS 2014 V21.3.0.12 rescans the Hosts file once the update is completed and that is it.  NIS also scans the Hosts file on system startup.  The CPU usage of NIS during the scan is ~13% and it takes about 30 seconds to scan the Hosts file.  HOWEVER, I am running SSDs, not hard drives.  My sources are MVPS Hosts, hpHosts(Ad and tracking servers only), Peter Lowe's AdServers List, and Malware Domain List.  Service DNS Client is left active on my systems. 

 

I've tried using hpHosts and hpHosts (Partial) as sources.  It jacks up the Hosts file entries to well over 550,000.  Now that really slows down the NIS scan time to several minutes.  It also slows down the browser speed.  I do use hpHosts and/or hpHosts (Partial) in my Hosts file sources for this reason.