[Don Lekei]

Microsoft did something misguided in a recent update. I came here to try to
resolve the problem only to find that nobody seems to know what it is.

Internet Explorer is overriding the hosts file when you are online. Now it
only honors the hosts file when you are offline. It is overriding the TCP/IP
services, and going straight to the offending site. Ping, tracert, mail, and
other browsers honor the hosts file.

For me this is a killer because I override all of my web sites with
dev.(domain).ca going to localhost, so I can edit sites. However, if my
computer is ONLINE then I can't access the local server.

Unfortunately, the ONLY work-around I have found so-far is to use another
browser like Firefox. I have been working so hard to avoid that.

If anyone knows an ACTUAL solution to this, I would appreciate a note at
iedev@help-my-pc.com thanks.

-Don


"Gary Smith" wrote:

> One possible cause is that linksynergy may be using a server name such as
> ad2.linksynergy.com that you don't have in your list. They can make them
> up as fast as you can discover and block them.
>
>
> In microsoft.public.windows.inetexplorer.ie6.browser Hall <hall@garp.org> wrote:
> > Gary, I've got a long list in my hosts file, which yes came from this
> > source.
>
> > Unfortunately, no one's able to point out a possible cause for why
> > technically this isn't working anymore...
>
>
> > "Gary Smith" <bitbucket@example.com> wrote in message
> > news:OksWhEnCFHA.3728@TK2MSFTNGP14.phx.gbl...
> >> But do you also have
> >>
> >> click.linksynergy.com
> >> ssl.linksynergy.com
> >> images.trafficmp.com
> >> ads.usatoday.com
> >> c.usatoday.com
> >> viewer.usatoday.com
> >>
> >> and any other host names they may have dreamed up to serve ads? Those
> >> were all in the MVPS HOSTS list published on 6-28-2004.
> >>
> >>
> >> In microsoft.public.windows.inetexplorer.ie6.browser Hall <hall@garp.org>
> > wrote:
> >> > Everyone
> >>
> >> > I've verified the location of the hosts file and its in
> >> > C:\WINDOWS\system32\drivers\etc
> >> > which is the only hosts file in the system, and is the correct location
> >> > according to
> >> >
> > HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Databa
> >> > se Path
> >>
> >> > Yes, I do update it and it has lines like this
> >> > 127.0.0.1 ad.linksynergy.com
> >> > 127.0.0.1 ad.trafficmp.com
> >> > 127.0.0.1 ad.usatoday.com
> >>
> >> > And yet images from these urls still appear in IE.
> >>
> >> > Any ideas?
> >>
> >> > Thanks!
> >>
> >>
> >>
> >>
> >> > "Hall" <hall@garp.org> wrote in message
> >> > news:ez$elsXCFHA.3740@TK2MSFTNGP09.phx.gbl...
> >> >> I'm on XP Pro.
> >> >>
> >> >> I've always used the hosts file to block advertising images to appear
> > in
> >> >> pages by entering their url with 127.0.0.1.
> >> >>
> >> >> This doesn't seem to work anymore. Has something changed?
> >> >>
> >> >>
> >>
> >>
> >>
> >> --
> >> Gary L. Smith gls432@yahoo.com
> >> Columbus, Ohio
>
>
>
> --
> Gary L. Smith gls432@yahoo.com
> Columbus, Ohio
>

[Malke]

Don Lekei wrote:

> Microsoft did something misguided in a recent update. I came here to
> try to resolve the problem only to find that nobody seems to know what
> it is.
>
> Internet Explorer is overriding the hosts file when you are online.
> Now it only honors the hosts file when you are offline. It is
> overriding the TCP/IP services, and going straight to the offending
> site. Ping, tracert, mail, and other browsers honor the hosts file.
>
> For me this is a killer because I override all of my web sites with
> dev.(domain).ca going to localhost, so I can edit sites. However, if
> my computer is ONLINE then I can't access the local server.
>
> Unfortunately, the ONLY work-around I have found so-far is to use
> another browser like Firefox. I have been working so hard to avoid
> that.
>
> If anyone knows an ACTUAL solution to this, I would appreciate a note
(email snipped)

I haven't seen this problem with any of the MS updates on any of my
Windows boxen or on any of the very many clients' computers I have
worked on. It actually sounds to me like you have something like Spybot
Search & Destroy's Internet Explorer protection enabled. Any
third-party programs like that? Norton Internet Security? Any
third-party firewalls that might be protecting the hosts file?

Oh, and don't post your real, unmunged email address on Usenet and
messageboards. It will get harvested by spambots. Here's a link
explaining how to munge:
http://www.mailmsg.com/SPAM_munging.htm

Malke
--
Elephant Boy Computers
www.elephantboycomputers.com
"Don't Panic!"
MS-MVP Windows - Shell/User

[Don Lekei]

Thanks Malke,

I have seen this on several support forums, including this one.

I found the problem. Actually, it turns out that IE now does some
interresting new checks (including tests for Windows 2003 IIS ) before
honoring the hosts file if you are online. These tests only occur with IE and
they only occur when you are online and only happen if you have
"automatically detect settings" set "on" in Internet
Options->Connections->Lan Settings. It also totally ignores the precidence
settings of hosts/dns/lmhosts etc in the registry.

Strangely, some of the problems seem to be related to the last date I ran
officeupdate!

Turning off "automatically detect settings" fixed all of the problems,
including checking for wpad.dat to determine if it is a valid proxy of the
site.

Btw: Thanks for the email tip. I wasn't sure if this was usenet or a
microsoft private site, but I always use a disposable email address that will
be blacklisted once it gathers spam.

"Malke" wrote:

> Don Lekei wrote:
>
> > Microsoft did something misguided in a recent update. I came here to
> > try to resolve the problem only to find that nobody seems to know what
> > it is.
> >
> > Internet Explorer is overriding the hosts file when you are online.
> > Now it only honors the hosts file when you are offline. It is
> > overriding the TCP/IP services, and going straight to the offending
> > site. Ping, tracert, mail, and other browsers honor the hosts file.
> >
> > For me this is a killer because I override all of my web sites with
> > dev.(domain).ca going to localhost, so I can edit sites. However, if
> > my computer is ONLINE then I can't access the local server.
> >
> > Unfortunately, the ONLY work-around I have found so-far is to use
> > another browser like Firefox. I have been working so hard to avoid
> > that.
> >
> > If anyone knows an ACTUAL solution to this, I would appreciate a note
> (email snipped)
>
> I haven't seen this problem with any of the MS updates on any of my
> Windows boxen or on any of the very many clients' computers I have
> worked on. It actually sounds to me like you have something like Spybot
> Search & Destroy's Internet Explorer protection enabled. Any
> third-party programs like that? Norton Internet Security? Any
> third-party firewalls that might be protecting the hosts file?
>
> Oh, and don't post your real, unmunged email address on Usenet and
> messageboards. It will get harvested by spambots. Here's a link
> explaining how to munge:
> http://www.mailmsg.com/SPAM_munging.htm
>
> Malke
> --
> Elephant Boy Computers
> www.elephantboycomputers.com
> "Don't Panic!"
> MS-MVP Windows - Shell/User
>

[Malke]

Don Lekei wrote:

> Thanks Malke,
>
> I have seen this on several support forums, including this one.
>
> I found the problem. Actually, it turns out that IE now does some
> interresting new checks (including tests for Windows 2003 IIS ) before
> honoring the hosts file if you are online. These tests only occur with
> IE and they only occur when you are online and only happen if you have
> "automatically detect settings" set "on" in Internet
> Options->Connections->Lan Settings. It also totally ignores the
> precidence settings of hosts/dns/lmhosts etc in the registry.
>
> Strangely, some of the problems seem to be related to the last date I
> ran officeupdate!
>
> Turning off "automatically detect settings" fixed all of the problems,
> including checking for wpad.dat to determine if it is a valid proxy of
> the site.
>
> Btw: Thanks for the email tip. I wasn't sure if this was usenet or a
> microsoft private site, but I always use a disposable email address
> that will be blacklisted once it gathers spam.
>

I'm glad you got it sorted. Thanks for taking the time to post the
solution since this will help others in the future. Yes, these are
public Usenet newsgroups hosted on Microsoft servers, propagated out to
other news servers.

Malke
--
MS-MVP Windows User/Shell
Elephant Boy Computers
www.elephantboycomputers.com
"Don't Panic"

[Robert Aldwinckle]

"Don Lekei" <Don Lekei@discussions.microsoft.com> wrote in message
news:B457BE54-458D-47AE-B3E4-A961EA4D0A3F@microsoft.com...
> Microsoft did something misguided in a recent update. I came here to try to
> resolve the problem only to find that nobody seems to know what it is.

Is this your interpretation of some symptoms which you aren't explaining
or do you have an article you can cite about this?

Are you a new user of NT5x by any chance? I could see someone new to NT5x
not understanding that the dnscache is loaded by HOSTS and then lookups from
the dsncache may appear to take precedence over HOSTS. E.g. if you make a
change to HOSTS but don't flush the cache (or reboot) the old HOSTS settings
could still be in effect. I have seen a slightly ambiguous statement that the cache
is updated also whenever HOSTS is changed, so YMMV.

In any case, perhaps all you need to do is flush or disable the dnscache
(if you're making changes to HOSTS you want to be used immediately)?

ipconfig /flushdns

net stop dnscache


>
> Internet Explorer is overriding the hosts file when you are online. Now it
> only honors the hosts file when you are offline.

This is ambiguous too. What do you mean by "when you are offline"?
In one sense you can be Offline in IE but still be connected to the Internet
e.g. by using registry value GlobalUserOffline


> It is overriding the TCP/IP
> services, and going straight to the offending site.

What tools did you use to prove this idea?
The only program I am aware of which does this is nslookup
as one would expect.


> Ping, tracert, mail, and
> other browsers honor the hosts file.
>
> For me this is a killer because I override all of my web sites with
> dev.(domain).ca going to localhost, so I can edit sites. However, if my
> computer is ONLINE then I can't access the local server.

As I hinted above your procedure is unclear to me.


>
> Unfortunately, the ONLY work-around I have found so-far is to use another
> browser like Firefox. I have been working so hard to avoid that.

Does Firefox actually *read* HOSTS? E.g. you have used FileMon to detect that?

Details please.


Robert Aldwinckle
(posted from ie6.browser)
---