PDA

View Full Version : can programs bypass Windows' "hosts" file?


jarthel
07-22-2008, 08:33 AM
I have a software here that like to phone home every so often. Before you say anything, this is a licensed software that has been paid for.

Uing tcpview (from sysinternal), I found the software is calling home. I just do not like the fact that it needs to call home now and then and I do not know what data (if any) is passed on to the vendor.

so I added the domain to my hosts file. This is the entry I created:

127.0.0.1 domain-here.com.

If I view domain-here.com using a browser, I get an error message which is correct since I do not have a webserver running in localhost.

BUT it seems the offending program is still able to call home. Somehow it is able to bypass my hosts file. In TcpView, the program is using the domain to call home and not its IP.

any ideas (other than install a firewall and blocking the offending domain) on how to prevent the program from calling home?

thank you very much :)

Monkey God
07-22-2008, 08:39 AM
do you know for sure thats its trying to resolve by domain name, or that its trying by IP and tcpview is simply displaying the resolved domain name?

DeaconFrost
07-22-2008, 08:57 AM
Have you tried contacting the company to ask why it phones home and if it can be disabled? Rather than play the paranoia card, since this is legal, licensed software, you have a right to ask that question of the vendor.

defektiv
07-22-2008, 01:01 PM
What is the name of the application? I may be familiar with what you're talking about.

calebb
07-22-2008, 01:17 PM
What is the name of the application? I may be familiar with what you're talking about.


Uing tcpview (from sysinternal), I found the software is calling home.

Not This.

DeaconFrost
07-22-2008, 01:23 PM
That's the name of the software used to discover that the unnamed application is phoning home.

calebb
07-22-2008, 02:11 PM
That's the name of the software used to discover that the unnamed application is phoning home.

My bad :)