<story><title>Adblock via /etc/hosts</title><url>https://github.com/StevenBlack/hosts</url></story><parent_chain><item><author>sugarfactory</author><text>I had been doing this until some time ago to block ads and to prevent Google from collecting my web browsing history via Google Analytics. During the time I witnessed a strange phenomenon. Every time I added  &amp;quot;127.0.0.1 www.google-analytics.com&amp;quot; to C:\Windows\System32\Drivers\etc\hosts. I saw the line removed from the file some hours later. Although I had added tens of lines I only saw the Google Analytics line removed. IIRC finally I decided to figure out whet caused the removal. I used Filemon to watch file changes, though the line got removed again while watching the file and nothing appeared on the log. I suspected Ring-0 processes were secretly running and causing the removal, but I knew nothing about the Windows kernel so I gave up here. I wonder what was the cause to this day.</text></item></parent_chain><comment><author>c0nsumer</author><text>Instead of Filemon I&amp;#x27;d suggest firing up Process Monitor [1] with a filter of &amp;quot;path contains system32\drivers\etc\hosts&amp;quot; and then Filter -&amp;gt; Drop Filtered Events.&lt;p&gt;Let this run while you go about your normal work, then check back after you notice the change. Look through the Operation column for WriteFile or something similar, then see what Process Name did it. This&amp;#x27;ll let you figure out what&amp;#x27;s actually making the change and you can appropriately assign blame.&lt;p&gt;[1] &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;technet.microsoft.com&amp;#x2F;en-us&amp;#x2F;sysinternals&amp;#x2F;processmonitor.aspx&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;technet.microsoft.com&amp;#x2F;en-us&amp;#x2F;sysinternals&amp;#x2F;processmoni...&lt;/a&gt;</text></comment>
<story><title>Adblock via /etc/hosts</title><url>https://github.com/StevenBlack/hosts</url></story><parent_chain><item><author>sugarfactory</author><text>I had been doing this until some time ago to block ads and to prevent Google from collecting my web browsing history via Google Analytics. During the time I witnessed a strange phenomenon. Every time I added  &amp;quot;127.0.0.1 www.google-analytics.com&amp;quot; to C:\Windows\System32\Drivers\etc\hosts. I saw the line removed from the file some hours later. Although I had added tens of lines I only saw the Google Analytics line removed. IIRC finally I decided to figure out whet caused the removal. I used Filemon to watch file changes, though the line got removed again while watching the file and nothing appeared on the log. I suspected Ring-0 processes were secretly running and causing the removal, but I knew nothing about the Windows kernel so I gave up here. I wonder what was the cause to this day.</text></item></parent_chain><comment><author>derFunk</author><text>Did you have local Google services running, like the Google Updater (afaik also comes with Chrome). Google also adds some entries into the task planner, you can also check there what is getting called.&lt;p&gt;Though I believe you should have seen something in Filemon.</text></comment>