<instructions>Your goal is to analyze the following comment and estimate how highly it will be upvoted by the Hacker News community.</instructions><comment><author>c0nsumer</author><text>Instead of Filemon I&amp;#x27;d suggest firing up Process Monitor [1] with a filter of &amp;quot;path contains system32\drivers\etc\hosts&amp;quot; and then Filter -&amp;gt; Drop Filtered Events.&lt;p&gt;Let this run while you go about your normal work, then check back after you notice the change. Look through the Operation column for WriteFile or something similar, then see what Process Name did it. This&amp;#x27;ll let you figure out what&amp;#x27;s actually making the change and you can appropriately assign blame.&lt;p&gt;[1] &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;technet.microsoft.com&amp;#x2F;en-us&amp;#x2F;sysinternals&amp;#x2F;processmonitor.aspx&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;technet.microsoft.com&amp;#x2F;en-us&amp;#x2F;sysinternals&amp;#x2F;processmoni...&lt;/a&gt;</text><parent_chain><item><author>sugarfactory</author><text>I had been doing this until some time ago to block ads and to prevent Google from collecting my web browsing history via Google Analytics. During the time I witnessed a strange phenomenon. Every time I added  &amp;quot;127.0.0.1 www.google-analytics.com&amp;quot; to C:\Windows\System32\Drivers\etc\hosts. I saw the line removed from the file some hours later. Although I had added tens of lines I only saw the Google Analytics line removed. IIRC finally I decided to figure out whet caused the removal. I used Filemon to watch file changes, though the line got removed again while watching the file and nothing appeared on the log. I suspected Ring-0 processes were secretly running and causing the removal, but I knew nothing about the Windows kernel so I gave up here. I wonder what was the cause to this day.</text></item></parent_chain></comment><story><title>Adblock via /etc/hosts</title><url>https://github.com/StevenBlack/hosts</url></story>
<instructions>Your goal is to analyze the following comment and estimate how highly it will be upvoted by the Hacker News community.</instructions><comment><author>derFunk</author><text>Did you have local Google services running, like the Google Updater (afaik also comes with Chrome). Google also adds some entries into the task planner, you can also check there what is getting called.&lt;p&gt;Though I believe you should have seen something in Filemon.</text><parent_chain><item><author>sugarfactory</author><text>I had been doing this until some time ago to block ads and to prevent Google from collecting my web browsing history via Google Analytics. During the time I witnessed a strange phenomenon. Every time I added  &amp;quot;127.0.0.1 www.google-analytics.com&amp;quot; to C:\Windows\System32\Drivers\etc\hosts. I saw the line removed from the file some hours later. Although I had added tens of lines I only saw the Google Analytics line removed. IIRC finally I decided to figure out whet caused the removal. I used Filemon to watch file changes, though the line got removed again while watching the file and nothing appeared on the log. I suspected Ring-0 processes were secretly running and causing the removal, but I knew nothing about the Windows kernel so I gave up here. I wonder what was the cause to this day.</text></item></parent_chain></comment><story><title>Adblock via /etc/hosts</title><url>https://github.com/StevenBlack/hosts</url></story>