DDE_Server

Emisioft hangout and not responding when importing custom hosts list

Recommended Posts

Hi everybody,

when i try to import host files for phishing links (downloaded from https://phishing.army/) after browsing the file and press add.the program stops loading and also i couldn't kill it until i reboot the PC.is there any fix or work around for this problem.in the previous times the program stop responding for certain second and then the rules is added but now it stops loading and the program not responding and get inside of infinite loop of crashing until i reboot (i cannot restart service even if i have admin rights-must reboot and the problem is replicated again)

Share this post


Link to post
Share on other sites

When you say "in the previous times the program stop responding for certain second" do you mean that in the past, import of large files was slow?  

How slow?   For what size of files?    And how big are the files you are trying to import this time?   

How much RAM does your machine have?    What version of Windows are you running, and is that 32- or 64-bit?  

You might want to read (though there was no solution described there): https://support.emsisoft.com/topic/32443-importing-hosts-files

 

  • Upvote 1

Share this post


Link to post
Share on other sites
20 minutes ago, JeremyNicoll said:

When you say "in the previous times the program stop responding for certain second" do you mean that in the past, import of large files was slow?  

How slow?   For what size of files?    And how big are the files you are trying to import this time?   

How much RAM does your machine have?    What version of Windows are you running, and is that 32- or 64-bit?  

You might want to read (though there was no solution described there): https://support.emsisoft.com/topic/32443-importing-hosts-files

 

When i said large i don't mean size i mean the file contains a lot of phishing links so importing them take time.the size of file downloaded as text file then convert them to hosts extension aren't big (file size may be in KB as you could see in the attachment it is 283kb file)

i have core i5 laptop with 6 Gigabytes ram. Windows 10 Pro _N 64 bit architecture .

 

phishing_army_blocklist_extended.txt

Share this post


Link to post
Share on other sites
25 minutes ago, JeremyNicoll said:

When you say "in the previous times the program stop responding for certain second" do you mean that in the past, import of large files was slow?  

How slow?   For what size of files?    And how big are the files you are trying to import this time?   

How much RAM does your machine have?    What version of Windows are you running, and is that 32- or 64-bit?  

You might want to read (though there was no solution described there): https://support.emsisoft.com/topic/32443-importing-hosts-files

 

i read the problem with link

yes before i was seeing the status bar responding then hang out little then respond but lately that also doesn't appear and i need to kill the process by restarting as killing it even with administrative rights fails (as i think this is due to self protection of the program)

 

Edited by DDE_Server
duplicated by mistake/add another reply

Share this post


Link to post
Share on other sites

For this sort of file, size probably means number of entries.       I can't see the attached file - only Emsisoft staff will be able to see it (and use it to see if import works for them). 

Share this post


Link to post
Share on other sites

How does web protection and browser security work? Do they store the db locally or on the cloud? Hopefully it is on the cloud and lookups are made during access.

Perhaps emsisoft can just import that list to their cloud db?

Share this post


Link to post
Share on other sites
11 hours ago, DDE_Server said:

when i try to import host files for phishing links (downloaded from https://phishing.army/) after browsing the file and press add.the program stops loading and also i couldn't kill it until i reboot the PC.

It's an issue with the UI in Emsisoft Anti-Malware. If you leave it for a while, it will eventually finish importing the HOSTS file. Sometimes it does crash, especially if the system runs out of memory while importing the HOSTS file, although I've managed to import large HOSTS files (hpHosts if I remember right) on Windows 7 test systems that only had 2 GB of RAM.

 

11 hours ago, DDE_Server said:

is there any fix or work around for this problem.

No. Our developers will have to fix this.

 

11 hours ago, DDE_Server said:

in the previous times the program stop responding for certain second and then the rules is added but now it stops loading and the program not responding and get inside of infinite loop of crashing until i reboot (i cannot restart service even if i have admin rights-must reboot and the problem is replicated again)

So it always crashes now, and this crashing persists after reboot?

  • Upvote 1

Share this post


Link to post
Share on other sites
3 hours ago, grayskull said:

How does web protection and browser security work?

Web Protection works by monitoring network traffic for DNS requests and IP addresses connections are opened to, and blocking them if the remote host is in our database. The database is stored in files in the Emsisoft Anti-Malware folder, and is updated when Emsisoft Anti-Malware checks for updates (once an hour by default).

Emsisoft Browser Security will hash part of the URL (I would believe just the domain name) of a visited website, and send the hash to our servers. If the hash matches one for known malicious hosts in our database then a list of all known malicious addresses at that domain are returned to Emsisoft Browser Security by our servers. The extension then determines on its own whether or not the page at that domain you're trying to visit is malicious, and blocks it accordingly. The results are then cached so that the extension doesn't need to request data about that domain again from our servers. This is done to ensure data about exactly what web pages you are visiting are never sent to our servers, and to minimize the number of times the extension has to ask us about the domains the web pages you visit are at in order to make it impossible to effectively track your browsing habits from the extension.

 

3 hours ago, grayskull said:

Perhaps emsisoft can just import that list to their cloud db?

We already use a number of third-party sources for malicious and phishing URL's. The Emsisoft Browser Security extension actually uses an extra source that has a very extensive list of phishing hosts, and is intended to supplement our Web Protection for those who have disabled their web browser's built-in phishing protection.

  • Thanks 1

Share this post


Link to post
Share on other sites

@GT500  When someone imports the contents of a file of iffy hosts, does that replace what's already held by EAM, or add to it?   Is the user-import set of hosts held separately from those that EAM itself maintains?  

I'm wondering of this user's repeated attempts might mean there's multiple not-quite-complete lists in storage?

 

I downloaded today's blocklists from https://phishing.army/ ; the basic list has about 10,700 hostnames and the extended list has about 13,700 ... which means these lists are nowhere near as large as the one discussed on the other forum discussion I mentioned (that was - it was claimed - 300282 entries).

 

@DDE_Server - saying you have a machine with 6 GB RAM is not neccessarily relevant; what might matter is how much of that RAM is free when you try to do the import.   So, are you doing this as soon as the machine is booted, or when you already have lots of other things running?   How much unused RAM does Task Manager (or other tools) show you have (that is, what are the figures in the Memory section of Task Manager's Performance tab)?  And how much does it show a2start.exe using before you start the import and as the import attempt is progressing? 

Eg: on my Win 8.1 system I have 8 GB RAM.  Task Manager right now says that I'm using  3.8 GB and have 4.1 GB available.   Those are the figures which (more or less) add up to 8 GB (the rest is possibly being used by the video card, I'm not sure).  But on my system I also have a large paging file; under the 3.8 & 4.1 GB figures Task Manager says I have 4.7 GB "committed" out of a total of 16.2 GB.   That means that here programs have 16.2 GB of memory available for use in total, even though there's only 8 GB of actual RAM chips.  The extra 8.2GB is space on the paging file.   Although the "memory" that's in the paging file (on an SSD) is a lot slower than the memory in the real RAM chips, it does mean that my system can do a lot more than if it only had the RAM chips.

What figures do you have?

  • Upvote 1

Share this post


Link to post
Share on other sites
12 hours ago, JeremyNicoll said:

@GT500  When someone imports the contents of a file of iffy hosts, does that replace what's already held by EAM, or add to it?   Is the user-import set of hosts held separately from those that EAM itself maintains?  

I'm wondering of this user's repeated attempts might mean there's multiple not-quite-complete lists in storage?

 

I downloaded today's blocklists from https://phishing.army/ ; the basic list has about 10,700 hostnames and the extended list has about 13,700 ... which means these lists are nowhere near as large as the one discussed on the other forum discussion I mentioned (that was - it was claimed - 300282 entries).

 

@DDE_Server - saying you have a machine with 6 GB RAM is not neccessarily relevant; what might matter is how much of that RAM is free when you try to do the import.   So, are you doing this as soon as the machine is booted, or when you already have lots of other things running?   How much unused RAM does Task Manager (or other tools) show you have (that is, what are the figures in the Memory section of Task Manager's Performance tab)?  And how much does it show a2start.exe using before you start the import and as the import attempt is progresses? 

Eg: on my Win 8.1 system I have 8 GB RAM.  Task Manager right now says that I'm using  3.8 GB and have 4.1 GB available.   Those are the figures which (more or less) add up to 8 GB (the rest is possibly being used by the video card, I'm not sure).  But on my system I also have a large paging file; under the 3.8 & 4.1 GB figures Task Manager says I have 4.7 GB "committed" out of a total of 16.2 GB.   That means that here programs have 16.2 GB of memory available for use in total, even though there's only 8 GB of actual RAM chips.  The extra 8.2GB is space on the paging file.   Although the "memory" that's in the paging file (on an SSD) is a lot slower than the memory in the real RAM chips, it does mean that my system can do a lot more than if it only had the RAM chips.

What figures do you have?

Thanks a lot @JeremyNicoll for you reply as you could see in the screen shot with Chrome process the largest memory resource is consumed by Emsisoft although there is still enough memory the crash occur

image.thumb.png.ad1506687606df7add6ab1fccb712380.png
Download Imageas you could 

Share this post


Link to post
Share on other sites
20 hours ago, GT500 said:

It's an issue with the UI in Emsisoft Anti-Malware. If you leave it for a while, it will eventually finish importing the HOSTS file. Sometimes it does crash, especially if the system runs out of memory while importing the HOSTS file, although I've managed to import large HOSTS files (hpHosts if I remember right) on Windows 7 test systems that only had 2 GB of RAM.

 

No. Our developers will have to fix this.

 

So it always crashes now, and this crashing persists after reboot?

first thanks for you reply

yes crash repeated again when trying importing the file also after reboot.i will try speedily import the host file after startup and see

kindly find the screenshot during importing and crashing occurrence (as you could see power usage became very high and i could hear my Fan span became louder 

image.thumb.png.2e63cbdd1127be0de56ed1c814b6bfe1.png
Download Image 

 

Share this post


Link to post
Share on other sites
16 hours ago, JeremyNicoll said:

When someone imports the contents of a file of iffy hosts, does that replace what's already held by EAM, or add to it?

Entries from HOSTS files are added to custom rules, which will override built-in rules (if a rule exists for the same domain).

 

16 hours ago, JeremyNicoll said:

Is the user-import set of hosts held separately from those that EAM itself maintains?

Absolutely. Nothing ever overwrites the default list of host rules.

 

4 hours ago, DDE_Server said:

as you could see power usage became very high and i could hear my Fan span became louder

That's because CPU usage from a2start.exe had increased, probably enough to max out a single core on the CPU.

Share this post


Link to post
Share on other sites

@DDE_Server  - when a2start.exe's cpu use goes high it's because it's doing the import.     How long have you left it doing that?    Is it a few minutes or hours or what? 

The "not responding" status information is misleading;  it just means  "is busy doing something else".

In your first screenshot you showed  Emsisoft Security Centre (which is a2start.exe) using 34.2 MB (actually it will have had more than that allocated to it by Windows but is only using a subset of it, that amount, at this instant).  In your later screenshot (with the high cpu) that figure has climbed to  92 MB.    Neither are large compared with your 6 GB of RAM, and if the 48% shown at the top of the first screenshot means that only about 3 GB RAM was then in use, there must be around 3 GB available.   Do you have any idea how big the memory value gets before a2start crashes?   

 

  • Upvote 1

Share this post


Link to post
Share on other sites
2 hours ago, JeremyNicoll said:

@DDE_Server  - when a2start.exe's cpu use goes high it's because it's doing the import.     How long have you left it doing that?    Is it a few minutes or hours or what? 

The "not responding" status information is misleading;  it just means  "is busy doing something else".

In your first screenshot you showed  Emsisoft Security Centre (which is a2start.exe) using 34.2 MB (actually it will have had more than that allocated to it by Windows but is only using a subset of it, that amount, at this instant).  In your later screenshot (with the high cpu) that figure has climbed to  92 MB.    Neither are large compared with your 6 GB of RAM, and if the 48% shown at the top of the first screenshot means that only about 3 GB RAM was then in use, there must be around 3 GB available.   Do you have any idea how big the memory value gets before a2start crashes?   

 

it took infinite time and import didn't continue .loading  profile of the mouse cursor without any progress until i force re-start

Share this post


Link to post
Share on other sites

> "it took infinite time"

How long did you wait?  Minutes or hours?  If hours, do you mean a couple or eg overnight?

This is not a stupid question.  If you have seen it take, say, five hours before it crashes, then when you try again you could record memory use at (say) 2 hours, 3 hours, 4 hours, 4h 15m, 4h 30m etc and we might get an idea of the point where memory is exhausted.   That might be useful info.

It is not obvious to me why you cannot import files which are much much smaller than those described in the other thread.

 

> "import didn't continue .loading  profile of the mouse cursor without any progress"

I have no idea what that means.

 

Share this post


Link to post
Share on other sites

This should be fixed in the latest beta version of Emsisoft Anti-Malware. I tested with an older version of hpHosts (last updated March 16th, 2018) available at the following link, and it imported fairly quickly with no errors:
http://hphosts.gt500.org/hosts.txt

Share this post


Link to post
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.


  • Recently Browsing   0 members

    No registered users viewing this page.