Spyware/Malware/Ads Blocklist Updates

[Moore]

Last update September 13th 2009

Outpost Firewall users can download totally free pre made lists ready for importing into Blockpost versions 2.5 -through to 4.0 & OPF 2009 from our new BlocklistPro.com site..

There are downloads for seperate anti-spyware list, ads-trackers list and a combined anti-spyware/ads list. The Level1 / Anti P2P list in Blockpost format has also now been added to BlocklistPro downloads.

There are more blocklists available to download using the Blocklist Manager that you may want to use, please check the BISS IP Blocklists FAQ for the full details on all available lists.

If you have your own IP entries to block, you should consider maintaining a custom list to make sure that you dont lose them through updating, and re-import that after each time you update. The Blocklist Manager can help with this by allowing you to import personal inclusion lists during each update, and can merge all blocklists into one list before you convert these IP ranges into Outpost format and import into Blockpost.

--

More information on the online Blocklist Converter here and Blocklist Manager here:

http://outpostfirewall.com/forum/showthread.php?t=7156
http://outpostfirewall.com/forum/showthread.php?t=9846

>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
:: Outpost Pro - BLOCKPOST V2 ~ V3 ~ V4 Lists ::
>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>

New free download site Blocklist Pro - Blockpost Section :
http://blocklistpro.com/download-cen...ll-blocklists/

==================================

>>>>>>>>>>>>>>>>>>>>>>>>>>>>
Outpost free - BLOCKPOST V1 Lists
>>>>>>>>>>>>>>>>>>>>>>>>>>>>

No longer available - please use the Blocklist Manager to build your own Blockpost V1 lists. Outpost V1 should probably be avoided and it would be best to upgrade to a more recent version of Outpost.

>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
For details of what goes in to the Malware list check this forum:
>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>

http://www.bluetack.co.uk/forums/index.php?showforum=83

>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
If you want to report a block you think is incorrect please post it here:
>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>

http://www.bluetack.co.uk/forums/index.php?showforum=72


--

The Bluetack Hosts file also contains all the known domains that belong to the hijackers in the malware IP blocklist , for the most effective protection.

----

Any comments and/or suggestions are welcome.

----

[Csimbi]

I am not sure that this is the right place to ask this - if not, just delete it.
Would it be possible to have fixed URLs for the lists above - without the date in the URL?
This would allow me to use these lists without updating the URL every time.
Thank You.

[Moore]

yeah ok, I'll see what I can do ..



Edit: Set fixed URLs , for the update date check the link in my signature

[cooldoc66]

Hi !
Is this list suitable for 3.5 as well? Blockpost DOES NOT seem to be working with this list (Bluetack)
Thanx in advance.
Ivan

[Csimbi]

Copy the file to <program files/outpost installation dir>\Blockpost.txt
Then, open the blockpost properties window, and click reload.
Note that the old list will disappear.
So - I suggest not using these lists alone, but grab the BLM (see Moore's sig about blocklist manager) and add it there as an external link to be used.
Hope it helps.

Oh, and Moore, thanks for the fixed URLs - just noticed it. Gonna use the combined list.

[cooldoc66]

Thx Csimbi, U r a Genious!
I try to study BLM 'cause I ain't too familiar what U've said about external Links etc.
Am I supposed to install BLM, and then use that application to append the forementioned Bluetack Blocklist to the copied blockpost.txt?
Is that what U recommend?
I appreciate Your help!

[Csimbi]

I am no genius, just spend long enough time on these security forums to gather in-depth info how things work. If You really want to name a genius, it shall be Dmut, Fazion and the BISS staff including Moore (no specific order here, all done their parts).

I used BLM in the past - do not use it currently - but I remember that there is a way to include URLs as well.
Go here: http://www.bluetack.co.uk/blmhelp/
Then click "Basic functions", then click "Import list", then scroll to the bottom.
I do not know how up-to-date the help pages are, but this is how You do it in general.
Moore, can You confirm/deny this? Thank You.

I use my own tool to create the lists, You can find it here: http://www.bluetack.co.uk/forums/ind...howtopic=11022

[morphyx]

i am using BLM and d/l'd the source files. i converted to PG2 and that prog works fine.

however, when i converted and loaded the same files for OP Blockpost v2, i can't get to any websites with firefox or IE. as soon as I clear the lists, i can surf.

i tried loading one list at a time to see if it was a specific file but i couln't sort it out.

any ideas?

[Csimbi]

When You load it up in the Blockpost plugin, what are the numbers shown (nuber of IPs, %, etc)?

[KronckeW]

for info: from my list



the 1st of course is the number of line items, the total ip's blocked is the sum of all the individual ip's covered in those ranges, and the third is the percentage of all possible ip's that are blocked, ie. almost 1.9 billion are blocked by the 9.4k items, or almost 44% of all possible addresses between 0.0.0.0 and 255.255.255.255 (these stats only appear in the current 3.5x version; they also appear at the end of bluetack's blocklist manager processing.)

morphyx: what sites were you trying to connect to & what does your blocked and blockpost logs say? ( see Please Read First ) can you connect to any sites at all? the key is normally in the logs

[morphyx]

hi,thanks for the reply!

first off,i dont see that stat bar at the bottom of the blockpost>properties panel. i'm using Outpost Firewall Pro ver. 3.51.759.6511 (462) and blockpst.dll 3.5.462.6330.

if there is an option to turn on/off that view i cant find it.

i'm on a hp laptop/AMD 64 athelon/win XP pro/cable modem/wireless router and have my pc set to 'best performance' which turned off the XP look. my toolbars and such are in classic windows mode. is that it?

as far as surf blocks...i cant get to google, google news, cnn news, microsoft updates, fox news, american express, and various other bookmarks.

it doesnt seem to block little known websites, message boards, or financial websites. there are many booksmarks i can reach.

when i look at the pro log veiwer as attempts are being blocked, it's a little confusing as to how i could select a specific block and set it to "allow". i see the 'add filter' but i'm not sure how to use it.

sorry if i'm a total noob. i;ve never used a firewall before and this one has alot of stuff!!

[KronckeW]

http://www.outpostfirewall.com/plug-...2006_06_05.exe

05.06.2006
+ new feature: system tray event notifier (disabled by default - must be enabled in properties dialog).
+ bug fix: 'Reload blocklist' now works. :-)
+ bug fix: subnet masking handled correctly by kernel.
+ added displaying of no. items, total no. blocked IPs and percentage of all IPs being blocked (approximation) in properties window.
+ minor behavioural changes in properties dialog.

hi, you can get the most current blockpost from the link in the post above, which is the last post in the referenced thread. it may need re-installing if you are using this version & do not see the stats...

if you click the 'detailed log' button ( or select the 'blockpost' line in the lefthand tree of the log viewer, you should display the blockpost log as in my attachment below. you can then use the mouse to select line entries by clicking with the left button, then using the right button to bring up a context
menu, select the copy selected records, then in the forum entry window right click & paste them in, like this:

12:18:30 10.0.0.5 adfarm.mediaplex.com 64.158.223.0-64.158.223.255#Valueclick, Inc
12:06:42 10.0.0.5 adfarm.mediaplex.com 64.158.223.0-64.158.223.255#Valueclick, Inc
12:06:36 10.0.0.5 adfarm.mediaplex.com 64.158.223.0-64.158.223.255#Valueclick, Inc

you should, with luck see the entries for the blocked site in the third column, and the range#description in the 4th, you can then use the blockpost properties window to "Find", and then "Remove" the offending range entries - sometimes the block lists are a bit too generic & block good stuff, if yo uuse the bluetack blocklist manager to create your lists, you can set up exceptions to keep these "remove"d sites from re-appearing next regeneration.

[Moore]

hi,thanks for the reply!
as far as surf blocks...i cant get to google, google news, cnn news, microsoft updates, fox news, american express, and various other bookmarks.

it doesnt seem to block little known websites, message boards, or financial websites. there are many booksmarks i can reach.

when i look at the pro log veiwer as attempts are being blocked, it's a little confusing as to how i could select a specific block and set it to "allow". i see the 'add filter' but i'm not sure how to use it.

For a start dont enable all lists from the BLM unless you know what you are doing... The spiders list will block all of google , the MS list blocks all microsoft IPs ..

For any site/IP address you want to unblock , look in the Blockpost log for what has been blocked , copy them and add each one of the IP / IP ranges into the BLM exclusions manager and then re-download the lists you have enabled... without using all the sources on offer.

Each blocklist in the BLM has a specific purpose , and can cause problems for many web sites if you use them all without knowing what they are intended for.

We also rely on user feedback on the bluetack forums to let us know if there are problems , there is a specific forum for reporting any sites that are blocked that shouldnt be here:
http://www.bluetack.co.uk/forums/index.php?showforum=72

You can find more information on the lists here :
http://www.bluetack.co.uk/forums/ind...&CODE=01&cid=9

i am using BLM and d/l'd the source files. i converted to PG2 and that prog works fine

BLM is not compatible with PG2 , only PG1.

I still just save my list to the desktop or a folder somewhere and import it in through Blockpost most of the time.

If you want , you can set up the BLM to save your exported list to the Outpost program files folder and then use the reload button in Blockpost. The instructions for setting up export are in the link provided by Csimbi.

Basically , In BLM options go to App location option , click the browse button and find the Outpost program files folder, select the blockpost.txt and save.

The list must be named blockpost.txt if you do it this way.

[Xcurt]

Good day to you all.

You can learn something new everyday, I guess.

Today I found this Forum and learned that I have never used Outpost Pro the way it is intended to be used. "Blocklists"? I have never heard of the subject before. Hmm.. I am quite sure that no one told about them when I bought Pro a couple of years ago.

I read this thread and opened my log viewer and saw that I have no lists at all. No one is being blocked...

Well, no harm has been done; no one has invaded my pc. But I am surprised and disappointed with the lack of information on how to use the plug-ins. I paid, downloaded and installed Pro and the plug-ins, and expected everything to be in order then. Wouldn't you?

Is there a page where I can learn how to make this feature work? Remember that I call my self an IT-analphabet, please - and English is by far not my first language.

But these blocklists... They must be offered by Agnitum, and it must be possible to subscribe to updates pr. automated download. This is 2006, and the name is PRO.

I use Win 2000 and Outpost Pro 3.51 - and this was my first post.

[Moore]

Hi Xcurt, welcome to the forum.

Blockpost is not an official plugin developed or maintained by Agnitum and the blocklists are not either.

The blocklists are an extra that you can choose to use to enhance your protection if you want to. We maintain these lists at www.bluetack.co.uk and share them here.

Is there a page where I can learn how to make this feature work?

Try this page , and also read through the other topics in the Blockpost forum :
http://outpostfirewall.com/forum/showthread.php?t=9846

An older guide to Blockpost is here but still contains most of the relevant information about its use:
http://www.outpostfirewall.com/guide.../blockpost.htm

If you have any questions at all you would like to ask , thats what the Blockpost forum is here for.

But these blocklists... They must be offered by Agnitum, and it must be possible to subscribe to updates pr. automated download. This is 2006, and the name is PRO

I think Agnitum has more important things to do like spending time to develop the firewall than to maintain their own blocklists. But you could always let them know how you feel via the suggestion page here:
http://www.agnitum.com/support/forms/suggestions.php