When using software like "AVAST" or "NETOP" we can easily block websites by putting the url into the list. If we try to open it in ANY BROWSER, it shows a page that said the url you're visiting is blocked. I lookup into the hostfile but found nothing. How's is work?
They are probably using kernel mode network filter driver that inspects the traffic and if a connection is detected to a blacklisted website, it is blocked and the message is injected to the network stream. On Windows, you can use Windows Filtering Platform and use functions like FwpmEngineOpen, FwpmSubLayerAdd, FwpmFilterAdd. These can be used from user mode to alter firewall behavior. Or, you can write network filter driver to have full access to the network stack.