220-1002 · Question #189
A technician performs a virus cleaning on a computer that has been redirecting all browsers to a phishing website. System Restore was turned off before the cleaning. The technician runs the machine…
The correct answer is A. Check the contents of the hosts file. The hosts file is a local text file (located at C:\Windows\System32\drivers\etc\hosts on Windows) that maps hostnames to IP addresses, overriding DNS resolution. Malware commonly modifies this file to redirect specific domains to a malicious IP address, even after antivirus…
Question
A technician performs a virus cleaning on a computer that has been redirecting all browsers to a phishing website. System Restore was turned off before the cleaning. The technician runs the machine through several scanners, and then tests for redirection. A smaller number of sites are still redirecting to the phishing website. The antivirus software correctly blocks the website. Which of the following should the technician do NEXT?
Options
- ACheck the contents of the hosts file
- BDo a System Restore to a date before the infection
- CRerun the antivirus scan with higher sensitivity
- DRebuild the OS on the machine
How the community answered
(37 responses)- A57% (21)
- B27% (10)
- C5% (2)
- D11% (4)
Explanation
The hosts file is a local text file (located at C:\Windows\System32\drivers\etc\hosts on Windows) that maps hostnames to IP addresses, overriding DNS resolution. Malware commonly modifies this file to redirect specific domains to a malicious IP address, even after antivirus scanning removes the core infection. Because some sites are still redirecting after the antivirus scan-yet the AV correctly blocks the destination-the redirect logic itself (in the hosts file) likely remains. System Restore was disabled (ruling out B), rerunning the scan (C) would not address a plain-text file modification, and a full OS rebuild (D) is premature before checking this simple file.
Topics
Community Discussion
No community discussion yet for this question.