220-1002 · Question #846
A user recently had malware removed from a computer, but the user is still experiencing issues with accessing websites. All the websites appear to display the same page. However, when a technician…
The correct answer is B. Verify the user's localhost file. The hosts file (commonly called the 'localhost file', located at C:\Windows\System32\drivers\etc\hosts on Windows) maps hostnames to IP addresses and is checked before DNS. Malware commonly modifies the hosts file to redirect legitimate websites to malicious pages. Since the…
Question
A user recently had malware removed from a computer, but the user is still experiencing issues with accessing websites. All the websites appear to display the same page. However, when a technician attempts to access the same websites from another computer, they display properly. Which of the following should the technician do NEXT?
Options
- ACheck the DNS server for compromise
- BVerify the user's localhost file
- CRequest a new IP address from the DHCP server
- DReboot the user's computer
How the community answered
(35 responses)- A11% (4)
- B80% (28)
- C6% (2)
- D3% (1)
Explanation
The hosts file (commonly called the 'localhost file', located at C:\Windows\System32\drivers\etc\hosts on Windows) maps hostnames to IP addresses and is checked before DNS. Malware commonly modifies the hosts file to redirect legitimate websites to malicious pages. Since the issue is isolated to the user's computer and persists after malware removal, checking and cleaning the hosts file is the logical next step. The DNS server, DHCP, and rebooting would not address a locally-modified hosts file.
Topics
Community Discussion
No community discussion yet for this question.