220-1002 · Question #854
A user contacts a technician to report issues with unwanted pop-ups appearing on a computer. Additionally, when the user types a search term into the browser, the user is taken to an unexpected…
The correct answer is A. Verify any modifications to the hosts file. Unwanted pop-ups and unexpected search engine redirects on a single machine, despite a correct DNS server, point to a locally modified hosts file that is overriding DNS resolution.
Question
A user contacts a technician to report issues with unwanted pop-ups appearing on a computer. Additionally, when the user types a search term into the browser, the user is taken to an unexpected search engine. The technician checks the IP configuration of the computer and determines the DNS is set to 8.8.8.8. Which of the following should the technician perform to determine the cause of the unwanted behavior?
Options
- AVerify any modifications to the hosts file.
- BFlush the DNS records.
- CInstall a software-based IDS.
- DChange to a different DNS server.
How the community answered
(31 responses)- A77% (24)
- B13% (4)
- C3% (1)
- D6% (2)
Why each option
Unwanted pop-ups and unexpected search engine redirects on a single machine, despite a correct DNS server, point to a locally modified hosts file that is overriding DNS resolution.
The hosts file is a local system file that takes precedence over DNS queries for name resolution; malware often modifies it to redirect specific domains to malicious IP addresses. Because the DNS server (8.8.8.8) is valid, the issue is not upstream but local. Checking the hosts file for unauthorized entries directly identifies the source of the redirect and pop-up behavior.
Flushing the DNS cache removes cached lookups but does not affect entries in the hosts file, which are applied before any DNS query is made.
Installing a software-based IDS monitors for intrusions going forward but does not identify or remediate an already-modified hosts file causing current redirects.
Changing the DNS server has no effect when the redirection is caused by local hosts file entries that bypass DNS entirely.
Concept tested: Hosts file modification as a malware redirect vector
Source: https://support.microsoft.com/en-us/topic/how-to-reset-the-hosts-file-back-to-the-default-c2a43f9d-e176-c6f3-e4ef-3500277a6dae
Topics
Community Discussion
No community discussion yet for this question.