220-802 · Question #209
A customer states that another technician just removed some viruses and now they are not able to connect to websites such as Windows Update, but are able to connect to others. Which of the following…
The correct answer is D. Host file has been manipulated. Malware commonly modifies the Windows hosts file to block or redirect traffic to security-related domains like Windows Update, and this manipulation often persists even after the virus files themselves are removed.
Question
A customer states that another technician just removed some viruses and now they are not able to connect to websites such as Windows Update, but are able to connect to others. Which of the following is the MOST likely cause of the issue?
Options
- ANIC driver is damaged
- BNot all viruses have been fixed
- CInternet Explorer cache is full
- DHost file has been manipulated
How the community answered
(34 responses)- A15% (5)
- B3% (1)
- C9% (3)
- D74% (25)
Why each option
Malware commonly modifies the Windows hosts file to block or redirect traffic to security-related domains like Windows Update, and this manipulation often persists even after the virus files themselves are removed.
A damaged NIC driver would cause a complete loss of network connectivity, not selective inability to reach specific sites like Windows Update.
While possible, 'not all viruses fixed' is a generic answer - the specific symptom of only certain sites being unreachable most precisely points to hosts file manipulation rather than active malware.
A full Internet Explorer cache would cause performance issues or display stale content, but would not prevent connectivity to specific websites like Windows Update.
The Windows hosts file (located at C:\Windows\System32\drivers\etc\hosts) is a local DNS override file that maps hostnames to IP addresses before any DNS query is made. Viruses and malware frequently add entries to this file to redirect update and security sites to invalid or localhost addresses, blocking access to those specific domains. Even after the virus executable is removed, the hosts file entries remain until manually corrected, which explains why only specific sites like Windows Update are unreachable while others work normally.
Concept tested: Malware hosts file manipulation blocking specific domains
Source: https://support.microsoft.com/en-us/topic/how-to-reset-the-hosts-file-back-to-the-default-c2a43f9d-e176-c6f3-e4ef-3500277a6dae
Topics
Community Discussion
No community discussion yet for this question.