CHECK TO SEE IF YOUR
BROWSER HAS BEEN HIJACKED
Using Internet Explorer, run a
Google search for "antivirus". The top search results
usually include sites like free.avg.com ,
www.avast.com , www.mcafee.com ,
and www.kaspersky.com . Click to
visit some of these sites. If your computer is infected with browser
redirect malware, you will instead be redirected to
other strange sites that have nothing to do with these sites. Below are
the REAL sites....
Your computer may be
infected with a dangerous virus without you even knowing. Some
viruses run in the "background" as hidden processes. For example the
Trojan "Spy Eye" attempts to connect to the Internet then sends your
usernames, passwords, and other critical personal information to a
remote computer on the Internet.
In this case, I physically
disconnected the Ethernet cable from the computer. Each time the
virus attempted to connect to the Internet a Windows 7 error message
popped up (because I cut off the Internet connection). Under normal
circumstances, even with the Ethernet cable connected, this error
message should not appear. The logical explanation is a virus...
With the Ethernet cable
reconnected I was able to use the program TCPView to see hidden
processes related to network connectivity. A suspect connection to
ikexpress.com is identified below...
A who is search reveals that
ikexpress is a server hosted in France of all places! The computer
was sitting idle so there was NO reason for it to be contacting an
ipaddress in Europe. So this was
obviously surreptitious activity...
Has your hosts file been changed?
Generally there are
only two reasons why the "hosts" file on your computer would
not display the normal default text (shown below). Either
the company you work for changed the "hosts" file in order
to restrict which websites employees visit, or a virus has
altered this file.
It is VERY common that
viruses alter the "hosts" file, so lets see if your hosts
file has been altered by navigating to its folder
location....
C:/Windows/System32/Drivers/etc/Hosts
Open and view the
"hosts" file with wordpad or other document viewing
program...
BELOW:
A "normal" looking hosts file....
#
Copyright (c) 1993-1999 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for
Windows.
#
# This file contains the mappings of IP addresses to host
names. Each
# entry should be kept on an individual line. The IP address
should
# be placed in the first column followed by the
corresponding host name.
# The IP address and the host name should be separated by at
least one
# space.
#
# Additionally, comments (such as these) may be inserted on
individual
# lines or following the machine name denoted by a '#'
symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host
127.0.0.1 localhost
An infected "hosts"
file would have all sorts of strange web addresses listed
below the last line of text.
There are normally 5
files located in the "etc" folder, namely hosts, imhosts,
networks, protocal, services. If you can't even see a
"hosts" file in the "etc" folder this could very likely be
due to a virus infection. If Windows prevents you from
opening the "hosts" file then this is often also a sign of
virus infection.
PREVENTION:
Don't get
caught by "fake alert" web pages...
According to Mark
Hofman of SANS Internet Storm Center, there are over 52,000 infected
websites out there trying to install executable files and other
malicious code. Most attacks use components which are often hidden
from visitors' eyes, aiming to redirect people to other more
dangerous pages.
BELOW: This is a
common "fake alert" web page that you may have stumbled upon. It appears to be part of the
Windows operating system, but it is not! It tries to lure the user
into clicking the "X", "cancel" or "remove all".
DO NOT click EITHER one! Clicking either of these
will prompt you to download and install a virus.
Note the multiple
grammatical errors, poor diction and just plain fishy language, a sure sign of a hoax.
Fortunately most viruses are written in countries such as
Russia where English is not the main language....
BELOW: You need to exit this web
page by simultaneously pressing the Ctrl + Alt + Delete
keys (or Ctrl + Shift + Esc), then closing out your browser by selecting it and
clicking "end task". Some browsers, such as
Firefox, may revisit
the same malicious web site when you re-launch the browser. To counteract this
you can try unplugging your Ethernet cable until you can navigate away from the
page.
The newest way that the bad guys are able to install
viruses on your computer is to trick you into thinking that a video on a web
page won't play because you don't have the proper player or plug-in installed on
your computer.
BELOW: This is an actual snapshot of a webpage that
had a link to a virus. It looks like a QuickTime or Flash movie, but
actually it's just a picture with a link to an exe file that launches a
virus. Also note the fake claims of "78,695 views" which is used to try to gain
your trust...
If you click the play button, you are asked if
you want to install a supposed "video plugin". Be
very suspicious if you are already able to play videos on YouTube without any problem.
Note below that "exonlinedata" is obviously not Macromedia (Flash), Quick Time, Windows media player, VLC media player or any other familiar name. If you click the "Run" button, a virus will install on your computer...
If the video doesn't play automatically
when you click to "play" it, then be cautious even if it's a
legitimate site. Sometimes the bad guys create web pages that mimic
real websites such as YouTube, Facebook, MySpace, etc. When in doubt go to the REAL
media player download site, such as Adobe's
Flash site...
http://get.adobe.com/flashplayer/
Other signs of virus infection:
Does your computer run external drives at constant
intervals? One current virus attempts to run external drives every 11 seconds as
soon as a browser is launched.
