Intenet searches redirected

There are some (more) nasty malware/adware/spyware bits around now that take over your hosts file. This is the file that your computer looks at _before_ it checks your DNS for the address of the website you want to go to.

We’ve seen the hosts file perverted in two ways.

1) A proxy was also loaded and the hosts file was filled with Windows’ default search sites but the address for them set at 127.0.0.1 (your computer) so that the running proxy could re-direct your requests.

2) The hosts file was populated with Windows’ default search sites, but the addresses were written in a non-IP format that could then be calculated back to a useable IP address by the malware to re-direct your search. In this form, the hosts file was also write-protected, so you have to un-write protect it before making any corrections.

If you notice trouble getting to search sites or getting to some Internet sites or getting to the Internet at all, malware/adware/spyware bits in your hosts file are one more area to look at while debugging…

Bleh!