Get on-the-go access to the latest insights featured on our
Trustworthy Computing blogs. Several days ago, one of our
customers submitted a sample (SHA1:
fbe71968d4c5399c2906b56d9feadf19a35beb97, detected as
TrojanDropper:Win32/Vundo.L). This trojan hijacks the hosts
“vk.com” and “vkontakte.ru” (both social networking sites in
Russia)and redirects them to 188.8.131.52, but achieves this in
an unusual way. A common method used to hijack a website and
redirect it to a site of the attacker’s choice is to add an
entry in the Windows hosts file located in the
%SystemRoot%\system32\drivers\etc directory. However, when we
open this file on an affected computer, it doesn’t contain any
entries related to “vk.com” and “vkontakte.ru”, as you can see
in the following example: But when we show hidden files, we can
see another “hosts” file. It is hidden, as in the following
example: There are two files with exactly the same name,
“hosts”, in the etc directory! How can this happen? As we know,
it is not possible for a direc