Faked Host Name - 209.44.111.62

Windows Security Tutorials - Herong's Tutorial Examples

∟Faked Host Name - 209.44.111.62

This section provides some notes on how Antivirus System PRO added entries to C:\WINDOWS\system32\drivers\etc\hosts to link faked host names to its Web site at IP address of 209.44.111.62.

More notes on what I did to remove Antivirus System PRO and related malicious programs.

24. Looking at file, C:\WINDOWS\system32\drivers\etc\hosts. New entries are there:

...
127.0.0.1 localhost
::1 localhost
209.44.111.62 surety.microsoft.com
209.44.111.62 aware-protect.com
209.44.111.62 www.aware-protect.com

25. Deleting all 209.44.111.62 entries from C:\WINDOWS\system32\drivers\etc\hosts.

26. Looking at IP address, 209.44.111.62, on www.whois.ws. It is registered to Netelligent Hosting Services Inc. in Canada:

OrgName:    Netelligent Hosting Services Inc.
OrgID:      NHS-31
Address:    1396 Franklin Drive
City:       Laval
StateProv:  QC
PostalCode: H7W-1K6
Country:    CA

NetRange:   209.44.96.0 - 209.44.127.255
CIDR:       209.44.96.0/19
NetName:    NETEL-ARIN-BLK02
NetHandle:  NET-209-44-96-0-1
Parent:     NET-209-0-0-0-0
NetType:    Direct Allocation
NameServer: NS1.NETELLIGENT.CA
NameServer: NS2.NETELLIGENT.CA
NameServer: NS3.NETELLIGENT.CA
Comment:    
RegDate:    2006-08-01
Updated:    2007-03-20

Some quick conclusions:

Now we know the IP address where Antivirus System PRO is hosted, 209.44.111.62.
The infection added fake host name entries to C:\WINDOWS\system32\drivers\etc\hosts, so that Antivirus System PRO can use nice looking host names like surety.microsoft.com to convince users to visit or download files from its Web site.