2

I opened my %WINDIR%\system32\drivers\etc\hosts file & I found the following entries there

0.0.0.0 gx7ekbenv2riucmf.onion
0.0.0.0 57g7spgrzlojinas.onion
0.0.0.0 Xxlvbrloxvriy2c5.onion
0.0.0.0 76jdd2ir2embyv47.onion
0.0.0.0 cwwnhwhlz52maqm7.onion
0.0.0.0 sqjolphimrr7jqw6.onion

Now, I open my hosts file quite frequently & this is the first time I have seen this. So this is quite recent.

Googling, I found that this has something to do with TOR. Now, I have never installed TOR on my machine, so how did I get these entries in my hosts file - is it some malware which has added this?

user93353
  • 1,982
  • 3
  • 19
  • 33
  • 1
    It does look like something has 'infected' your machine/hosts file. Have you tried removing them, rebooting, and seeing if they are back again? If they are then something is still active on your machine. It does like you may have been compromised though. – ISMSDEV Jul 10 '17 at 11:53

1 Answers1

6

I googled the first onion address and found this: https://blog.cyren.com/articles/wannacrypt-ransomware-spreads-via-nsa-exploit

Those are WannaCry command and control servers. It appears that some protection technology is blocking WannaCry from downloading to your computer (by setting 0.0.0.0 as the destination).

schroeder
  • 123,438
  • 55
  • 284
  • 319
  • 5
    No, this entries will **prevent** WannaCry to reach the C&C servers. See if your antivirus/antimalware can change the hosts file. If so, they are likely protecting you. – ThoriumBR Jul 10 '17 at 12:38
  • 2
    @ThoriumBR yes, you are correct! I missed the address... – schroeder Jul 10 '17 at 12:57