Practical Packet Analysis

The Ghost in Internet Explorer

hauntedbrowser.pcap

This scenario begins with a disturbing call to the help desk from a user on your network named Chad. According to Chad, his computer has recently been host to a demonic possession. Despite his best efforts, the home page on his Internet browser keeps changing itself to point to various weather sites. Even if he manually changes it back to what it should be, his changes are reversed after he reboots his computer. Your goal here is to get to the bottom of this "possession" and to perform an exorcism of the ghosts that have invaded Chad's computer.

What We Know

Chad has been with our company quite a while and we know he does not have a great deal of technical expertise. In fact, he usually does more ...