bm.kkwen66.cn

I dont know how This virus attacked my PC on the first place. But, one day, when Firefox started to crash in regular fashion, I found that, every site I browse from FF, the browser sends some request to "bm.kkwen66.cn". Fishy. Even, when I visit google.com, browser communicates with "bm.kkwen66.cn".

My collegue (who's pc is also infected) reported me that, while visiting gmail, chrome prevented him. Saying that the site "bm.kkwen66.cn" is malicious. So, while accessing gmail, in background, browser was communicating with this site! (and chrome is affected too)

Antiviruses could do nothing. So, what I did is simple. I downloaded ghostwall (a free firewall for windows)

Then, I inquired the ip of bm.kkwen66.cn


Then, in ghostwall, I blocked all traffic to and from this IP.
Thats it! I am done. Though, Firefox still tries to communicate with the site, but the firewall blocks. :)



Why used ghostwall? Its free. And, windows build in firewall does not allow you to block specific IP (atleas in XP SP1)

So, if you are experiencing abnormal behaviour in you Firefox, try browsing several sites and keep eyes on you browser statusbar if it is communicating with malicious sites.

P.S.
- In the first screenshot, you see that while pingin to bm.kkwen66.cn, I get destinaton unreachable. Because, by the time I am writing this entry, I have already blocked that site, so ping packets are blocked

- Don't say that the better solution to this is to switching to linux, virus in linux is rare bla bla bla.