To preface this, I'd just like to let you know that I'd consider myself an intermediate security guy(Definitely not a novice, not yet an expert) I do have a story to tell, and would like to know if you guys have any ideas as of what happened.
1. The call My friend received a call today(From his supposed credit card company) , that his credit card was charged three days ago on eBay for the amounts of $1, $10, and $40 dollars. He responded to the call right away (He did not give away any personal information about the card or himself, he just gave his address to verify himself and the woman on the phone simply asked him if he had completed the purchases or not.) He of course said that he did not authorize those purchases. He then asked me if I could see why his computer could not access eBay.com.
2. eBay.com Typing eBay.com into Chrome was giving him a page not found error(he could access every other website.) He tried on his sons laptop and he could log in just fine. The first thing I did was go to his hosts file. To my surprise (for the first time) there were additional entries in it. There was a list about 30 lines long of eBay domains/sub-domains that were pointing back to localhost. Real fishy.
3. My advice He told me that he doesn't believe that his credit card was on file with eBay or PayPal so he didn't know how they could get that information. My advice was to change all of his account passwords and to keep track of his billing statements. I also got rid of all of the eBay hosts file entries to give him a clean slate.
4. How? How could this have happened? Just trying to overwrite the hosts file in Windows 7 is a pain. Having to go through Administrative access and all. I told him that it was possibly a phishing attack. I don't know how they got to his hosts file though. All of the hosts file entries were somehow only involving "eBay" and no other retailers. Coincidence? I think not.
5. His setup, and my question He has a simple i3 Asus laptop running Windows 7 (I did a clean install when he purchased it 3 weeks ago.) All he uses the laptop for is the internet. Clean Win 7, Google Chrome, and Microsoft Security Essentials with real-time protection turned on. Nothing else. How could this have happened? I'm really clueless. Any feedback is welcome.