Long story short, my daughter installed Hola VPN earlier this year to get around some blocks on her school network and in our home network. I removed it and started using OpenDNS as a stop gap to block access for proxy/economizers and some specific sites while looking for other security measures to install. OpenDNS is doing its job blocking the sites, but recently I got a warning on the OpenDNS dashboard "Malware/Botnet Activity Detected In Last 30 Days". Looking back over the logs I see on one particular day lots of requests (blocked) to resolve client.hola.org, perr.hola.org, and a lot of zagent###.hola.org (where ### are different numbers.) Other days (but not everyday) I see hola.org resolution being requested. I've got no idea where this is coming from because I cannot find Hola installed anywhere on the laptops or phones in our house. I tried Wireshark to do some DNS analysis but unfortunately my laptop (Windows) does not have the capability to do a proper promiscuous mode to get DNS requests from all the devices on the network.
Download –––––>>> https://t.co/EJ4udYoDSc
I just took a look at their site and apparently they offer not only a desktop application, but also browser addons/extensions for most web browsers so you might check the addons/extensions of any installed browsers. Also keep in mind that if your daughter uses Google Sync in Chrome, she could easily sign in to Chrome to get her preferred extensions installed automatically, then sign out to instantly remove them. Additionally, if she uses a portable build of any browser such any of those that are based on Chromium (such as SRWare Iron), she could keep it on a flash drive with the extension/addon for the VPN installed enabling her to use it without having to install anything on the system itself.
In the meantime, you could try blocking access to the VPN's servers/login page through the Windows Firewall with Advanced Security or by blacklisting them through your router or modem if it allows it (some do, some don't, depending on the features of the firmware/software installed on the router/modem).
Beyond that, if you suspect the system might be infected or simply want a set of experienced and knowledgeable eyes to take a look and see if they might be able to determine the source of the connections for you, please follow the instructions in this topic then create a new topic in our malware removal area by clicking here and a malware removal specialist will guide you in checking and cleaning your system of any threats and hopefully hunting down and stopping the source of the VPN connections. You don't have to do so of course, and if you'd rather continue in this thread to see if anyone else has any ideas you are certainly welcome to do so.
Thank you Exile, I appreciate the suggestions. The browser add on (Chrome) is what she installed at first and then later their phone app (Android). And I did in fact have to untangle it from Google sync (it kept reinstalling itself) too which was a pain but eventually I made sure it was removed from her profile. When I check her devices I look at the history to see if anything was installed and I jump into "Developer Mode" to do an update to see if it brings anything down from her syned profile. I'll keep in mind the flash drive. I haven't noticed her having one, but doesn't hurt to keep an eye out.
Regarding the modem, I'll check into them. For the router, I'm using Eero and they claim that they are working on a blacklist function to deliver later this year, but I'm getting tired of waiting so I may end up dropping and getting something with better security features or adding Circle to the mix. OpenDNS is a stop gap but it's easy to get around it. My daughter has shown herself to be a lot more tech savvy than I expected!
By the way, take a look around the drive for any portable copies of Chrome as well; it doesn't have to be on a flash drive, it just has to be somewhere you haven't/aren't likely to look (though I'd start in the most obvious locations such as the Downloads folder and the user's Documents folder etc. because people can be lazy too, and she might be underestimating you).
If you prefer not to opt into our resource-sharing community, you can enjoy Hola Premium through a paid subscription. Hola Premium subscribers get unlimited watch time with the Opera addon and use Hola VPN on mobile, TV, and other devices. You can also opt-out by removing the extension.
- AllHosts/WebRequest/WebRequestBlocking: Let Hola VPN Add-On check every web request and modify it. Hola VPN is the fastest unblocker because it uses split-tunneling technology and only proxy the minimum number of web requests needed to unblock a site.
It looks like you're using an ad blocker, so you'll have to wait 15 more sec.
Hide ads with Premium to skip the wait and help us pay for bandwidth, hosting, and other bills.
Or please add this site to your allowlist (AdBlock Plus,uBlock Origin)
* Your use of Hola Free VPN Proxy is free of charge in exchange for safely using
some of your device's resources (WiFi and very limited cellular data), and only
when you are not using your device. You may turn this off by becoming a premium user. Please see our TOS for further information. hola.org/legal/sla/#automatic_route
Technical architecture: HolaVPN Proxy Unblocker is a split-tunneling proxy, built to unblock web sites without slowing them down. It works by sending only the minimal required information through a tunnel, and the rest is sent directly, for fastest unblocking. To enjoy a full privacy VPN, use HolaVPN Plus.
How do we use your information?
We use your information in order to provide you with the Service. This means
that we will use the information to set up your account, provide you with
support regarding the Service, communicate with you for updates, marketing
offers or concerns you may have and conduct statistical and analytical research
to improve the Service.
Information we share
We do not rent or sell any Personal Information. We may disclose Personal
Information to other trusted third party service providers or partners for the
purposes of providing you with the Services, storage and analytics. We may also
transfer or disclose Personal Information to our subsidiaries, affiliated companies.