0

I recently had a 'redirect virus' while I was logged in as administrator. Every time I would query something in a search engine, I was redirected to domaindiscount24.com. After a virus cleanup everything resumed to normal. Until I noticed nslookup.exe returning wrong ip addresses:

nslookup google.com:
    Non-authoritative answer:
    Name:    google.com.domain.name
    Addresses:  213.128.138.236
               109.234.109.20
              109.234.109.21

nslookup yahoo.com:
    Non-authoritative answer:
    Name:    yahoo.com.domain.name
    Addresses: 109.234.109.21
              213.128.138.236
             109.234.109.20

Every time I nslookup a domain name, I get these same ip addresses, which point to domaindiscount24.com. Is my dns server(modem/router) poisoned? Or the addresses are mere records from the redirect virus earlier?

=========================** EDIT **===============================

Here is an odd output from the command prompt:

6
  • 1
    Try ipconfig /flushdns That will clear the DNS cache. Jan 14, 2012 at 3:45
  • It doesn't work. Some free software might have configured my dns settings. I remember getting a correct ip address from nslookup along with the two ip addresses (109.234.109.21 and ...20) but after that all nslookup queries returns the above addresses.
    – WikiWitz
    Jan 14, 2012 at 3:58
  • What is your DNS setting? try setting your DNS manually to OpenDNS 208.67.222.222 , 208.67.220.220 . The try ipconfig /flushdns again
    – chmod
    Jan 14, 2012 at 4:28
  • Setting it manually to opendns doesn't work.
    – WikiWitz
    Jan 14, 2012 at 14:41
  • This type of action can be caused by a hacked nslookup.exe file also... It's happened to me before and i was able to fix it by copying a clean nslookup.exe file from a clean system. That could be a solution for you, too.. Jan 18, 2012 at 0:58

4 Answers 4

5

You have (somehow) Primary DNS suffix or Connection-specific DNS Suffix defined and enable to add in TCP/IP settings

Check with ipconfig /all. Reconfigure (if needed) - Network Connection - Used connection (or interface)

enter image description here

3
  • 1
    What are you saying? Like my settings should be the same with this image? I added an image above for you to check in case that helps.
    – WikiWitz
    Jan 14, 2012 at 14:27
  • @mywiki-witwiki - no, just show dialogue for you (from XP, BTW). Your scrrensots show: 1. You have DNS suffix search list, 2. This domain added to all hostnames, I haven't Win7 now to find, where search list defined and how to remove it Jan 14, 2012 at 16:07
  • I don't think the Primary DNS Suffixing is the culprit. I successfully disabled it in the Group Policies but nslookup still returns the wrong IP addresses.
    – WikiWitz
    Jan 15, 2012 at 7:56
1

If neither of the "ipconfig" or checking DNS settings works, you might find that the "virus" has created you a nice big Hosts file - look in %systemroot%\system32\drivers\etc (e.g. C:\Windows\system32\drivers\etc).

There should be a file called "Hosts" (not Hosts.txt). Open the file in Notepad. Alternative go to Start, Run and type in:

notepad %systemroot%\system32\drivers\etc\hosts

If you're just a home user, you shouldn't have more than a couple of entries in the file (you'll probably only need "localhost 127.0.0.1").

4
  • Actually, I was just playing around with the hosts file a few days ago and nope there were nothing there other than comments.
    – WikiWitz
    Jan 14, 2012 at 14:06
  • Why the downmark on the answer? Jan 18, 2012 at 0:07
  • Me? I didn't do that.
    – WikiWitz
    Jan 18, 2012 at 7:29
  • Sorry, I wasn't blaming you - just asking whoever downvoted my answer why they did it. Jan 19, 2012 at 7:32
0

A similar issue happened to a client of mine today. Only Google related sites and Bing.com was being redirected to a viral page, which the antivirus blocked.

Things that I noticed was "bad" were:

  • %windir%\system32\drivers\etc\hosts was hidden and read-only so I deleted it and replaced it with a file with a single line which read: 127.0.0.1 localhost

  • checked the DNS settings and everything was correct

  • ran TCPVIEW and did not find any extra open ports or ports in LISTEN states.

  • ran MalwareBytes and it found nothing

Resetting Internet Explorer to default settings did not help. Installed Firefox, and still the same thing.

Ended up doing a System Restore to a week ago and it worked (for now at least).

However, I am very curious where the real cause of this is so that we can block future similar spyware.

-1

Try this:

http://public.madeinengland.co.nz/nslookup-shows-the-wrong-dns-server/

Basically, the DNSClient is storing the wrong IP and the NIC settings are being overwritten. The above link will fix your DNS issues.

1
  • 1
    Link-only answers are a no-no due to possible future link rot. please include pertinent information in your answer. Dec 9, 2012 at 23:19

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .