Sign up ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

When I am pinging non-existing host like 'zzz' or 'qwerty'

I am getting the following result

Pinging [] with 32 bytes of data:

Reply from bytes=32 time=60ms TTL=46
Reply from bytes=32 time=66ms TTL=46

It looks like a virus to me. But I was unable to find a solution on web. Any ideas how to fix it?

Even more ridiculous results with nslookup

C:\> nslookup

Non-authoritative answer:

How to get rid of it?

share|improve this question

3 Answers 3

There is a wildcard DNS entry for * which points at that IP. That means that even if there is no website hosted for that subdomain, all non-explicitly defined entries for that domain point to, which, apparently, responds to ICMP ECHO requests.

share|improve this answer
Sounds like exact answer to me. I wonder how I can fix it. I cannot reproduce it on my second laptop so I guess it is local issue. – bublegumm May 8 '10 at 14:35
IF you have "" set as a search domain in your network connection preferences, anything you ping from that one location that isn't fully qualified will append to the end. – MDMarra May 8 '10 at 16:44

You will be interested to notice that I get similar results too :-)

$ ping
PING ( 56 data bytes
64 bytes from icmp_seq=0 ttl=57 time=390 ms


  1. resolves the same way for all
    Nothing special in resolving to for you
  2. But, why does zzz get converted to for you?
    That means, you have as your local domain name.
    Is that expected? If so, ping abc would also look for
    And, resolve to the same IP (wildcard DNS as MarkM explains).

So, the real question becomes: Is your default domain name?

share|improve this answer
No, it is not my domain name. Although I am not sure what default in this context means. – bublegumm May 8 '10 at 14:36
@bublegumm, see the default search domain, in your network preferences, Advanced, DNS, like here. – Arjan May 8 '10 at 16:32
up vote 0 down vote accepted

For name lookup, the DNS client uses DNS Suffixes which can be changed here for Windows XP:

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\DNSClient\SearchList
share|improve this answer
Aha, I somehow thought your were on a Mac. I'm sure there is some "Advanced" setting in some dialog for that on Windows as well. – Arjan May 8 '10 at 17:12

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.