Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I recently had a 'redirect virus' while I was logged in as administrator. Every time I would query something in a search engine, I was redirected to domaindiscount24.com. After a virus cleanup everything resumed to normal. Until I noticed nslookup.exe returning wrong ip addresses:

nslookup google.com:
    Non-authoritative answer:
    Name:    google.com.domain.name
    Addresses:  213.128.138.236
               109.234.109.20
              109.234.109.21

nslookup yahoo.com:
    Non-authoritative answer:
    Name:    yahoo.com.domain.name
    Addresses: 109.234.109.21
              213.128.138.236
             109.234.109.20

Every time I nslookup a domain name, I get these same ip addresses, which point to domaindiscount24.com. Is my dns server(modem/router) poisoned? Or the addresses are mere records from the redirect virus earlier?

=========================** EDIT **===============================

Here is an odd output from the command prompt:

share|improve this question

migrated from serverfault.com Jan 14 '12 at 3:55

This question came from our site for system and network administrators.

1  
Try ipconfig /flushdns That will clear the DNS cache. – Andrew Lambert Jan 14 '12 at 3:45
    
It doesn't work. Some free software might have configured my dns settings. I remember getting a correct ip address from nslookup along with the two ip addresses (109.234.109.21 and ...20) but after that all nslookup queries returns the above addresses. – WikiWitz Jan 14 '12 at 3:58
    
What is your DNS setting? try setting your DNS manually to OpenDNS 208.67.222.222 , 208.67.220.220 . The try ipconfig /flushdns again – chmod Jan 14 '12 at 4:28
    
Setting it manually to opendns doesn't work. – WikiWitz Jan 14 '12 at 14:41
    
This type of action can be caused by a hacked nslookup.exe file also... It's happened to me before and i was able to fix it by copying a clean nslookup.exe file from a clean system. That could be a solution for you, too.. – The_aLiEn Jan 18 '12 at 0:58
up vote 5 down vote accepted

You have (somehow) Primary DNS suffix or Connection-specific DNS Suffix defined and enable to add in TCP/IP settings

Check with ipconfig /all. Reconfigure (if needed) - Network Connection - Used connection (or interface)

enter image description here

share|improve this answer
1  
What are you saying? Like my settings should be the same with this image? I added an image above for you to check in case that helps. – WikiWitz Jan 14 '12 at 14:27
    
@mywiki-witwiki - no, just show dialogue for you (from XP, BTW). Your scrrensots show: 1. You have DNS suffix search list, 2. This domain added to all hostnames, I haven't Win7 now to find, where search list defined and how to remove it – Lazy Badger Jan 14 '12 at 16:07
    
I don't think the Primary DNS Suffixing is the culprit. I successfully disabled it in the Group Policies but nslookup still returns the wrong IP addresses. – WikiWitz Jan 15 '12 at 7:56

If neither of the "ipconfig" or checking DNS settings works, you might find that the "virus" has created you a nice big Hosts file - look in %systemroot%\system32\drivers\etc (e.g. C:\Windows\system32\drivers\etc).

There should be a file called "Hosts" (not Hosts.txt). Open the file in Notepad. Alternative go to Start, Run and type in:

notepad %systemroot%\system32\drivers\etc\hosts

If you're just a home user, you shouldn't have more than a couple of entries in the file (you'll probably only need "localhost 127.0.0.1").

share|improve this answer
    
Actually, I was just playing around with the hosts file a few days ago and nope there were nothing there other than comments. – WikiWitz Jan 14 '12 at 14:06
    
Why the downmark on the answer? – misterjaytee Jan 18 '12 at 0:07
    
Me? I didn't do that. – WikiWitz Jan 18 '12 at 7:29
    
Sorry, I wasn't blaming you - just asking whoever downvoted my answer why they did it. – misterjaytee Jan 19 '12 at 7:32

A similar issue happened to a client of mine today. Only Google related sites and Bing.com was being redirected to a viral page, which the antivirus blocked.

Things that I noticed was "bad" were:

  • %windir%\system32\drivers\etc\hosts was hidden and read-only so I deleted it and replaced it with a file with a single line which read: 127.0.0.1 localhost

  • checked the DNS settings and everything was correct

  • ran TCPVIEW and did not find any extra open ports or ports in LISTEN states.

  • ran MalwareBytes and it found nothing

Resetting Internet Explorer to default settings did not help. Installed Firefox, and still the same thing.

Ended up doing a System Restore to a week ago and it worked (for now at least).

However, I am very curious where the real cause of this is so that we can block future similar spyware.

share|improve this answer

Try this:

http://public.madeinengland.co.nz/nslookup-shows-the-wrong-dns-server/

Basically, the DNSClient is storing the wrong IP and the NIC settings are being overwritten. The above link will fix your DNS issues.

share|improve this answer
1  
Link-only answers are a no-no due to possible future link rot. please include pertinent information in your answer. – Ƭᴇcʜιᴇ007 Dec 9 '12 at 23:19

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .