Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I recently had a 'redirect virus' while I was logged in as administrator. Every time I would query something in a search engine, I was redirected to domaindiscount24.com. After a virus cleanup everything resumed to normal. Until I noticed nslookup.exe returning wrong ip addresses:

nslookup google.com:
    Non-authoritative answer:
    Name:    google.com.domain.name
    Addresses:  213.128.138.236
               109.234.109.20
              109.234.109.21

nslookup yahoo.com:
    Non-authoritative answer:
    Name:    yahoo.com.domain.name
    Addresses: 109.234.109.21
              213.128.138.236
             109.234.109.20

Every time I nslookup a domain name, I get these same ip addresses, which point to domaindiscount24.com. Is my dns server(modem/router) poisoned? Or the addresses are mere records from the redirect virus earlier?

=========================** EDIT **===============================

Here is an odd output from the command prompt:

share|improve this question

migrated from serverfault.com Jan 14 '12 at 3:55

This question came from our site for system and network administrators.

1  
Try ipconfig /flushdns That will clear the DNS cache. –  Andrew Lambert Jan 14 '12 at 3:45
    
It doesn't work. Some free software might have configured my dns settings. I remember getting a correct ip address from nslookup along with the two ip addresses (109.234.109.21 and ...20) but after that all nslookup queries returns the above addresses. –  WikiWitz Jan 14 '12 at 3:58
    
What is your DNS setting? try setting your DNS manually to OpenDNS 208.67.222.222 , 208.67.220.220 . The try ipconfig /flushdns again –  chmod Jan 14 '12 at 4:28
    
Setting it manually to opendns doesn't work. –  WikiWitz Jan 14 '12 at 14:41
    
This type of action can be caused by a hacked nslookup.exe file also... It's happened to me before and i was able to fix it by copying a clean nslookup.exe file from a clean system. That could be a solution for you, too.. –  The_aLiEn Jan 18 '12 at 0:58

4 Answers 4

up vote 5 down vote accepted

You have (somehow) Primary DNS suffix or Connection-specific DNS Suffix defined and enable to add in TCP/IP settings

Check with ipconfig /all. Reconfigure (if needed) - Network Connection - Used connection (or interface)

enter image description here

share|improve this answer
1  
What are you saying? Like my settings should be the same with this image? I added an image above for you to check in case that helps. –  WikiWitz Jan 14 '12 at 14:27
    
@mywiki-witwiki - no, just show dialogue for you (from XP, BTW). Your scrrensots show: 1. You have DNS suffix search list, 2. This domain added to all hostnames, I haven't Win7 now to find, where search list defined and how to remove it –  Lazy Badger Jan 14 '12 at 16:07
    
I don't think the Primary DNS Suffixing is the culprit. I successfully disabled it in the Group Policies but nslookup still returns the wrong IP addresses. –  WikiWitz Jan 15 '12 at 7:56

If neither of the "ipconfig" or checking DNS settings works, you might find that the "virus" has created you a nice big Hosts file - look in %systemroot%\system32\drivers\etc (e.g. C:\Windows\system32\drivers\etc).

There should be a file called "Hosts" (not Hosts.txt). Open the file in Notepad. Alternative go to Start, Run and type in:

notepad %systemroot%\system32\drivers\etc\hosts

If you're just a home user, you shouldn't have more than a couple of entries in the file (you'll probably only need "localhost 127.0.0.1").

share|improve this answer
    
Actually, I was just playing around with the hosts file a few days ago and nope there were nothing there other than comments. –  WikiWitz Jan 14 '12 at 14:06
    
Why the downmark on the answer? –  misterjaytee Jan 18 '12 at 0:07
    
Me? I didn't do that. –  WikiWitz Jan 18 '12 at 7:29
    
Sorry, I wasn't blaming you - just asking whoever downvoted my answer why they did it. –  misterjaytee Jan 19 '12 at 7:32

A similar issue happened to a client of mine today. Only Google related sites and Bing.com was being redirected to a viral page, which the antivirus blocked.

Things that I noticed was "bad" were:

  • %windir%\system32\drivers\etc\hosts was hidden and read-only so I deleted it and replaced it with a file with a single line which read: 127.0.0.1 localhost

  • checked the DNS settings and everything was correct

  • ran TCPVIEW and did not find any extra open ports or ports in LISTEN states.

  • ran MalwareBytes and it found nothing

Resetting Internet Explorer to default settings did not help. Installed Firefox, and still the same thing.

Ended up doing a System Restore to a week ago and it worked (for now at least).

However, I am very curious where the real cause of this is so that we can block future similar spyware.

share|improve this answer

Try this:

http://public.madeinengland.co.nz/nslookup-shows-the-wrong-dns-server/

Basically, the DNSClient is storing the wrong IP and the NIC settings are being overwritten. The above link will fix your DNS issues.

share|improve this answer
1  
Link-only answers are a no-no due to possible future link rot. please include pertinent information in your answer. –  Ƭᴇcʜιᴇ007 Dec 9 '12 at 23:19

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.