Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I recently had a 'redirect virus' while I was logged in as administrator. Every time I would query something in a search engine, I was redirected to After a virus cleanup everything resumed to normal. Until I noticed nslookup.exe returning wrong ip addresses:

    Non-authoritative answer:

    Non-authoritative answer:

Every time I nslookup a domain name, I get these same ip addresses, which point to Is my dns server(modem/router) poisoned? Or the addresses are mere records from the redirect virus earlier?

=========================** EDIT **===============================

Here is an odd output from the command prompt:

share|improve this question

migrated from Jan 14 '12 at 3:55

This question came from our site for system and network administrators.

Try ipconfig /flushdns That will clear the DNS cache. – Andrew Lambert Jan 14 '12 at 3:45
It doesn't work. Some free software might have configured my dns settings. I remember getting a correct ip address from nslookup along with the two ip addresses ( and ...20) but after that all nslookup queries returns the above addresses. – WikiWitz Jan 14 '12 at 3:58
What is your DNS setting? try setting your DNS manually to OpenDNS , . The try ipconfig /flushdns again – chmod Jan 14 '12 at 4:28
Setting it manually to opendns doesn't work. – WikiWitz Jan 14 '12 at 14:41
This type of action can be caused by a hacked nslookup.exe file also... It's happened to me before and i was able to fix it by copying a clean nslookup.exe file from a clean system. That could be a solution for you, too.. – The_aLiEn Jan 18 '12 at 0:58
up vote 5 down vote accepted

You have (somehow) Primary DNS suffix or Connection-specific DNS Suffix defined and enable to add in TCP/IP settings

Check with ipconfig /all. Reconfigure (if needed) - Network Connection - Used connection (or interface)

enter image description here

share|improve this answer
What are you saying? Like my settings should be the same with this image? I added an image above for you to check in case that helps. – WikiWitz Jan 14 '12 at 14:27
@mywiki-witwiki - no, just show dialogue for you (from XP, BTW). Your scrrensots show: 1. You have DNS suffix search list, 2. This domain added to all hostnames, I haven't Win7 now to find, where search list defined and how to remove it – Lazy Badger Jan 14 '12 at 16:07
I don't think the Primary DNS Suffixing is the culprit. I successfully disabled it in the Group Policies but nslookup still returns the wrong IP addresses. – WikiWitz Jan 15 '12 at 7:56

If neither of the "ipconfig" or checking DNS settings works, you might find that the "virus" has created you a nice big Hosts file - look in %systemroot%\system32\drivers\etc (e.g. C:\Windows\system32\drivers\etc).

There should be a file called "Hosts" (not Hosts.txt). Open the file in Notepad. Alternative go to Start, Run and type in:

notepad %systemroot%\system32\drivers\etc\hosts

If you're just a home user, you shouldn't have more than a couple of entries in the file (you'll probably only need "localhost").

share|improve this answer
Actually, I was just playing around with the hosts file a few days ago and nope there were nothing there other than comments. – WikiWitz Jan 14 '12 at 14:06
Why the downmark on the answer? – misterjaytee Jan 18 '12 at 0:07
Me? I didn't do that. – WikiWitz Jan 18 '12 at 7:29
Sorry, I wasn't blaming you - just asking whoever downvoted my answer why they did it. – misterjaytee Jan 19 '12 at 7:32

A similar issue happened to a client of mine today. Only Google related sites and was being redirected to a viral page, which the antivirus blocked.

Things that I noticed was "bad" were:

  • %windir%\system32\drivers\etc\hosts was hidden and read-only so I deleted it and replaced it with a file with a single line which read: localhost

  • checked the DNS settings and everything was correct

  • ran TCPVIEW and did not find any extra open ports or ports in LISTEN states.

  • ran MalwareBytes and it found nothing

Resetting Internet Explorer to default settings did not help. Installed Firefox, and still the same thing.

Ended up doing a System Restore to a week ago and it worked (for now at least).

However, I am very curious where the real cause of this is so that we can block future similar spyware.

share|improve this answer

Try this:

Basically, the DNSClient is storing the wrong IP and the NIC settings are being overwritten. The above link will fix your DNS issues.

share|improve this answer
Link-only answers are a no-no due to possible future link rot. please include pertinent information in your answer. – Ƭᴇcʜιᴇ007 Dec 9 '12 at 23:19

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .