hosts file not loading & dnscache problems

[sean2e]

Hi all,

Suddenly yesterday without warning my hosts file entries stoped working. I am on a W2K sp4 workstation. This is what I have discovered so far:

1. hosts file has not changed.
2. ipconfig /flushdns is successful does not re-load the hsot file
3. ipconfig /displaydns shows tons on entries even after the flush. I can't count how many as the DOS window just keeps scrolling.
4. hosts file entries don't seem appear in the dnscache.
5. dnschache entries contain sites I've never been tto

My guess is that my machine is loading it's own dnschache from a server somewhere, or it is being pushed down. ANy thought?

Thanks,
Sean

 

[GlenJohnson]

What does ipconfig /all show now? Anything in the event logs? Something changed, so we need to figure out what. Good luck.

Glen A. Johnson
"To fear the worst oft cures the worse."
William Shakespeare (1564-1616); English dramatist, poet.

Want to get great answers to your Tek-Tips questions? Have a look at FAQ219-2884

 

[sean2e]

DOH! I got infected with a trojan that changed my registry and uses it's own hosts file!

http://us.mcafee.com/virusInfo/default.asp?id=description&virus_k=100719

I have Anti-virus, but was most likely not up to DAT when I was infected Oct 1.

Well I saw nothing in the event viewer, I had noticed strange entries for DNS servers, but I had switched to obtain DNS auto. Luckly I had saved the offending DNS server to text file. I may not have noticed I was infected with a trojan but my proxy server blocked access to the baad DNS servers, and I rely on my hosts file.

Everyhtings seems fine. Now I need to find what website had the Trojan in it's vbscript.

 

[GlenJohnson]

Glad you got it figured out. Good luck.

Glen A. Johnson
"To fear the worst oft cures the worse."
William Shakespeare (1564-1616); English dramatist, poet.

Want to get great answers to your Tek-Tips questions? Have a look at FAQ219-2884