Tons of AdServers/spyware in DNS

[egnilk66]

I just opened up the DNS server at one of our remote Brick/Mortar sites, the entries are full of Ad/Spam sites...

The Router/Firewall is using the ISP's DNS servers and the LAN workstations all use an internal DNS. I don't get it... then again, I'm no DNS guru.

 

[egnilk66]

The entries were in the Cached Lookups. I am now wondering what the possible issues are that could be causing this... Tons of spyware trying to reach it's home?? I hate spyware!

 

[5jgibbs]

well.. if they are in your cashed lookups.. and your computer is not infected.. someone’s computer prob is.. and every time a user goes to access the internet, to used your DNS, so forward the query to a DNS server that can resolve a host name to a IP.. so it cashes that link..

so if a user has spiwear, and that spiwear is trying to access the internet.. that prob what your seeing..

i would install spybot on every computer on the network.. to make sure your good..

 

[egnilk66]

Those are exactly the thoughts that I had. Thanks for the input.


DJK

 

[aftertaf]

and..................
what you could also do is make a copy of all these hostnames

add the zones to your dns server and the ip address 127.0.0.1
that way they'll never be resolved again ;-)

Aftertaf

"Solutions are not the answer." - Richard Nixon

 

[egnilk66]

What kind of overhead does that create?

 

[egnilk66]

And....How do i add them? Do I add them as Host files in the forward look up?

 

[5jgibbs]

add them as a forward lookup hence the name.. it will look at the host name of say.. hotbot.com and when you change the ip from 69.169.34.125 to 127.0.0.1 it will not find anything.. except a local host page..

also.. if you have an webpage.. you can have it jump to that by putting the IP of your organizations webpage in there..

 

[5jgibbs]

NONO.. wait.. you want to creat a HOST A file.. i think lol.. i am brain dead right now..sorry.. lol

 

[anawrocki]

html spam that "calls home" can cause these has well.

 

[5jgibbs]

wait.. now i am confused..YA.. how do you do that.. i need a mem refresher lol

 

[egnilk66]

Ok perfect, no I am thoroughly confused.

 

[5jgibbs]

ya.. so am i lol.. i am trying to figure it out.. i have done it before..