strange dns problem

[btj]

I have an XP workstation that will not resolve the IP
addresses of search engines correctly. For example I
can't go to search.msn.com, www.google.com,
www.lycos.com, etc. If I try to ping any of these, I get
the same address for all of them. 207.44.194.56. If I
do an nslookup for any of them I get the correct address.

I have tried using different DNS servers in the network
setup, and have checked the hosts file. Other computers
on the same network using DHCP do not have this problem.
I have run "ipconfig /flushdns" and get the same result.
If I clear the dnscache using the above command and then
do a "ipconfig /displaydns" I get a long list of the
search engines all with 207.44.194.56 as the A record. I
have run "net stop dnscache" and still get the same
results when trying to connect to the web site or ping.

Any ideas?

 

[BobC]

I have an XP workstation that will not resolve the IP
addresses of search engines correctly. For example I
can't go to search.msn.com, www.google.com,
www.lycos.com, etc. If I try to ping any of these, I get
the same address for all of them. 207.44.194.56. If I
do an nslookup for any of them I get the correct address.

I have tried using different DNS servers in the network
setup, and have checked the hosts file. Other computers
on the same network using DHCP do not have this problem.
I have run "ipconfig /flushdns" and get the same result.
If I clear the dnscache using the above command and then
do a "ipconfig /displaydns" I get a long list of the
search engines all with 207.44.194.56 as the A record. I
have run "net stop dnscache" and still get the same
results when trying to connect to the web site or ping.

Any ideas?

Spyware. Get spybot search and destroy.
http://www.safer-networking.org/

 

[btj]

I tried spybot already, no joy.

-----Original Message-----


Spyware. Get spybot search and destroy.
http://www.safer-networking.org/
.

 

[Wÿrm]

I have an XP workstation that will not resolve the IP

addresses of search engines correctly. For example I
can't go to search.msn.com, www.google.com,
www.lycos.com, etc. If I try to ping any of these, I get
the same address for all of them. 207.44.194.56. If I
do an nslookup for any of them I get the correct address.

http://www.f-secure.com/v-descs/delude.shtml

maybe this virus?

 

[Kent W. England [MVP]]

It's too new for spybot.

It's the new Qhosts bug. See http://vil.nai.com/vil/content/v_100719.htm
and http://www.symantec.com/avcenter/venc/data/trojan.qhosts.html for
more details.

You can fix the Qhosts bug manually if your AV tools don't do it.

Delete the following files:
%WinDir%\Help\hosts
%WinDir%\winlog

Delete the following directory:
c:\bdtmp\tmp

Reset the following registry key value:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters
"DataBasePath" = %SystemRoot%\System32\drivers\etc

Delete the following registry key value:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\In
terfaces\windows
"r0x" = your s0x

Delete the following IP addresses from your DNS servers list, if
present:
69.57.146.14
69.57.147.175

Reconfigure your DNS server IP addresses as required by your service
provider.

Reconfigure your Internet Explorer search settings as desired, if you
don't want google. Qhosts sets all search values to google.