DNS won't flush - all search engines point to 207.44.220.30

  • Thread starter Thread starter Alan Davis
  • Start date Start date
A

Alan Davis

If I look at DNS...

ipconfig /displaydns

Windows IP Configuration

www.lycos.de
----------------------------------------
Record Name . . . . . : www.lycos.de
Record Type . . . . . : 1
Time To Live . . . . : 603107
Data Length . . . . . : 4
Section . . . . . . . : Answer
A (Host) Record . . . : 207.44.220.30


search.msn.co.kr
----------------------------------------
Record Name . . . . . : search.msn.co.kr
Record Type . . . . . : 1
Time To Live . . . . : 603107
Data Length . . . . . : 4
Section . . . . . . . : Answer
A (Host) Record . . . : 207.44.220.30

and more entries all pointing to the same IP address.

If I do ipconfig /flushdns it says it is successfull...
However; the entries remain.

Thanks for the help !

Alan Davis
 
If in doubt, throw the pram out with the baby in it.

START -> Run... -> `SERVICES.MSC` -> OK

Find `DNS Client` in the list of services and double click it.
Set `Startup type` from `Automatic` to `Manual`.
Click on `Stop`.
Click on `OK`.
Dismiss the services manager.

No way will the DNS cache bug-you any more, as you've just stopped it,
but note that now the operating system will ALWAYS query the Internet
to resolve IP addresses from domain names. In some cases a very
desired thing. In others, not. You can always set it back to
`Automatic` if it makes matters worse for you, but it should not.
 
Try this:

http://www.symantec.com/avcenter/venc/data/trojan.qhosts.html

Some virus plants a bogus hosts file in your Windows folder. Entries in the hosts file direct your browser to incorrect (perhaps randomly generated or selected) IP addresses for a number of major search engines. At least that was my experience. Here's a snippet --

207.44.220.30 google.com
207.44.220.30 www.altavista.com
207.44.220.30 altavista.com
207.44.220.30 search.yahoo.com
207.44.220.30 uk.search.yahoo.com
207.44.220.30 ca.search.yahoo.com
207.44.220.30 jp.search.yahoo.com

every attempt to connect to the customary main web search pages went nowhere, but I could still reach Google groups, Image search, and other stuff. I found the answer in Google Groups, by the way.

I'd say the first place to start is to search your whole computer for files with the name "hosts." There is usually a hosts file here: \WINDOWS\system32\drivers\etc\hosts in a normally-operating Win XP Pro system, and from what I understand, the problem may crop up in the standard hosts file in the standard location, but it was a little harder for me to figure out. I checked my regular hosts file repeatedly, enabled, then disabled it, then enabled it again, turned my firewall on & off, dumped my IE cache, cookies, reinstalled my NIC, you name it. FInally I read a message somebody posted saying that the worm/virus/trojan/whatever it is can stick an extra hosts file in your \WINDOWS\help folder and cause the trouble from there. Sure enough, that's where it was. Once you've deleted, or just simply renamed the tainted hosts file you'll find that your ability to reach those inaccessible sites is fully restored. Hooray!

But I think there's more to correcting the problem & preventing it's recurrence than that, so be sure to check out the symantec link and make use of their free tool. ALso, I think there are a number of recent posts on this topic right in this forum.

Best of luck...

Have a look at whatever turns up by opening each file in Notepad. I betcha you'll find some odd-looking entries for your inaccessible search pages.
 
Back
Top