Chuckster Posted April 23, 2009 Posted April 23, 2009 Hi, I did an IPCONFIG /DISPLAYDNS on 2 of the DCs and 2 Member servers and I've seen that I have entries that should not be in there at all. How do I get rid of them? The entries are: Windows IP Configuration smart-antivirus2009buy.com ---------------------------------------- Record Name . . . . . : smart-antivirus2009buy.com Record Type . . . . . : 1 Time To Live . . . . : 456120 Data Length . . . . . : 4 Section . . . . . . . : Answer A (Host) Record . . . : 127.0.0.1 www-download-antivirus.com ---------------------------------------- Record Name . . . . . : www-download-antivirus.com Record Type . . . . . : 1 Time To Live . . . . : 456120 Data Length . . . . . : 4 Section . . . . . . . : Answer A (Host) Record . . . : 127.0.0.1 virgiio.it ---------------------------------------- Record Name . . . . . : virgiio.it Record Type . . . . . : 1 Time To Live . . . . : 456120 Data Length . . . . . : 4 Section . . . . . . . : Answer A (Host) Record . . . : 127.0.0.1 www.virdgilio.it ---------------------------------------- Record Name . . . . . : www.virdgilio.it Record Type . . . . . : 1 Time To Live . . . . : 456120 Data Length . . . . . : 4 Section . . . . . . . : Answer A (Host) Record . . . : 127.0.0.1 www.tuttograatis.it ---------------------------------------- Record Name . . . . . : www.tuttograatis.it Record Type . . . . . : 1 Time To Live . . . . : 456120 Data Length . . . . . : 4 Section . . . . . . . : Answer A (Host) Record . . . : 127.0.0.1 spywarebot-t.com ---------------------------------------- Record Name . . . . . : spywarebot-t.com Record Type . . . . . : 1 Time To Live . . . . : 456120 Data Length . . . . . : 4 Section . . . . . . . : Answer A (Host) Record . . . : 127.0.0.1 spermatrix.com ---------------------------------------- Record Name . . . . . : spermatrix.com Record Type . . . . . : 1 Time To Live . . . . : 456120 Data Length . . . . . : 4 Section . . . . . . . : Answer A (Host) Record . . . : 127.0.0.1 www.searchfromyourbrowser.net ---------------------------------------- Record Name . . . . . : www.searchfromyourbrowser.net Record Type . . . . . : 1 Time To Live . . . . : 456120 Data Length . . . . . : 4 Section . . . . . . . : Answer A (Host) Record . . . : 127.0.0.1 www.rosaoalice.it ---------------------------------------- Record Name . . . . . : www.rosaoalice.it Record Type . . . . . : 1 Time To Live . . . . : 456120 Data Length . . . . . : 4 Section . . . . . . . : Answer A (Host) Record . . . : 127.0.0.1 paginegialler.it ---------------------------------------- Record Name . . . . . : paginegialler.it Record Type . . . . . : 1 Time To Live . . . . : 456120 Data Length . . . . . : 4 Section . . . . . . . : Answer A (Host) Record . . . : 127.0.0.1 www.nicecodec.net ---------------------------------------- Record Name . . . . . : www.nicecodec.net Record Type . . . . . : 1 Time To Live . . . . : 456120 Data Length . . . . . : 4 Section . . . . . . . : Answer A (Host) Record . . . : 127.0.0.1 www.mylimewirenetwork.com ---------------------------------------- Record Name . . . . . : www.mylimewirenetwork.com Record Type . . . . . : 1 Time To Live . . . . : 456120 Data Length . . . . . : 4 Section . . . . . . . : Answer A (Host) Record . . . : 127.0.0.1 liberok.it ---------------------------------------- Record Name . . . . . : liberok.it Record Type . . . . . : 1 Time To Live . . . . : 456120 Data Length . . . . . : 4 Section . . . . . . . : Answer A (Host) Record . . . : 127.0.0.1 www.l8bero.it ---------------------------------------- Record Name . . . . . : www.l8bero.it Record Type . . . . . : 1 Time To Live . . . . : 456120 Data Length . . . . . : 4 Section . . . . . . . : Answer A (Host) Record . . . : 127.0.0.1 www.justcount.net ---------------------------------------- Record Name . . . . . : www.justcount.net Record Type . . . . . : 1 Time To Live . . . . : 456120 Data Length . . . . . : 4 Section . . . . . . . : Answer A (Host) Record . . . : 127.0.0.1 internet-optimizer.com ---------------------------------------- Record Name . . . . . : internet-optimizer.com Record Type . . . . . : 1 Time To Live . . . . : 456120 Data Length . . . . . : 4 Section . . . . . . . : Answer A (Host) Record . . . : 127.0.0.1 httpwwwads.com ---------------------------------------- Record Name . . . . . : httpwwwads.com Record Type . . . . . : 1 Time To Live . . . . : 456120 Data Length . . . . . : 4 Section . . . . . . . : Answer A (Host) Record . . . : 127.0.0.1 www.harddrevvagt.com ---------------------------------------- Record Name . . . . . : www.harddrevvagt.com Record Type . . . . . : 1 Time To Live . . . . : 456120 Data Length . . . . . : 4 Section . . . . . . . : Answer A (Host) Record . . . : 127.0.0.1 googlebawt.com ---------------------------------------- Record Name . . . . . : googlebawt.com Record Type . . . . . : 1 Time To Live . . . . : 456120 Data Length . . . . . : 4 Section . . . . . . . : Answer A (Host) Record . . . : 127.0.0.1 frostwire.click-new-download.com ---------------------------------------- Record Name . . . . . : frostwire.click-new-download.com Record Type . . . . . : 1 Time To Live . . . . : 456120 Data Length . . . . . : 4 Section . . . . . . . : Answer A (Host) Record . . . : 127.0.0.1 www.frostwire.click-new-download.com ---------------------------------------- Record Name . . . . . : www.frostwire.click-new-download.com Record Type . . . . . : 1 Time To Live . . . . : 456120 Data Length . . . . . : 4 Section . . . . . . . : Answer A (Host) Record . . . : 127.0.0.1 www.forseo.com ---------------------------------------- Record Name . . . . . : www.forseo.com Record Type . . . . . : 1 Time To Live . . . . : 456120 Data Length . . . . . : 4 Section . . . . . . . : Answer A (Host) Record . . . : 127.0.0.1 file7.qqhelper.com ---------------------------------------- Record Name . . . . . : file7.qqhelper.com Record Type . . . . . : 1 Time To Live . . . . : 456120 Data Length . . . . . : 4 Section . . . . . . . : Answer A (Host) Record . . . : 127.0.0.1 www.errari.it ---------------------------------------- Record Name . . . . . : www.errari.it Record Type . . . . . : 1 Time To Live . . . . : 456120 Data Length . . . . . : 4 Section . . . . . . . : Answer A (Host) Record . . . : 127.0.0.1 www.energy-factor.com ---------------------------------------- Record Name . . . . . : www.energy-factor.com Record Type . . . . . : 1 Time To Live . . . . : 456120 Data Length . . . . . : 4 Section . . . . . . . : Answer A (Host) Record . . . : 127.0.0.1 www.download-all-area.com ---------------------------------------- Record Name . . . . . : www.download-all-area.com Record Type . . . . . : 1 Time To Live . . . . : 456120 Data Length . . . . . : 4 Section . . . . . . . : Answer A (Host) Record . . . : 127.0.0.1 de98.remsys.org ---------------------------------------- Record Name . . . . . : de98.remsys.org Record Type . . . . . : 1 Time To Live . . . . : 456120 Data Length . . . . . : 4 Section . . . . . . . : Answer A (Host) Record . . . : 127.0.0.1 www.corroiere.it ---------------------------------------- Record Name . . . . . : www.corroiere.it Record Type . . . .
OutToLunch Posted April 23, 2009 Posted April 23, 2009 (edited) Isn't that the effect of some security software? It's not trying to hijack legit domains to dodgy ones, it's blocking dodgy ones by routing them to localhost - or am I missing the point... Edit - exactly the same response from /displaydns on my PC here, ESET NOD32, Spybot SD, MalwareBytes, MS Malicious Software Removal Tool etc have all been on here, sure one of them will helpfully have added a block... Edited April 23, 2009 by OutToLunch 1
Chuckster Posted April 23, 2009 Author Posted April 23, 2009 Would Spybot S&D do something like this? My LEA installed it because they believed there was a malware on the server.
OutToLunch Posted April 23, 2009 Posted April 23, 2009 # This list is Copyright 2000-2007 Safer Networking Limited # End of entries inserted by Spybot - Search & Destroy At the end of my hosts file, which contains 127.0.0.1 entries for all the sites you listed above. If it was something like somerealipaddress nwolb.com sameipaddress midlandbank.com sameipaddress capitalone.co.uk then you should worry about malware infection. 127.0.0.1 is the reverse - bad sites being redirected to localhost instead.
Innovation_Dan Posted April 24, 2009 Posted April 24, 2009 I think I would immediately run a full virus scan on all DNS servers. Sounds like a pretty standard practice for some of these fake AV viruses. (Is it possible for these viruses to send a fake update to the DNS server?)
powdarrmonkey Posted April 24, 2009 Posted April 24, 2009 (Is it possible for these viruses to send a fake update to the DNS server?) Only if your configuration is broken.
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now