Browser Virus

Do you know what your DNS servers are supposed to be?

One way to find out is to got to a command/DOS shell and type the following:

ipconfig /all

This should give you a a listing of your IP configuration, including the DNS servers (at the bottom of the list usually.) For example, my comcast DNS server IP addresses are:

DNS Servers . . . . . . . . . . . : 216.148.227.68
204.127.202.4

If I then do a reverse lookup on one of these IP addresses by typing:

ping -a 216.148.227.68

It gives me:

ping -a 204.127.202.4

Pinging ns5.attbi.com [204.127.202.4] with 32 bytes of data:

Reply from 204.127.202.4: bytes=32 time=47ms TTL=52
Reply from 204.127.202.4: bytes=32 time=47ms TTL=52
Reply from 204.127.202.4: bytes=32 time=48ms TTL=52
Reply from 204.127.202.4: bytes=32 time=47ms TTL=52

Ping statistics for 204.127.202.4:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 47ms, Maximum = 48ms, Average = 47ms

Notice how it gives me the name of the DNS server at the beginning of the output? I know this is a valid server for Comcast as they're still using the old AT&T server names from when the service was bought out.

Take a look at the IP addresses/names for your DNS servers and then contact your ISP and ask them what they should be (it may also be listed on their website.) If they aren't the same as yours either (a) your DHCP lease, connection or DNS server hasn't been updated for some reason, or (b) something has hijacked your DNS and your being routed somewhere else by a hacker/virus/worm/application/spyware.

Hope this helps.
 
Do you know what your DNS servers are supposed to be?

One way to find out is to got to a command/DOS shell and type the following:

ipconfig /all

This should give you a a listing of your IP configuration, including the DNS servers (at the bottom of the list usually.) For example, my comcast DNS server IP addresses are:

       DNS Servers . . . . . . . . . . . : 216.148.227.68
                                                 204.127.202.4

If I then do a reverse lookup on one of these IP addresses by typing:

ping -a 216.148.227.68

It gives me:

ping -a 204.127.202.4

Pinging ns5.attbi.com [204.127.202.4] with 32 bytes of data:

Reply from 204.127.202.4: bytes=32 time=47ms TTL=52
Reply from 204.127.202.4: bytes=32 time=47ms TTL=52
Reply from 204.127.202.4: bytes=32 time=48ms TTL=52
Reply from 204.127.202.4: bytes=32 time=47ms TTL=52

Ping statistics for 204.127.202.4:
   Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
   Minimum = 47ms, Maximum = 48ms, Average = 47ms

Notice how it gives me the name of the DNS server at the beginning of the output? I know this is a valid server for Comcast as they're still using the old AT&T server names from when the service was bought out.

Take a look at the IP addresses/names for your DNS servers and then contact your ISP and ask them what they should be (it may also be listed on their website.) If they aren't the same as yours either (a) your DHCP lease, connection or DNS server hasn't been updated for some reason, or (b) something has hijacked your DNS and your being routed somewhere else by a hacker/virus/worm/application/spyware.

Hope this helps.
All good advise. I stil have the other computers on xp (my sons) so I can read all the settings. they are the same as mine, his works mine does not. Very strange. I will double check again.
 
TruWrecks walked me through the problem.




"You'll want to use notepad.exe to open the following file:
<span style='color:green'>Make sure that the files are not on read only or you will just make a text file</span>
C:\WINDOWS\HOSTS

or

C:\WINDOWS\HOSTS.SAM

Look for any entries for Hayabusa.org. If you find any, delete them.

If you don't find any you can always add an entry:

<span style='color:green'>(DON'T ADD, WOULD NOT WORK WHEN I DID) Mike</span>
hayabusa.org 216.55.162.48

This will over-ride you DNS requests for the listed sites."

Doug

Thanks again
 
Crazy. I don;t think I've ever seen a computer hold on to DNS info with a death grip like that before... Glad you got it figured out.
 
Sounds like u have a solution, but always nicer to have the hosts file clean of any hard-values.

Have u tried these in the command prompt:
ipconfig /flushdns
ipconfig /registerdns

Also, Adware Away might be worth a try: . It found some webbrowser hijackers on my PC and was the only program able to remove them without going thru a long series of manual steps and reboots. Latest pain-in-the-ass one was trying to go to google.com kept bringin me to some googl.com for some xxx treats.
 
I get 404 NOT FOUND But I can get to the boards just not the home page.???
 
rock.gif
so... it works now?
rock.gif


rock.gif
 
Sounds like u have a solution, but always nicer to have the hosts file clean of any hard-values.

Have u tried these in the command prompt:
ipconfig /flushdns
ipconfig /registerdns

Also, Adware Away might be worth a try: .  It found some webbrowser hijackers on my PC and was the only program able to remove them without going thru a long series of manual steps and reboots.  Latest pain-in-the-ass one was trying to go to google.com kept bringin me to some googl.com for some xxx treats.
I will have to give it a try. I se Adaware and Spybot at the present time twice per week.
 
All of everyone everywhere should start using FIREBIRD browser:
http://mozilla.org
Only if you want bigger security holes than IE has.
HAHAHAHAHHAA I beg to differ. NO ONE can compete with the amount of security problems MS has in thier browser, not to mention all their other systems. NO ONE!
smile.gif
Take into account knowlege base of a known product, and that hackers only mess with BIG things worth bragging about.

Besides, accessing the Internet AT ALL IS, by itself, a security hole. Shut it off... let's all go out and play
 
Sounds like u have a solution, but always nicer to have the hosts file clean of any hard-values.

Have u tried these in the command prompt:
ipconfig /flushdns
ipconfig /registerdns

Also, Adware Away might be worth a try: .  It found some webbrowser hijackers on my PC and was the only program able to remove them without going thru a long series of manual steps and reboots.  Latest pain-in-the-ass one was trying to go to google.com kept bringin me to some googl.com for some xxx treats.
The ipconfig commands aren't supported in Windows 98, only NT, 2000, and XP.

For Windows 98 you need to use the winipcfg command. That will open a new window with a dropdown menu that lists the network adapters. Select the adapter for your config, and it will show you the configuration for it.

You can't do any DNS commands here though.

If you really want to know what it's doing, put a sniffer on it. Go to http://www.ethereal.com and download the Windows based sniffer on to your machine.

Setuo and run the sniffer to capture all traffic from your computer, then it will tell you exaclty what the problem is.
 
Back
Top