DNS Cache Question

[HybridShadow]

I had a virus the other day and now when I type ipconfig /displaydns

It has all these weird sites, I think that is whats causing problems and not letting me access some sites.

[rendrag]

have you tried this from a command window:

ipconfig /flushdns

ipconfig /registerdns

[DARPA]

Hi,

have a check to your hosts file locate in:

C:\WINDOWS\system32\drivers\etc

If you found many sites, is was probably populated by a virus.

to open it (it doesn't have any extension) use worpad or notepad.

Resolution:

1- select all

2- delete

3- paste the following to it, save it, run ipconfig /flushdns and reboot

# Copyright © 1993-1999 Microsoft Corp.

#

# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.

#

# This file contains the mappings of IP addresses to host names. Each

# entry should be kept on an individual line. The IP address should

# be placed in the first column followed by the corresponding host name.

# The IP address and the host name should be separated by at least one

# space.

#

# Additionally, comments (such as these) may be inserted on individual

# lines or following the machine name denoted by a '#' symbol.

#

# For example:

#

# 102.54.94.97 rhino.acme.com # source server

# 38.25.63.10 x.acme.com # x client host

127.0.0.1 localhost

[HybridShadow]

Thank you

There were alot in the file

They reference to this and claim to be added from WinHelp2002

Here is a link i found in Google

http://www.mvps.org/winhelp2002/hosts.htm

It also says a hosts file larger than 135k slows down the computer, mine is over 400k.

They had a work around but i am just going to clear it out and not worry about it. [Possibly check it every now and then over the next few days]

But when i get vista im going to reformat anyway so if anything is left from the virus or the hosts file it will be gone.

Thank you for getting back to me. I did have a picture attached but it didnt upload, i didn't even know this topic finished uploading.

I will let you know if a still get those sites in ipconfig /displaydns

[DARPA]

Ok! great let me know about this issue.

The thing is, when you ping "localhost" , you'r pinging yourself. This is what we call Name Resolution, if you check your file, you can found 127.0.0.1 localhost. It indicates that when you ping localhost it's redirected to ip 127.0.0.1; But if you try to connect to a site like www.microsoft.com and microsoft.com is present in your file and pointing to 127.0.0.1 you go nowhere... since for exemple to correct ip should be [207.46.19.30].

When you try to resolve a name, there is a sequence and before you really go online to resolve a name, it will first check your cache and host file...

I hope I could help you.

Darpa

[Nephilim]

BTW, you can have a hell of a lot of fun with that host file. Just ask our trainees :-D

[rendrag]

if you want to make sure no more entries get added to your hosts file, you can make it read-only

right-click it and go to properties, check the read-only box, and hit OK

[HybridShadow]

Yes it ended up being the hosts file, I would now recommend that no one use programs like I mentioned in my above post.

Now when I displaydns i see some sites I recently went to and my Google Toobar Favourites??

But all is good my ADSL2+ that has been slowed to 64k is running as quick as it can lol.

Its funny now having the full "64k" it feels really fast, I cant wait for 6 days when my bandwidth counter is reset