DNS Cache

jamesk said:

I have a site that was pointed to shopify, and then closed the store. Now when I try to load the new site, it always directs to the closed shopify site. If I do a dns reset using ipconfig /flushdns it will work for a while, but then always reverts back. So I have to reset many times per day.
Any ideas on how to get this setup so that the dns is not changing..?
thanks
james

Hi jamesk and welcome to Tenforums.

Please advise what browser(s) you are using and uninstall all toolbars in all of them.

Let's check for infection
-download and run RKILL
This is a little program that will stop any malicious running processes temporarily until next boot. After running, it places a text file on your desktop - paste that info here.

- download, install and run Malwarebytes Antimalware Free
Update the definitions and go into settings and select the box to scan for Rootkits as well as everything else that is already checked. Do a custom scan and select your entire C: drive.

Let us know if it finds anything. Reboot if asked to. If you do reboot, run RKILL again.

Depending on your response, I'll give you next steps.

jamesk said:

Here is the rkill txt
Rkill 2.8.3 by Lawrence Abrams (Grinler)
.....

* Windows Firewall Disabled

[HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = dword:00000000

Everything looks good except this. What are you using for a firewall? Do you have a 3rd-party firewall installed? If not, you will need to edit the registry and change that to "1". (Well, I would try turning it on through Windows, before I would edit the registry....)

Something may have messed with your hosts file. That is a system file that will redirect any IP address to another, hard coded. Check these instructions to view/edit the system hosts file. There may be something in there causing you problems. Beginner Geek: How To Edit Your Hosts File

This is what a plain vanilla hosts file should look like. This is straight off my desktop, just upgraded to 11099.

It is in this folder.... C:\Windows\System32\drivers\etc. Filename is "hosts". You can open it with Notepad.

----------------------------------------------------------------------------------------------------------------------------------------

# Copyright (c) 1993-2009 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host

# localhost name resolution is handled within DNS itself.
# 127.0.0.1 localhost
# ::1 localhost

f14tomcat said:

Something may have messed with your hosts file. That is a system file that will redirect any IP address to another, hard coded. Check these instructions to view/edit the system hosts file. There may be something in there causing you problems. Beginner Geek: How To Edit Your Hosts File

This is what a plain vanilla hosts file should look like. This is straight off my desktop, just upgraded to 11099.

It is in this folder.... C:\Windows\System32\drivers\etc. Filename is "hosts". You can open it with Notepad.

----------------------------------------------------------------------------------------------------------------------------------------

# Copyright (c) 1993-2009 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host

# localhost name resolution is handled within DNS itself.
# 127.0.0.1 localhost
# ::1 localhost

If there were any changes to a plain vanilla Hosts file, RKILL would have listed that in the report.

jamesk said:

I had the windows firewall off, so I turned it on. Running the malware scan now...

Okay, let us know what it finds, if anything.