intermittent dns issues not affecting entire network
Hello, everyone. There are two users in my office who are suddenly unable to access some internet sites that they have always been able to access before. I am able to navigate to the sites from other machines in the office with no problems. The two users who are having problems are receiving the "page cannot be displayed" message when they attempt to go to some sites; at the bottom of the error page it states "DNS error or server cannot be found". They are able to access other internet sites with no problems. It's not the sites themselves having problems because I am able to get to them from other computers.
One of the machines is running XP Pro, the other is 2000 Pro. We have a Novell network here with client version 4.91. I've tried adjusting the security settings in the browsers, but it has not made a difference. Nothing has changed on the network or on the machines; no new software or hardware has been installed. There are no viruses resident on either machine.
Please help if you can! Thank you in advance for your replies.
Software/Hardware used:
Software/Hardware used:
ASKED:
June 29, 2007 11:53 AM
UPDATED:
July 2, 2007 7:44 PM
Answer Wiki:
A quick test to see if they have cached bad DNS entries would be to ping one of the websites from a machine that works and compare the resolved address to the address resolved on a machine that didn't work. If the entries don't match do and ipconfig /flushdns and try it again to see if that clears up the issue.
You can also check their hosts file to see if something has placed entries in there. There have been some viruses that write entries to your hosts file.
HTH
Gary
To see all answers submitted to the Answer Wiki: View Answer History.
Gary had a good idea about checking the hosts file, but I suggest you use nslookup on both working and non-working systems. Are they getting information from the same DNS server? If the systems are the same, they should get identical information. If they do, and there are still differences, I world suspect redirection or similar malware causes.
rt
Thank you, astronomer. I never thought to compare DNS servers, and sure enough, the machines that weren’t working were pointing to a different DNS server. I don’t believe that anyone changed those settings. Could malware have done it? I can’t tell you how appreciative I am, as well as the people this problem was affecting! Everything is working fine now.
Thank you!
Malware could definitely have done it. You would be shocked and disturbed at what is now happening with javascript.
I watched a demo where the presenter uploaded script to an IIS server, downloaded it with an innocent client, (just by clicking on the link), and compromised the client. He installed a keylogger and showed the recent common websites visited. After this he showed, on his hack server, the username and password used for the ecommerce site. Then he scanned the local net, found the DSL modem, and cracked it using the manufacturers default admin and password.
This is the next big vulnerability area.
rt