Bizarre DNS issue

[hgate73]

I'm having a strange DNS issue on a lot of our client Windows 7 workstations that I've narrowed down to the following:

When the DNSCache (DNS Client) service is running:
- Clients cannot resolve four particular hostnames
- Clearing the DNS cache (ipconfig /flushdns) and then pinging the hosts creates a record that says "<hostname>: the host does not exist"

When I stop the DNSCache, suddenly all hostnames resolve correctly.

I've deleted the hostnames and readded them to the DNS server (running Server 2k8).
I've flushed the client DNS caches.
I've checked the client host files for errant entries.

Can anyone point me in roughly the right direction?

 

[linney]

You are not seeing any fallout from this virus that has been in the news recently? However the fallout was a lot less than the expected problems with DNS.

https://forms.fbi.gov/check-to-see-if-your-computer-is-using-rogue-DNS

 

[hgate73]

Hi Linney, thanks for posting. No, it's not related to DNS changer (unfortunately).

I did end up tracking the issue down. It appears we had an old Linux server still acting as NetBIOS master and was passing out old/bad data to clients. Additionally, the TCP/IP Helper for NetBIOS service was disabled. Apparently this breaks Microsoft SMB shares (network shares such as \\server\share and \\ip.address\share). After re-enabling the service we are issue-free.