NSLOOKUP appends rr.com domain

[dcranford]

Seems this is reported throughout the web for domain PCs but I've not found anything for "at home" laptops. I have one connected to a standard RoadRunner router. Two days ago, IE stopped finding websites. Running NSLOOKUP returns something similar to this:

C:\>nslookup

http://www.cnn.com

Server: UnKnown
Address: 192.168.1.1

Non-authoritative answer:
Name:

http://www.cnn.com.carolina.rr.com

Addresses: 21.22.23.24 (this is an example - not the actual returned address)

No matter what I lookup, it always appends the carolina.rr.com domain and returns the same number.

I feel reasonably certain that the virus and spyware software is current. The daily anti-virus signatures are updating to the laptop. I've checked the basic IP services and all that are set to automatic are running. Any one have any ideas on this?

Deon Cranford

 

[Noway2]

The server unknown part may be the key. That suggests to me that your query did not receive an answer from the DNS. When you are connected to TWC via DHCP connection, domain carolina.rr.com will be pushed to your resolver. Since it wasn't able to lookup

http://www.cn.com,

it then tried appending the default domain, carolina.rr.com to the query and gets sent to TWC's dummy page. I think it is similar to when you get those pages that come up with "<whatever your searched for>.com domain is available, contact us at xyz to buy it", kind of a catchall.

I have seen this happen every once in a while and not fully understood it.

Next time, when this happens, at the nslookup prompt >, type server 8.8.8.8 and then repeat your query. This should set the DNS to google's public DNS rather than TWCs.

 

[dcranford]

Appreciate the idea. I'll work on that this weekend and advise

 

[CaptPikel]

Just to chime in...nslookup is a bad tool to use. Don't use it if possible.

On your problem, nslookup uses the search list option by default. If you want to perform the search correctly with nslookup, add a period to the end to specify an FQDN(

http://www.cnn.com.).

The search list option can usually be changed (or disabled) under the advanced settings for an adapter in Windows. I think it's called DNS suffix or something.

 

[dcranford]

Thank you both for the replies. Spent most of the weekend on this one. Turned out to be; you guessed it, a virus. It's name was Roxifind. I was never able to determine how the rerouting of the DNS was being done but it kept ports https, ftp, ssh, and telnet open while disabling port 80.

I appreciate you taking the time to forward your suggestions.