Weird Win9x DNS traffic

[compuveg]

Clients in my LAN are making weird DNS queries. They're looking for A records for things like 'poldecod.dll', or for 'X:'.

Has anyone seen this? Thanks in Advance.

 

[SgtB]

How's your AV? Up to date? If so, run a full scan on these machines. Is there a direct connection to the internet in this network? If so, is it firewalled? If not, why?

Is there any non-standard software on this machine? If so, get rid of it, and see if the behavior persists. ________________________________________
Check out

http://www.security-forums.com

 

[Tom57]

I'm getting the same on Win98 computers, on different networks. I have DNS resolutions for mail.#$%?& or any kind of garbage, poldecod.dll and other. I have scanned, double checked, removed TCPIP completly, reinstalled... to no avail. The systems affected are unstable (more than the usual win98), freeze and loose network connections.

I have found nothing in AV forums or elsewhere.

Any more suggestions?

tom57

 

[SgtB]

Does this happen on newly installed clients? Try rebuiling the OS on the machine. Then monitor it directly (ie packet-sniffer) Install standard applications, and keep an eye on it. Log everything about the machine, and I'm sure you'll find out where the traffic is coming from.

________________________________________
Check out

http://www.security-forums.com

 

[compuveg]

If you can't tell by looking at the thread, I've kind of dropped this issue. This weird DNS traffic occurs when installing nothing but win98 and the network driver on a clean box from clean CDs. I've got to just assume its similar to the shotgun aim Microsoft uses on text entered into the address bar of MSIE.