Re: browser redirection to forward.domainname.at
From: Daniel Bowers (Satus) (daniel.bowers@satus.com)Date: 02/26/02
- Previous message: Matthew.van.Eerde@hbinc.com: "browser redirection to forward.domainname.at"
- In reply to: Matthew.van.Eerde@hbinc.com: "browser redirection to forward.domainname.at"
- Next in thread: Michael Gargan: "Re: browser redirection to forward.domainname.at"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
From: "Daniel Bowers (Satus)" <daniel.bowers@satus.com> To: <focus-ms@securityfocus.com> Date: Tue, 26 Feb 2002 11:48:40 -0600
Check your DNS servers for poisoning...
http://www.kb.cert.org/vuls/id/109475
Also, flush the DNS caches on the 2000 workstations, and make sure they
aren't running the DNS Server service.
ipconfig /flushdns
I found one adult-oriented site that would attempt to poison the DNS cache
of clients and scan for DNS servers on client's class C whenever HTTP
requests from new IPs arrived.
----- Original Message -----
From: <Matthew.van.Eerde@hbinc.com>
To: <focus-ms@securityfocus.com>
Cc: <focus-virus@securityfocus.com>
Sent: Tuesday, February 26, 2002 10:29 AM
Subject: browser redirection to forward.domainname.at
> A strange problem is surfacing on our network. Users will type in a
website
> they have been to before, and they will be forwarded to
>
> http://forward.domainname.at/http://212.69.172.16/forward.php
> and then to
> http://212.69.172.16/forward.php
>
> Have we been hit by a virus? Or is there some name resolution hack on the
> internet?
>
> Typing in the ip address of a site
> http://216.168.252.86 for http://www.verisign.com for example
> goes to the correct site. nslookup prompts from the command line yeild
the
> correct IP address.
>
> Workstations are Windows 2000 Professional SP2 with IE 6.
>
> Matthew van Eerde
> Software Engineer
- Previous message: Matthew.van.Eerde@hbinc.com: "browser redirection to forward.domainname.at"
- In reply to: Matthew.van.Eerde@hbinc.com: "browser redirection to forward.domainname.at"
- Next in thread: Michael Gargan: "Re: browser redirection to forward.domainname.at"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
