Windows Forum

Ask something
Discussion Locked

Name resolution issue

0 helpful
6 replies

by pricepd 1 view

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

I have a Win2K server runing active directory, with DNS for internal use only. I am not resolving internet names, those are being forwarded to our ISP's DNS server. Recently we were unable to connect to www.msn.com, all
other domain names could be resolved. This only happens periodically and can be solved if the win2k server is restarted. When this happens the users get the standard "Page cannot be displayed" message in IE. But the server gets redirected to www.yeah.com.

I realize this is probably a redirection from some spyware, but neither Adaware nor Spy Bot Search and Destroy have resolved the issue. I have also searched the
registry for any unusual entries or redirections, but can't seem to find any.

This has my whole network screwed up because we have to reboot the server, sometimes 5 times a day. The work around I have given the users is to use www.msn.com's IP address directly in the address bar of IE and that works.

Anyone have any ideas?

thanks

6 replies

by cg it

quick answer for the server itself would be to check IE default web page in IE's tools/internet options/general. Next would be to check Group Policy settings/computer configuration/IE settings. If someone set group policy for computers on the domain to use that default site, then no matter what, when group policy is refreshed, that default page would be applied to computers affected by that policy.

Let us know what IE computer configuration is set as a group policy for computers.

by pricepd

There are no group policies in effect. We are a small domain and I am the only one who has access to administrative functions on the Domain. Also We have NAV Corporate edition and I have scanned for viruses and there are no viruses found.

by ewgny

Did you check the hosts file on your DC for any entries, some malicious sites or programs can add an entry into your hosts file and ad-aware or spybot wouldn't pick it up. You can make your hosts file read only to prevent unauthorized entries being made in it. Also check your DNS records for any unusual entries. Your workstations are cofigured to use your internal DNS server only, correct ? Post back any event ID's that you are getting related to DNS if you have any

by cg it

there's a way to respond without rejecting answers....rejecting answers just makes one [and if enough suggestions/answers given are rejected, everyone else] not want to provide other possible solutions/answers maybe someone else will have an idea

by pricepd

Thehosts file is clean. In fact I enterd the IP address of msn to the hosts file (in the correct format), but it doesn't seem to have an effect. Sorry for rejecting you answer. I didn't realize I needed to add comments to my question. I won't reject any more suggestions until I am ready to close the question.

This discussion is closed to new replies.