Weird DNS problems

[thebluebumblebee]

Hi,

My son is having a problem with his system taking him to different web sites than he intends. Today, it took him to www.multiplaygameservers.com. It has taken him to MSN.com and Google.com before. All have been benign. (XP Pro 32) I've tried ipconfig /flushdns and sometimes it works while other times it does not. We use SpybotS&D, AVG free AV, and are behind a NAT and firewall router.

Ideas???

 

[Hybrid_theory]

Goto C:\WINDOWS\system32\drivers\etc\ open the hosts file with notepad or wordpad.

The only entry under the comments should be:
127.0.0.1 localhost

 

[thebluebumblebee]

Goto C:\WINDOWS\system32\drivers\etc\ open the hosts file with notepad or wordpad.

The only entry under the comments should be:
127.0.0.1 localhost

SpybotS&D has inserted a huge list of domain names but they are all 127.0.0.1

 

[95Viper]

Run this> HiJackThis and post your results, don't delete anything unless you are sure of what you are deleting.

You might want to run these :
Malwarebytes
Superantispyware

 

[Namslas90]

Run Winsockfix;
This utility repairs/restores the Winsock and TCP/IP in windows.
Also useful to combat viri.

XP here;
http://www.snapfiles.com/get/winsockxpfix.html

Win7;
http://windows7themes.net/winsock-fix-for-windows-7.html

 

[thebluebumblebee]

We've tried Winsock and will post hijackthis info if needed.

 

[Namslas90]

We've tried Winsock and will post hijackthis info if needed.

Just now had a customer bring me a laptop with similar issues.
Ran Winsockfix, loaded AVG with jump drive, ran installer and
it didn't install (I-net blocked by trojan).
Unpluged internet, Unistalled, re-installed AVG installer from JD
plugged in internet right after clicking run and it all went fine.

Found;
Malwareremover.bot (trojan)
Gamevance (several types, all trojans).
I believe multiplaygameservers,com is their site, but im not going there to check.