ipconfig /flushdns runs continuously

  • Thread starter Thread starter Joe Richards
  • Start date Start date
J

Joe Richards

For some reason, cmd.exe flashes onscreen briefly, and
executes ipconfig /flushdns. Returns
message "Successfully flushed the DNS Resolver cache".

Connecting via cable-modem (Eastlink) using Win2K SP4.
Command line even runs when disconnected from internet.

Recently infected and cleaned Blaster virus with NAV
Corporate v.7.51 and Symantec blasterfix utility.
Rebooted, rescanned - clean.

Any help is appreciated.

J.Richards
Halifax, Canada
 
Are you going to start, then run, then typing cmd, then ok. Then typing in
the command window ipconfig /flushdns?
What operating syatem do you have. If XP, go to run type MSCONFIG, then
click ok, then put you system in selective start up, un check load start up
items. Reboot does it still do it?
 
I'm running Windows 2000 SP4 and IE6 SP1, connecting via
DSL to internet. Command window is flashing on its own
repeatedly (appears for about 1/4 of a second every 30
seconds), and begins to do this immediately after logging
in to Windows. Occurring in both normal and safe modes.

TCP/IP set to obtain DNS server automatically. DHCP is
enabled. No DNS server addresses are specified.

Kind of distracting. Any more ideas?

Thx,
Joe
 
I'm having the exact same problem. This C:\WINNT\System32
\cmd.exe window with the message, "Successfully flushed
the DNS Resolver Cache" flashes every 10-20 seconds. Yes,
very distracting!

I'm also running Windows 2000 SP4 and IE6, but i'm using
56K modem for internet. I don't know about TCP/IP.

I have no idea where it came from. This just happens 2
days ago. I tried to run all the updates and patches, but
nothing helps. I tried to run ipconfig/flushdns, but
didn't help either.

Please let me know of anything that might help getting rid
of this.

Thank you very much,
Amy
 
In
Amy P. said:
I'm having the exact same problem. This C:\WINNT\System32
\cmd.exe window with the message, "Successfully flushed
the DNS Resolver Cache" flashes every 10-20 seconds. Yes,
very distracting!

I'm also running Windows 2000 SP4 and IE6, but i'm using
56K modem for internet. I don't know about TCP/IP.

I have no idea where it came from. This just happens 2
days ago. I tried to run all the updates and patches, but
nothing helps. I tried to run ipconfig/flushdns, but
didn't help either.

Please let me know of anything that might help getting rid
of this.

Thank you very much,
Amy
Click to expand...
I would suggest to check in your registry at this location for anything
being invoked at boot time:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

If you would like to post it, you can highlight the Run key, go to the
Registry menu, select export, and export it as "run-key.reg" (use the
quotes). Then post that here or copy and paste it to your response and we
can take a look at it.

Also, check your Startup folder in your Start\Programs list to see what is
being initialized at startup.

Have you ran Adaware 6.0 to eliminate possible spyware/trackingware stuff
installed?


--
Regards,
Ace

Please direct all replies to the newsgroup so all can benefit.

Ace Fekay, MCSE 2000, MCSE+I, MCSA, MCT, MVP
Microsoft Windows MVP - Active Directory
 
I'm also having the same problem, just started randomly last night
(08/24) after a reboot. I've had no worms, but was running SP2 and
upgraded to SP3 and got all the patches. I've also run Ad-Aware 6 and
cleaned everything out, but still persists. A list of the non-obvious
entries in my registry.

My registry entry for \CurrentVersion\Run
annex as.exe
LoadQM loadqm.exe
MS Config Loader svcrhost.exe
projselector C:\Program Files\Common Files\Roxio...
RFX_auto_upgrade
Synchronization Manager mobsync.exe /logon
vptray C:Program~1\Norton~1\vptray.exe


My registry entry for \CurrentVersion\Run Services
annex as.exe
MS Config Loader svcrhost.exe


I run a word processor called "Latex" and "annex" seems to be
associated with that. There's only one thing in my Startup Folder,
MSOffice.

Dustin
 
okay, so almost exactly 24 hours after it began, it stopped. I'm
guessing that's why no ones posted anything more.

my money's on svcrhost.exe (which looks eerily familiar to the
legitimate svchost.exe) Does anyone else have this in their registry?


Dustin
 
Alright ladies and gentlemen,

It came back and svcrhost.exe also convienently came back in the
process list. I killed it and the madness ended. I think it's safe to
delete the svcrhost.exe from the registry under both Run and Run
Services (full path:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windoze\Current Version\)


Dustin
 
-----Original Message-----
okay, so almost exactly 24 hours after it began, it stopped. I'm
guessing that's why no ones posted anything more.

my money's on svcrhost.exe (which looks eerily familiar to the
legitimate svchost.exe) Does anyone else have this in their registry?


Dustin
.
Click to expand...
 
We are having the same problem. ZoneAlarm alerts us to
the fact that svchos1.exe and svchosl.ext attempting to
access the internet. Windows 2000 Server with all
critical and other updates installed. IE 6.0.2800. Never
a known worm or virus on the system. Since I had a flock
of worm removal tools, I ran 14 of them with no hits.
 
This problem seems to becoming more prevalent over the last few days. Check HKLM\Software\Microsoft\Windows\CurrentVersion\Run for anything out of
the ordinary. Also check the HKCU\Software\Microsoft\Windows\CurrentVersion\Run for the same thing. Be sure to update your AV software to the latest
patches as well as Windows Update for OS patches.

Thank you,
Mike Johnston
Microsoft Network Support


--

This posting is provided "AS IS" with no warranties, and confers no rights. Use of included script samples are subject to the terms specified at
http://www.microsoft.com/info/cpyright.htm

Note: For the benefit of the community-at-large, all responses to this message are best directed to the newsgroup/thread from which they originated.
 
All OS updates have been applied. What does "HKCU" mean.
Thanks
-----Original Message-----
This problem seems to becoming more prevalent over the
Click to expand...
last few days. Check
HKLM\Software\Microsoft\Windows\CurrentVersion\Run for
anything out of
the ordinary. Also check the
Click to expand...
HKCU\Software\Microsoft\Windows\CurrentVersion\Run for
the same thing. Be sure to update your AV software to
the latest
patches as well as Windows Update for OS patches.

Thank you,
Mike Johnston
Microsoft Network Support
Click to expand...
confers no rights. Use of included script samples are
subject to the terms specified at
http://www.microsoft.com/info/cpyright.htm

Note: For the benefit of the community-at-large, all
Click to expand...
responses to this message are best directed to the
newsgroup/thread from which they originated.
 
In
Chuck Davis said:
All OS updates have been applied. What does "HKCU" mean.
Thanks
Click to expand...

It's one of the subkeys in your registry. It means:
HK_Current_User.

If not sure how to check your registry, look at these articles below.
Whatever you do, back it up first (see the article on that below):

Microsoft Windows 2000 Resource Kit - Registry Information [Search, Subkeys,
Entries, etc]:
http://www.microsoft.com/windows200...0/techinfo/reskit/en-us/w2rkbook/regentry.asp

Backing Up and Restoring the Registry:
http://www.microsoft.com/technet/pr...r2003/proddocs/deployguide/registrybackup.asp

A Crash Course- Editing the Windows NT Registry (Exploring Windows NT 2001):
http://msdn.microsoft.com/library/en-us/dnexnt01/html/ewn0201.asp

Registry structure:
http://www.microsoft.com/windows2000/en/server/help/sag_ntregconcepts_mply.htm

Hope that helps.

--
Regards,
Ace

Please direct all replies to the newsgroup so all can benefit.

Ace Fekay, MCSE 2000, MCSE+I, MCSA, MCT, MVP
Microsoft Windows MVP - Active Directory
 
In
Jonsey said:
Chuck Davis said:
This problem is caused by a worm: W32.HLLW.Gaobot.AA
[Symantec]W32/Gaobot.worm.y [McAfee], WORM_AGOBOT.P
[Trend]

Our problem was resolved with the instructions from:
http://securityresponse.symantec.com/avcenter/venc/data/w3
2.hllw.gaobot.aa.html#recommendations
Good luck!
Click to expand...

Haha, just my luck. Yesterday I just formatted and reinstalled Win2k,
and I've already been infected with something. Figures.
Click to expand...


That's not good! Hope you were able to repair the problem.

Antivirus
Adaware
Latest Patches
Personal or entry level firewall.

All good things to keep you up to date and protected.
:-)

--
Regards,
Ace

Please direct all replies to the newsgroup so all can benefit.

Ace Fekay, MCSE 2000, MCSE+I, MCSA, MCT, MVP
Microsoft Windows MVP - Active Directory
 
Back
Top