Weird (DNS?) problem

[daveh551]

I have a weird problem that comes and goes.

Every once in a while, when I go to access groups.google.com, it comes
up with a site titled "sushan test", with the URL identified as
"testindia.bizland.com/test.html" (or something close to that). It
persists for some time, no matter how I access google (clicking on a
specific link, or typing "groups.google.com" into the address bar).
www.google.com is okay.

I've also seen sporadic redirection of other well-known sites. For
example, www.yahoo.com came up with a site titled "Bubbles" that was
some innocuous poem with a ditzy stationery.

I ran nslookup on groups.google.com, and it came up with a google
address. Running nslookup on testindia.bizland.com came up with an
entirely different address. I also ran nslookup on groups.google.com
directing the DNS server to my ISP's server, and got the same result
back. All my machines are pointed to my Primary Domain Controller as
their DNS server.

I ran a complete virus scan of the system, and found no errors, but the
problem went away after I finished.

Also, I THINK, but I'm not sure, that it only occurs from one of the
machines on my home network (I have a laptop running Win 2000 Pro, a
desktop running Win XP Pro, and a file/print/PDC server running Win
2000 Server).

I'm completely stumped.

Any ideas? Thanks in advance.

 

[BobC]

I have a weird problem that comes and goes.

Every once in a while, when I go to access groups.google.com, it comes
up with a site titled "sushan test", with the URL identified as
"testindia.bizland.com/test.html" (or something close to that). It
persists for some time, no matter how I access google (clicking on a
specific link, or typing "groups.google.com" into the address bar).
www.google.com is okay.

Sounds like you've been hijacked by malware. Run complete system scan for
virus and spyware (you may need to run several anti-spyware utilities).
Download and run HiJackThis to find problems on your computer.

Also check for rogue entries in your hosts file.