Strange DNS issues ever since we installed Windows 8

[Mitsiee]

Hello,

I am currently working for a company of about 20 people. The internet has always been working fine, but ever since I installed Windows 8 3 months ago it has been acting up weird.

Sometimes when going to a certain url it redirects to the 404 page of google (showing the url like google.com/404=theurlIentered/ or something similar). At other times it redirects to website that we have never been to. Other than redirecting it also marks very normal websites (google.com for instance) as unsafe. It will keep redirecting/doing whatever for a few minutes, after that period you can finally go back and actually access the url you want.

Things to keep in mind;
- It seems to have started since I installed the trial of Windows 8 3 months ago.
- It does not happen on Windows 7
- It does happen on Mac and Windows 8
- We tried flushing the DNS, with no results
- It happens about once an hour, and prevents you from entering that url for a few minutes.
- It seems to happen most with websites we host from within the company
- Pinging the URL shows the same IP as the url it redirects to

Please help us!

 

[Danimal1209]

You can try setting your DNS servers manually to 8.8.8.8 (Google DNS) to see if it really is a DNS issue.

But, it sounds like you might have some kind of redirect malware floating around.

Lastly, you need to have special configurations in order to access internal webservers with a public url.

 

[m1ldslide1]

You can try setting your DNS servers manually to 8.8.8.8 (Google DNS) to see if it really is a DNS issue.

But, it sounds like you might have some kind of redirect malware floating around.

Lastly, you need to have special configurations in order to access internal webservers with a public url.

This - it could be a false alarm, but this is very common and very risky for your business.

General idea is that your client is reconfigured via malware to send DNS requests to some server in Romania or somewhere, which redirects all of your traffic through MiTM servers, eventually routing to the actual server you want to connect to (eg Bank of America). A lot of the time this isn't detected because you still get your intended website. Gnarly stuff...

 

[Genx87]

I am assuming you are running active directory? I would make sure you arent hosting any zones in your dns of the websites you are trying to gain access to. If you are running a firewall block outgoing dns except for your DNS server.