Windows 10: DNS Cache

I have a site that was pointed to shopify, and then closed the store. Now when I try to load the new site, it always directs to the closed shopify site. If I do a dns reset using ipconfig /flushdns it will work for a while, but then always reverts back. So I have to reset many times per day.
Any ideas on how to get this setup so that the dns is not changing..?
thanks
james

:)

 

I can't log into my Microsoft account or use the Store since Anniversary Update

There is no notification about this problem. I tried changing my DNS to Google's DNS, flushed
my DNS cache & nothing changed. I then tried Open DNS, flushed
my DNS cache & still nothing. I don't know what else to try to fix this issue beyond doing a clean install.

 

Boot bug and DNS CLIENT event BUG?

Try disabling DNS client.

To start View your dns cache, always good to know what is in there which may be helpful

ipconfig /displaydns In elevated command

Then clear your dns cache

To clear your DNS cache

>Click Start.

>Elevated CMD

>Run the following command: ipconfig /flushdns.

Disable DNS Cache

>R-click Start

>Run>Service.msc

>Scroll to DNS Client

>Stop and disable.

your store apps will not work.

Myself I never Enable DNS Client and is always disabled. I don't use store or apps.

 

Hi jamesk and welcome to Tenforums.

Please advise what browser(s) you are using and uninstall all toolbars in all of them.

Let's check for infection
-download and run RKILL
This is a little program that will stop any malicious running processes temporarily until next boot. After running, it places a text file on your desktop - paste that info here.

- download, install and run Malwarebytes Antimalware Free
Update the definitions and go into settings and select the box to scan for Rootkits as well as everything else that is already checked. Do a custom scan and select your entire C: drive.

Let us know if it finds anything. Reboot if asked to. If you do reboot, run RKILL again.

Depending on your response, I'll give you next steps.

 

Here is the rkill txt
Rkill 2.8.3 by Lawrence Abrams (Grinler)
BleepingComputer.com - News, Reviews, and Technical Support
Copyright 2008-2016 BleepingComputer.com
More Information about Rkill can be found at this link:
RKill - What it does and What it Doesnt - A brief introduction to the program - Anti-Virus, Anti-Malware, and Privacy Software

Program started at: 01/14/2016 05:37:55 PM in x64 mode.
Windows Version: Windows 10 Home

Checking for Windows services to stop:

* No malware services found to stop.

Checking for processes to terminate:

* No malware processes found to kill.

Checking Registry for malware related settings:

* No issues found in the Registry.

Resetting .EXE, .COM, & .BAT associations in the Windows Registry.

Performing miscellaneous checks:

* Windows Firewall Disabled

[HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = dword:00000000

 

Everything looks good except this. What are you using for a firewall? Do you have a 3rd-party firewall installed? If not, you will need to edit the registry and change that to "1". (Well, I would try turning it on through Windows, before I would edit the registry....)

 

Something may have messed with your hosts file. That is a system file that will redirect any IP address to another, hard coded. Check these instructions to view/edit the system hosts file. There may be something in there causing you problems. Beginner Geek: How To Edit Your Hosts File

This is what a plain vanilla hosts file should look like. This is straight off my desktop, just upgraded to 11099.

It is in this folder.... C:\Windows\System32\drivers\etc. Filename is "hosts". You can open it with Notepad.

----------------------------------------------------------------------------------------------------------------------------------------

# Copyright (c) 1993-2009 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host

# localhost name resolution is handled within DNS itself.
# 127.0.0.1 localhost
# ::1 localhost

 

If there were any changes to a plain vanilla Hosts file, RKILL would have listed that in the report.

 

I had the windows firewall off, so I turned it on. Running the malware scan now...

 

This is my hosts file...
# Copyright (c) 1993-2009 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host

# localhost name resolution is handled within DNS itself.
# 127.0.0.1 localhost
# 162.255.118.46 tshirtsbyjames.com
# ::1 localhost
192.168.199.119 HPSCANNER

 

Okay, let us know what it finds, if anything.

 

I have a site using the ip 162.255.118.46 but it will always switch back to the shopify store ip.... 23.227.38.32
I have tried shutting down the DNS Client, but it always starts back up..
Nothing showed up on the malware scan.

 

What browsers are installed on the system?
Do you have Ccleaner installed?

 

Seems there are some issues with that IP
https://www.virustotal.com/en/ip-add...6/information/

Better get Malwarebytes Antiexploit installed on your system, and don't turn the firewall off!

Please advise what browser(s) you are using and uninstall all toolbars in all of them.

 

Check your browser's shortcuts under settings, there should be some links to the old site being triggered.

Or maybe a redirect page, because as of now it returns 404 and the only running site is under 23.227.38.32 which is the new site for shopify...