Were we poisioned, spoofed or something else?

Today, one of our internal DNS servers began reporting every host resolution
as an address that has been traced to somewhere in China. We are actively
trying to figure out what occurred. Replacing our actual domain with "test",
here is what we saw in nslookup or regular pings.

nslookup
>www.test.com
www.test.com.test.com (china address)
>validhost1.test.com
validhost1.test.com.test.com (china address)
>invalidname1.test.com
invalidname1.test.com.test.com (china address)

What was happening?

TIA

In news:O4ClwPQOIHA.3556@TK2MSFTNGP03.phx.gbl,
Steve typed:
> Today, one of our internal DNS servers began reporting every host
> resolution as an address that has been traced to somewhere in China.
> We are actively trying to figure out what occurred. Replacing our
> actual domain with "test", here is what we saw in nslookup or regular
> pings.
> nslookup
> > www.test.com
> www.test.com.test.com (china address)
> > validhost1.test.com
> validhost1.test.com.test.com (china address)
> > invalidname1.test.com
> invalidname1.test.com.test.com (china address)
>
> What was happening?
>
> TIA

Try putting a period at the end of the query. Apparently it is suffixing
your search suffix and the period will stop that. Can you post an ipconfig
/all (unedited if you can please) so we can further evaluate your machine's
configuration?

Thanks,

--
Regards,
Ace

This posting is provided "AS-IS" with no warranties or guarantees and
confers no rights.

Ace Fekay, MCSE 2003 & 2000, MCSA 2003 & 2000, MCSE+I, MCT,
MVP Microsoft MVP - Directory Services
Microsoft Certified Trainer

Infinite Diversities in Infinite Combinations

Having difficulty reading or finding responses to your post?
Try using Outlook Express or any other newsreader, configure a news
account, and point it to news.microsoft.com. Anonymous access. It's
easy and it's free:

How to Configure OEx for Internet News
http://support.microsoft.com/?id=171164

"Life isn't like a box of chocolates or a bowl of cherries or
peaches... Life is more like a jar of jalapenos. What you do today
may burn your butt tomorrow." - Garfield