DNS cache

[geek_love]

I posted this in connection with a malware question in the malware forum a couple of days ago, but that thread seems to have disappeared - at least, I can't find it. I'm thinking it's more of a software problem, anyway.

I'm a relatively new computer user running Vista, and what I don't know could fill the phone book, but here's my problem. I checked my DNS cache and found three or four dozen entries - all are highly suspect-looking sites, none of which I've ever visited. They seem to all(?) be listed among the hundreds of sites listed in my registry in relation to my Spybot protection.

But isn't the DNS cache supposed to only hold sites that I've actually visited before, or tried to visit? As I said, I've never been to any of those sites.

In addition, I tried clearing the cache, via Command Prompt, ipconfig/flushdns, but it didn't work. It says the attempt was "successful," but when I look in the cache again they're all still there.

So:

1. Why are sites I've never been to listed in the DNS cache?
2. Why aren't any sites that I HAVE been to listed in the DNS cache?
3. Why can't I clear the cache?

Thanks in advance for any help!

[Cat_w_9_lives]

This might help explain it:
http://forums.spybot.info/showthread.php?t=281

1. Why are sites I've never been to listed in the DNS cache?

See fourth level of protection in link

2. Why aren't any sites that I HAVE been to listed in the DNS cache?

You cleared cache, Spybots hosts file is protected I think...

3. Why can't I clear the cache?

Because what is left is protected by Spybot most likely. Think you can change in the advanced settings if I recall but I usually look closely at a site if I am blocked from visiting.

[geek_love]

Hi, Cat. Thank you for responding. I've read the information in the link, and I guess those sites are in my DNS cache because Spybot put them there, although I confess that I don't completely understand it. It's my (admittedly limited) understanding that a site should only appear there if I try to access it - whether it's a site in my HOSTS file or not. But, oh well, there's lots I don't understand.... I feel better knowing that it's okay that they're there.

One thing, though: Those were the only sites in the cache even BEFORE I flushed it. And even now, when I visit more sites, then check my cache, none of those sites I've visited are listed there. So it looks like the cache isn't accumulating a list of any of the sites I visit.

Any idea why?

[DavidGP]

Originally Posted by geek_love

One thing, though: Those were the only sites in the cache even BEFORE I flushed it. And even now, when I visit more sites, then check my cache, none of those sites I've visited are listed there. So it looks like the cache isn't accumulating a list of any of the sites I visit.

Any idea why?

The DNS Reslover Cache which is the one you will have been looking at with ipconfig /displaydns and flushed with ipconfig /flushdns doesnt always store all websites visited, generally one that are not in the cache already, and many of the times its not listing the actual website but a hosts server ( OR servers of advertising banners etc ), which is why possibly your not seeing sites you vistited. Default time for holding them in the local DNS Cache is aprox 24hrs, majority of the time DNS lookups are dont on the network.

More info http://en.wikipedia.org/wiki/Domain_name_system and http://support.microsoft.com/kb/318803 ( DONT and I wouldnt suggest you have to or need to follow the advise in the Microsoft KB but the info is apt )


SO really wouldnt worry too much at whats in the DNS Cache and as Cat pointed out Spybots additions are in the HOSTs and are normal, do you have another application called SpywareBlaster installed as it too adds known bad sites/activex to the blocked zone of the registry for IE, so if using Spybot I would only use one of these applications as your duplicating the blocks and could potentially slow your internet down a touch.

[geek_love]

Hi, Halo. Thank you for responding, and for all the info. I feel better now.

A couple of follow-up questions, and I think I can leave you alone:

1. I found some advice at another forum saying that, as I'm using the Spybot HOSTS file, I could disable my DNS client for "better browsing performance." Would you recommend this as well?

2. I am indeed using SpywareBlaster along with Spybot. Do you prefer one over the other? If you prefer Spybot, should I uninstall SpywareBlaster? Or if you prefer SpywareBlaster, how do I disable the Spybot HOSTS?

Thanks again for your help!

[geek_love]

I guess I should add that, yes, since I installed SpywareBlaster I've noticed that my internet is slower - so I guess it's all related.

[Cat_w_9_lives]

If you uninstall Spybot it should uninstall the Host file too. Re DNS not sure from what I know it tells your computer that an numerical IP address = a alpha address, could be more open to errors or spoofing?

[plodr]

geek love, here is the malware thread
http://forums.majorgeeks.com/showthread.php?t=159736
if you lose a thread, just search for all posts by you and you should be able to get back to a lost thread.

[geek_love]

Thank you plodr. Good to know. Thanks all!