Sonicwall VPN Client and Hosts files are not working... I think its spyware

One of our users laptops stopped resoulving host file entries correctly. For example:

Hosts entry

192.168.1.10    SVRHOME

The public IP for that private network is 26.120.23.5 and is set as the Gateway IP Address for the VPN connection.


When I ping SVRHOME it resolves the public address 26.120.23.5 instead of the entry that is in the hosts file, 192.168.1.10.
I checked for spyware and did find mysearch bar installed. So I ran hijackthis and removed the entries and then ran Adaware to find anything else.
I then booted into safemode under the local admin account and deleted the files in Temp, Temp Internet, and PreFetch.
Booted back up, adaware again which came back clean and then ran winsockfix.
After the reboot I tested it again and it was doing the same thing. So I then uninstalled the VPN client software and rebooted then reinstalled it.

Still resolving the wrong IP. Any ideas? I saw this one other time and gave up and just built the use a new laptop. Since this is the second time this has happend I would like to find a solution.
noodleNTAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

jodypeetCommented:
has you vpn connection got "allow netbios traffic" set ?
try a tracert to svrhome

0
barrymercerCommented:
I'd just double check a few things. Make sure there's no extra extension on the file it shold just be called "hosts", sometimes programs like to add .txt or whatever to the end of it. Also, make sure that nothing apart from "hostname ip"
appears in it, except for the comments of course.

Fqiling that, can you post it so we can have a look? remove the IPs if you're worried.
0
noodleNTAuthor Commented:
The host file was fine. I even gave the guy mine thinking his got corrupted. There is no file extension on the host file or anything in the file.

Example of the host file:

127.0.0.1       localhost

192.168.10.10      svrmail
192.168.10.10      svrmail.mydomain.com
192.168.10.10      ftp.city.mydomain.com
192.168.10.50      svrfiles
192.168.10.50      svrfiles.mydomain.com
0
Hey MSSPs! What's your total cost of ownership?

WEBINAR: Managed security service providers often deploy & manage products from a variety of solution vendors. But is this really the best approach when it comes to saving time AND money? Join us on Aug. 15th to learn how you can improve your total cost of ownership today!

noodleNTAuthor Commented:
Any Ideas?
0
jodypeetCommented:
are both his laptop and the domain using class C subnet masks ?
0
noodleNTAuthor Commented:
I got it working:

TCP/IP Properties\Advanced\Options Tab
TCP/IP Filtering was Enabled and set to Permit only for chech port and protocal with each field blank. In essence blocking everything. (I think spyware did this.)

Then replaced all files in c:\windows\sytem32\drivers\etc with ones from a working laptop. (For the hell of it.)
0
DarthModCommented:
Submitted to PAQ with points refunded (500)

DarthMod
Community Support Moderator
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
noodleNTAuthor Commented:
Happend to someone new today and the damn fix above wont fix it!! ARG!
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Networking

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.