Waxa aan ku rakibay ESET Smart Security mid ka mid ah kombayutaradayda waxaana dhawaan helay fariin digniin ah oo leh sidan soo socota:

Detected DNS Cache Poisoning Attack is detected by the ESET personal firewall

Hooy! Taasi hubaal uma ekayn mid aad u wanaagsan. Weerarka sunta ah ee DNS cache-ga ayaa asal ahaan la mid ah sida ^(DNS)DNS spoofing, taas oo asal ahaan ka dhigan tahay in magaca DNS server cache la jabsaday iyo marka la codsanayo bogga internetka, halkii laga heli lahaa server-ka dhabta ah, codsiga waxaa loo wareejinayaa kombuyuutar xaasidnimo ah oo soo dejisan kara spyware. ama fayrasyada kombiyuutarka.

Waxaan go'aansaday inaan sameeyo iskaanka fayraska oo buuxa oo aan sidoo kale soo dajiyay Malwarebytes oo aan iskaan ka sameeyay malware. Midkoodna wax iskaanka ahi ma soo bixin, markaa waxaan bilaabay inaan sameeyo cilmi-baaris yar oo dheeraad ah. Haddii aad eegto shaashadda kore, waxaad arki doontaa in ciwaanka 'remote' ee IP-ga uu dhab ahaantii yahay cinwaanka IP-ga maxalliga ah (192.168.1.1). Ciwaanka IP-ga ayaa dhab ahaantii u dhacaya inuu noqdo ciwaanka IP-ga ee router-kayga! Markaa router-kayga ayaa sumaynaya kaydkayga DNS^(DNS) ?

Runtii maaha! Sida laga soo xigtay ESET , waxay mararka qaarkood si lama filaan ah u ogaan kartaa taraafikada IP gudaha router ama qalab kale sida khatarta suurtagalka ah. Tani xaqiiqdii waxay ii ahayd xaalad aniga sababtoo ah ciwaanka IP-gu wuxuu ahaa IP maxalli ah. Haddii aad hesho fariinta oo ciwaanka IP-gaagu uu ku dhaco mid ka mid ah safafkan hoose, markaa waa uun taraafikada gudaha oo looma baahna in laga walwalo:

192.168.x.x

10.x.x.x

172.16.x.x to 172.31.x.x

Haddii aysan ahayn ciwaanka IP-ga maxalliga ah, hoos ugu dhaadhac tilmaamaha dheeraadka ah. Marka hore^(First) , waxaan ku tusi doonaa waxa la sameeyo haddii ay tahay IP maxaliga ah. Horey u soco oo fur barnaamijka ESET Smart Security oo aad wadahadalka Settings Advanced . ^{(Advanced Settings)}Balaadhi Shabakadda^(Network) , ka dib Firewall-ka shakhsi ahaaneed^{(Personal Firewall )} oo guji Xeerarka iyo aagagga^{(Rules and zones)} .

Guji badhanka Setup ee hoos yimaada ^(Setup)Aagga iyo tifaftiraha qaanuunka^{(Zone and rule editor)} oo guji tab^(Zones) aagga . Hadda dhagsii ciwaanka laga saaray ilaalinta firfircoon (IDS)^{(Address excluded from active protection (IDS) )} oo dhagsii wax ka beddel^(Edit) .

Marka xigta wada hadal dejinta ^(setup)aagga^(Zone) ayaa soo muuqan doona oo halkan waxaad dooneysaa inaad gujiso ku dar cinwaanka IPv4^{(Add IPv4 address)} .

Hadda sii wad oo ku qor cinwaanka IP-ga ee ay ku taxan tahay markii ESET ay ogaatay khatarta.

Guji OK^{(Click OK)} dhowr jeer si aad dib ugu noqoto barnaamijka ugu muhiimsan. Waa inaadan mar dambe helin farriimaha hanjabaadda ah ee ku saabsan weerarrada sumowga DNS ee ka imanaya ciwaanka IP-ga maxalliga ah. Haddii aysan ahayn ciwaanka IP-ga maxalli ah, taasi waxay la macno tahay in aad dhab ahaantii dhibane u tahay xatooyada DNS ! Xaaladdaas, waxaad u baahan tahay inaad dib u dejiso faylkaaga Windows Hosts oo aad nadiifiso kaydka DNS ee nidaamkaaga.^(DNS)

Dadka ku sugan ESET^(ESET) waxay abuureen faylka EXE oo aad kaliya soo dejisan karto oo aad ku ordi karto si aad u soo celiso faylka asalka ah ee Hosts oo aad nadiifiso kaydka DNS .

https://support.eset.com/kb2933/

Haddii aadan rabin inaad isticmaasho feylkooda EXE sabab kasta ha noqotee, waxaad sidoo kale isticmaali kartaa Fix It soo dejinta Microsoft si loo soo celiyo faylka martida loo yahay:

https://support.microsoft.com/en-us/help/972034/how-to-reset-the-hosts-file-back-to-the-default

Si aad gacanta ugu nadiifiso kaydka DNS ee kumbiyuutarka ^(DNS)Windows , fur degdegga amarka oo ku qor xariiqda soo socota:

ipconfig /flushdns

Caadiyan dadka intiisa badan weligood ma noqon doonaan dhibanayaal ku dhaca DNS -ka waxaana laga yaabaa inay fikrad fiican tahay in la joojiyo dabka ESET oo kaliya la isticmaalo firewall-ka Windows . Anigu shakhsi ahaan waxaan ogaaday in ay keento waxyaabo badan oo been abuur ah oo ay ku dhamaato cabsigelinta dadka si ka badan sidii ay dhab ahaantii u ilaalin lahayd. Ku raaxayso!

Fix Detected DNS Cache Poisoning Attack Message

I have ESET Smart Sеcurity іnstalled on one of my PCs and I recently got an alert message saying the following:

Detected DNS Cache Poisoning Attack is detected by the ESET personal firewall

Whoops! That definitely didn’t sound too good. A DNS cache poisoning attack is basically the same thing as DNS spoofing, which basically means the DNS name server cache has been compromised and when requesting a webpage, instead of getting the real server, the request is redirected to a malicious computer that can download spyware or viruses to the computer.

I decided to perform a full anti-virus scan and also downloaded Malwarebytes and did a scan for malware too. Neither scan came up with anything, so then I started doing a little bit more research. If you look at the screenshot above, you’ll see that the ‘remote’ IP address is actually a local IP address (192.168.1.1). That IP address actually happens to be my router IP address! So my router is poisoning my DNS cache?

Not really! According to ESET, it can sometimes accidentally detect internal IP traffic from a router or other device as a possible threat. This was definitely the case for me because the IP address was a local IP. If you get the message and your IP address falls in an of these ranges below, then it’s just internal traffic and there is no need to worry:

192.168.x.x

10.x.x.x

172.16.x.x to 172.31.x.x

If it’s not a local IP address, scroll down for further instructions. First, I’ll show you what to do if it’s a local IP. Go ahead and open up the ESET Smart Security program and go to the Advanced Settings dialog. Expand Network, then Personal Firewall and click on Rules and zones.

Click on the Setup button under Zone and rule editor and click on the Zones tab. Now click on Address excluded from active protection (IDS) and click Edit.

Next a Zone setup dialog will appear and here you want to click on Add IPv4 address.

Now go ahead and type in the IP address that it listed when ESET detected the threat.

Click OK a couple of times to go all the way back to the main program. You should no longer get any threat messages about DNS poisoning attacks coming from that local IP address. If it’s not a local IP address, that means you might actually be a victim of DNS spoofing! In that case, you need to reset your Windows Hosts file and clear the DNS cache on your system.

The folks at ESET created an EXE file that you can just download and run to restore the original Hosts file and flush the DNS cache.

https://support.eset.com/kb2933/

If you don’t want to use their EXE file for whatever reason, you can also use the following Fix It download Microsoft to restore the Hosts file:

https://support.microsoft.com/en-us/help/972034/how-to-reset-the-hosts-file-back-to-the-default

To manually clear the DNS cache on a Windows PC, open the command prompt and type in the following line:

ipconfig /flushdns

Normally most people will never be victims of DNS spoofing and it may be a good idea to disable the ESET firewall and just use the Windows firewall. I personally have found that it brings up too many false positives and ends up scaring people more than actually protecting them. Enjoy!

Related posts

• Hagaaji "Setup wuxuu kuu diyaarinayaa kumbiyuutarkaaga isticmaalka ugu horreeya" Dib u-bilaabid kasta

• Sida loo hagaajiyo 'RPC Server waa lama heli karo' qalad gudaha Windows

• Sida loo Hagaajiyo "Ilaalinta Kheyraadka Windows Ma Samayn Karto Hawlgalkii La Codsaday" Khaladka

• Sida loo Hagaajiyo Gacsiga Khaladaadka Khibrada Khibrada 0x0003

• Sida Loo Hagaajiyo Amazon Dabka Tablet Aan Dalacin

• Sida loo hagaajiyo "dns_probe_started" gudaha Google Chrome

• Hagaaji "Lama Heli Karo Shaygan" Marka la tirtirayo Windows

• Isticmaal amarradan degdega ah si aad u hagaajiso ama u hagaajiso faylalka musuqmaasuqa

• Fix "Qalabka shabakadda wireless-ka ee aan la taageerin waa la helay. Nidaamkii waa la joojiyay" Khaladka

• Sida loo hagaajiyo Hulu Code Error Code p-dev320

• Sida Loo Galo Muuqaalka Badbaado ee Mode Si loo Xaliyo Arrimaha

• Sida loo hagaajiyo furayaasha fallaadha ee aan ku shaqayn Excel

• Sida loo hagaajiyo Windows 10 Taskbar Aan Shaqeyn

• Hagaaji "Tilmaanta xusuusta la tixraacayo lama akhrin karo" khaladaadka

• Sida loo hagaajiyo Khaladaadka Google Play Store

• Sida loo hagaajiyo shilalka Flash ee Internet Explorer 11

• Sida loo hagaajiyo "Kombuyutarkaga dhibaato ayuu galay wuxuuna u baahan yahay inuu dib u bilaabo" qalad

• Hagaaji "Qalabkani ma isticmaali karo Module Platform la Aaminsanyahay" Marka la sahlayo BitLocker

• Sida loo hagaajiyo Hotspot-ka oo aan ku shaqayn Android

• Sida loo hagaajiyo uTorrent ku xirnaanshaha asxaabta