DNS Not Working

[Chris LeFebvre]

I've got a friends XP Home machine that seemed like it had some
virus and spyware problems. I removed the rather bad anti-virus that she
had and installed and scanned with NOD32 3.x and it found and removed a
bunch of stuff.

Now I've got a really weird problem that I've never seen before, that
is that normal DNS resolutions seem to fail for no reason. One of the
things I normally do when fixing these types of problems with someones
computer is to run WinSockFix and this usually cleans up any damage that
removing Spyware crap has with TCP/IP communications. In this case I can
ping out just fine, also the anti-virus was able to download it's scan
database just fine and something like "nslookup www.yahoo.com" returns
correct results. However both IE7 and FireFox 3.1 are giving me "Page
can't be displayed" or "Can't find the server" messages. Also I can't
install Spybot Search & Destroy because the install process tries to
lookup and connect to their server and lookup fails and the install
won't continue past that point.

At the moment the computer is plugged into my Linksys router via the
10/100 Intel Pro/100 port but she does use a usb wireless adapter at her
place. The point I'm making is that ipconfig /all does list correct and
valid DNS servers. I've even deleted the network adapter from the device
manager and rebooted and let the system reinstall it and I still have
the same problem.

Does anyone have any idea's about how to correct this problem?

Thanks,

- Chris

 

[Malke]

I've got a friends XP Home machine that seemed like it had some
virus and spyware problems. I removed the rather bad anti-virus that she
had and installed and scanned with NOD32 3.x and it found and removed a
bunch of stuff.

Now I've got a really weird problem that I've never seen before, that
is that normal DNS resolutions seem to fail for no reason. One of the
things I normally do when fixing these types of problems with someones
computer is to run WinSockFix and this usually cleans up any damage that
removing Spyware crap has with TCP/IP communications. In this case I can
ping out just fine, also the anti-virus was able to download it's scan
database just fine and something like "nslookup www.yahoo.com" returns
correct results. However both IE7 and FireFox 3.1 are giving me "Page
can't be displayed" or "Can't find the server" messages. Also I can't
install Spybot Search & Destroy because the install process tries to
lookup and connect to their server and lookup fails and the install
won't continue past that point.

At the moment the computer is plugged into my Linksys router via the
10/100 Intel Pro/100 port but she does use a usb wireless adapter at her
place. The point I'm making is that ipconfig /all does list correct and
valid DNS servers. I've even deleted the network adapter from the device
manager and rebooted and let the system reinstall it and I still have
the same problem.

Does anyone have any idea's about how to correct this problem?

I would suggest more scanning for malware with MalwareBytes' Antimalware
(MBAM) and possibly Spybot S&D. In both cases, you can get the updates as a
separate file. When you install both those programs, you are given the
choice after installation finishes whether you want to go online to get
updates. You probably just missed this when you installed Spybot; it can
happen when you're quickly clicking "next", "next", "finish". ;-)

http://www.malwarebytes.org
http://www.safer-networking.org

Malke

 

[Chris LeFebvre]

Malke:

Okay, as you suggested I found the checkbox to prevent Spybot from
trying to download updates during the install so I have it installed and
downloaded the latest update packages on another computer and installed
that. The scan turned up a bunch of the usual things but nothing too
serious. After repairing the things it found and rebooting I've still
got the same problem. I tried LSPFix instead of WinSockFix and that
shows no problems and lists these dll's: mswsock.dll, winrnr.dll and
rsvpsp.dll.

I also ran the sfc /scannow and that didn't turn up anything either.

As far as I can tell TCP/IP connectivity is working, for instance if
I use the actual IP address for Google (http://209.85.165.99/) I can get
to the main search page in both IE and FireFox but of course any query
bombs because the DNS lookup from within the browser fails.

I've tried the latest HiJackThis! and I took a good look at all
browser helper objects and really don't see anything out of the
ordinary, just a bunch of toolbars.. Yahoo, Google, Aol.

I've used Process Explorer to look and see what's running and I don't
see anything out of the ordinary and I tried using RootKitRevealer since
that's about the last thing I can think of and that only turned up a
couple things and according to the Sysinternals forums none of them are
real problems just a few false positives.

I'm really at a loss as to the cause of the problem here, any other
idea's?

Thanks,

- Chris

 

[Chris LeFebvre]

Malke:

Sorry, I seem to have found the problem. I noticed that this machine
had SP3 installed, I uninstalled SP3 and after reboot the DNS problem
went away.

Is this some type of know issue with sp3?

Thanks,

- Chris

 

[Malke]

Malke:

Sorry, I seem to have found the problem. I noticed that this machine
had SP3 installed, I uninstalled SP3 and after reboot the DNS problem
went away.

Is this some type of know issue with sp3?

Some people have had issues. My partner and I have installed SP3 on hundreds
of machines with no problems, but in computing there are always exceptions.

http://www.google.com/search?hl=en&q=DNS+problems+after+SP3&btnG=Search
http://www.google.com/search?q=DNS+errors+after+SP3&btnG=Search&hl=en&sa=2

Using ICS?
http://support.microsoft.com/KB/951830

Support - Free unlimited installation and compatibility support is available
for Windows XP, but only for Service Pack 3 (SP3), until 14 Apr-09. Chat
and e-mail support is available only in the United States and Canada.

US -
http://support.microsoft.com/oas/default.aspx?ln=en-us&prid=11273&gprid=522131
CA -
http://support.microsoft.com/oas/default.aspx?ln=en-ca&prid=11273&gprid=522131
UK -
http://support.microsoft.com/oas/default.aspx?ln=en-uk&prid=11273&gprid=522131
AU -
http://support.microsoft.com/oas/default.aspx?ln=en-au&prid=11273&gprid=522131
Other - http://support.microsoft.com/oas/default.aspx?gprid=1173 | select
Windows XP | select Windows XP Service Pack 3

Malke