Possible DNS Virus?

I've got a computer here that will not load web pages. If I go into a command prompt, and ping www.google.com, I get nothing. Actually, I get "Ping request could not find host www.google.com. Please check the name and try again." But if I ping 72.14.205.99 (one of Google's IP Addresses), I get 4 Packets Received.

Same with the web browser. I type in www.google.com, and I get The webpage cannot be found. I type 72.14.205.99, and Google comes up.

I think I've got it narrowed down to the PC itself. When I hook my laptop into the same cable, everything is fine. My guess is some type of virus is blocking the lookup.

Dell Dimension 4550
Windows XP Home SP2
512 MB RAM
Pentium 4 2.53 GHz
IE7 (7.0.5730.11)

I ran Malwayrebytes, thinking maybe some malware may be the problem. It found 8 problems, but fixing them solved nothing.

I can also ping the loopback so TCP/IP is good.

Thank you for any help!

I don't think, it's any infection.
It looks like DNS is messed up.
Numeric address is not being translated to regular address.

Start with some basic troubleshooting....

Turn off computer. Disconnect router, and modem from power source for 30 seconds.
Power them back on.
Restart computer.

If that doesn't work, bypass router, and connect computer straight to the modem.

If that doesn't work...
Go Start>Run (Start search in Vista), type in:
cmd
Click OK (in Vista, while holding CTRL, and SHIFT, press Enter).

In Command Prompt window, type in following commands, and hit Enter after each one:
ipconfig /flushdns
ipconfig /registerdns
ipconfig /release
ipconfig /renew

Restart computer.

If that doesn't work...
Go Start>Run (Start search in Vista), type in:
cmd
Click OK (in Vista, while holding CTRL, and SHIFT, press Enter).

At Command Prompt, type in:
netsh int ip reset reset.log
Hit Enter.
Type in:
netsh winsock reset catalog
Hit Enter.

Restart computer.


If that doesn't work...
Download, install, and run WinSockFix: http://www.softpedia.com/get/Tweak/N...nSockFix.shtml
Restart computer, and check again.

If that doesn't work...
Download Dial-A-Fix (DAF):
http://wiki.lunarsoft.net/wiki/Dial-...C_and_articles

Have XP CD available in case DAF needs a file. Likely not!

Check all boxes on the screen (clear any restrictions if it shows any)
Then click GO!

When the entire page is finished click the HammerHead at bottom to go to the second DAF page.

Here, one at a time, do the below:

Reinstall BITS
Reinstall Windows Firewall
Repair Permissions
Reset networking

Watch for any File not found or other errors and make note as this may lead to the fix!

Restart computer.

Thank you for the reply Broni.

I tried everything you suggested. When I got to Dial-A-Fix, I ran into some issues with IPSEC.exe, and that my version of Windows did not have it. So it couldn't go through with the fix. Could this be causing this?

That's where I'm at right now. Nothing has worked yet.

I don't think IPSEC.exe has anything to do with your problem, because IPSEC.exe is not required to run at computer startup.

See, if same thing happens in Safe Mode with Networking.

Trying this in Safe Mode was one of the first things I tried. My thinking was that something might have been running in the background, causing the DNS resolution process to cease. It didn't work then.

But I tried again since the newest reconfigurations, and I'm still getting the same issue. I can ping Google's IP Address, but I can't ping the Domain Name.

There are a ton of restore points. Should I try one of those?

Did you check "hosts" file?

Windows XP - C:\WINDOWS\SYSTEM32\DRIVERS\ETC

It's there, and only has the 127.0.0.1 localhost entry.

Yeah, that's fine.
The only other thing, that comes to my mind would be a problem either with router/modem, or bad NIC card. If one of those three malfunction, one of the possible results is lost ability to translate DNS.

The Modem/Router are good because my laptop works just fine. I never knew that a bad NIC would cause DNS issues. I'll slap a new one in, and see what happens. I'm going to cry if that's it. :(

Why? 15 bucks?

Haha, not the price. Because of the time it took to do all of this, and all it was was a bad $15 NIC. :D

I didn't guarantee anything :D

Yeah, I know you didn't guarantee it, and it's a good thing. Still having the same issue, even with the new NIC. This issue is such a crazy one.

Should I try and roll back to a previous check point under system restore? That's about the only thing I can think of.

You can give it a shot. Another possibility is some service(es) is not starting.
...or some damn infection?
However, it's bed time for me, so I'll check back tomorrow :)

Same here. Thanks for all the help Broni. Sorry to keep you up so late. LOL

I'm guessing there has to be an infection somewhere. I tried AVG, and it came up with many infections, "cured" them all, but still having the same issue.

Thanks again Broni, I'll be back at it again tomorrow.

Quote:

---

I tried AVG, and it came up with many infections

---

Aha. You may want to visit HJT section, and post required logs.

Open a command prompt and run "ipconfig /all" and paste the output please.

I had the same problem once. In XP i installed ipv6. I didn't even have it enabled but my ipconfig returned a very peculiar address. I uninstalled ipv6 and hey presto

I'll do that in a bit. I didn't notice anything strange as far as the addresses go. They were all Class C, IPv4. Right now, I'm doing all the necessary scans to post over in the HTJ section.

So, there was some serious infection, but after the cleaning ( http://discussions.virtualdr.com/sho...d.php?t=239299) the problem remains.

From the other thread:

Quote:

---

I don't know if this is anything, but under System Properties, it says Service Pack 2. But when I go into Add or Remove Programs, Windows XP Service Pack 3 is listed, but without a size. It just has Remove. Could there be an issue with the Service Pack?

---

Do you remember any attempt to install SP3, at some point, and what happened?
HJT log also says SP2, so this is what's really installed.

I want you to try one thing.
Uninstall AVG, using AVG Remover: http://www.avg.com/download-tools
If no positive change, reinstall.

I uninstalled AVG, and I'm still getting the same issue. The uninstallation of Service Pack 3 did not fix the issue either.

I'm going to try and do a Repair Install of Windows XP. Hopefully, that will work.

I cross my fingers, because I'm out of ideas....

I am as well. If this doesn't fix it, I guess we'll have to reformat and do a fresh install. I'll let you know how it goes. Right now, I'm making an Image of the drive as it stands right now. Then, I'll go and do the Repair Install.

I tell you Broni, this is the strangest problem I've come across yet.

Don't tell me. It's been driving me nuts as well.....

Well, I'm able to ping again after doing the Repair Install. But now, I'm trying to update Windows with SP2 and I keep getting a Access Denied error about half way through the installation.

So I looked it up on MS Support, and found this article:

http://support.microsoft.com/kb/873148

Changed the permissions on the registry key, ran SP2 install again. Same thing. Can I just skip to SP3, or do I need SP2 first. I'm sure I'll get the same error. Right now, it has SP1 installed.

One problem solved, another one says Hello! :D

Quote:

---

I'm able to ping again after doing the Repair Install

---

Do you mean, by domain name?

Yes, you can install SP3 without installing SP2 first.

Haha, I'm sorry. It was 3AM, and I was a bit tired. Yes, I can ping domain names again. I haven't opened up a browser until I get SP2 installed. But if I can ping the domain name, I should be able to.

I keep my fingers crossed :)

As for your problem with SP installation, try this:

Go Start>Run (Start Search in Vista), type in:
msconfig
Click OK (hit Enter in Vista).

Click on Startup tab.
Click Disable all

Click Services tab.
Put checkmark in Hide all Microsoft services
Click Disable all.

Click OK.
Restart computer in Normal Mode.

NOTE. If you use different firewall, than Windows firewall, turn Windows firewall on, just for this test, since your regular firewall won't be running.
If you use Windows firewall, you're fine.

Try installation now.

Are you installing through Windows Update, or standalone?

A standalone. I didn't want to open up any browsers until I had at least SP2 installed.

Good move...

I got the SP2 Denied Access issue figured out Broni. What I ended up doing is going into regedit and giving the Administrator Group Full and Read Permissions for the HKEY_CLASSES_ROOT hive.

For some reason, the Admin did not have these permissions, so when SP2's installation tried to change some of the registry keys, it was denied and the installation was stopped.

I read somewhere that you had to have SP1a installed or SP2 installed before you were allowed to install SP3. Is this true? If so, I don't think I had SP1a, it was just SP1.

Thank you very much Broni for going through this with me. I learned alot. Thanks to themanwhowas for his input as well. Still wish I knew how to properly read a HJT log though. :D

So to summarize, I had to do a repair installation of Windows XP Home to remedy the DNS issue. I guess we'll never know what actually caused the problem.

You're very welcome :)
I'm very glad, your problem has been fixed :)