Windows XP DNS Resolution Issues

[Radio2006]

Hello all,

Having a very interesting situation here. Working on PC for a friend who stated that it connected to the network, but was unable to browse to any sites using Internet Explorer and Google Chrome...

After re-creating the issue, I began with pinging the Default Gateway. Successful.
Then I pinged the DNS servers...successful.
Then I pinged www.google.com...unsuccessful.

So I immediately thought, DNS servers! So I pinged them...successful. And that is where I am stuck. Nslookup doesn't work for anything. I shifted to Google DNS servers and pinged them...successful, but no browsing.

I then shifted to OpenDNS servers and pinged them...successful, but still no browsing. I uninstalled and reinstalled drivers for both NICS...wireless and LAN. I disabled all firwall and anti-virus protection and I verified that all applicable services were up and op, i.e., DNS Client, DHCP Client, Network Connections and all that.

Using a Windows 7 laptop, on the same network, with the same DNS and IP settings, I am able to connect, browse, ping, and resolve to IP address. But not on the Windows XP laptop.

XP Laptop Specs are as follows:

Acer Extensa 4220
Windows X SP 3 32-bit
1 GB DDR2
80GB HDD
Broadcom Gigabit Ethernet Controller
Broadcom 802.11b/g WLAN Controller

I have no clue how to proceed, so if there are any ideas out there, I would love to hear them.

[JorgeM]

This could be malware related.

You could also verify if DNS request packets are even leaving the PC by installing and running a packet capture but that will only be helpful if you know how to read those captures.

When you open a CMd prompt and use NSLOOKUP you get no results from the DNS server?

[CimmerianX]

Curious. You could also look at XP local HOSTS file and see if there is anything 'funny' in there. You could also try manually adding a name with IP and see if you can ping that added name from command line.

[JorgeM]

The hosts file is a good test to see if your DNS client is working without depending on a DNS server. However, when you use the NSLOOKUP utility, you are bypassing local name resolution processes and directly communicating with the DNS server.

Even the PING command will leverage local name resolution processes. Here is a summary regarding client side name resolution processes (Windows): http://www.itgeared.com/articles/1090-microsoft-windows-tcpip-netbios-and/

[Reverend Jim]

What happens if you open your browser and type

http://74.125.225.115/

into the address bar and press ENTER? It should bring up Google.

[Radio2006]

@JorgeM, correct. Even after verifying that I can ping the DNS servers, the nslookup fails saying that it could not contact the DNS servers. I agree with your malware theory. I will scan and see. I can ping any IP address with no issues, but trying to browse with other IP's, like Google's, nothing happens.

@CimmerianX, true. I forgot about the HOSTS files. As soon as I get the computer back, I will take a look.

@Reverend Jim, even when I type in the IP...nothing which baffles me as I am pretty sure this may be a DNS problem...but with those results I am not sure what to think.

[Reverend Jim]

If nothing happens when you use the IP address then I don't think it is a DNS problem because there is no name resolution being done.

[Radio2006]

I agree...I am going to get a packet analyzer on the machine and take a look at what is going on...that won't be until Tuesday though so if you guys can bear with me until then, it would be greatly appreciated...and thanks for the help so far.

[Radio2006]

Nothing I have seen is out of the ordinary. I believe it may be an anti-virus software issue that is causing the problem. Since all anti-virus software has been removed and the issue remains, I will be forced to conduct a clean-install. I generally don't like to nuke the issue, but at least I know it will kill the problem. Thanks for your assistance guys!

[JorgeM]

Unfortunately, sometimes nuking the system is the only efficient and effective solution remaining.