Archived from groups: microsoft.public.win2000.dns (More info?)

W2K SP4 Have s similar problem to a prior post on here
already. WS is on a network along with several other WS on
a W2K domain server.

I can ping IP adresses locally on our intranet and out on
to the internet. Can ping a known DNS server out on the
internet and get a reply back from all locations. Canot
ping using a www.xxxx.com and get a reply back

I cannot access any web site requiring DNS translation
from within IE however, can open the web pages of known
sources that have the IP address for.

Have already checked the host file (clean). Have ran a
couple of winsock repair tools, have edited the registry
for winsock and winsock32 and imported registry settings
from one of the working WS. Have ran adaware etc and
cleaned up everything that I could - all to no avail.

A second WS is showing the same problems today which makes
me very nervous that something is getting in, while I
haven't found the resolve for the first one yet.

I amhoping that someone out there can point me in the
right direction to a resolve. There has tobe something I
am not thinking about or something that someone has found
that will work.

Regards

Bill

Archived from groups: microsoft.public.win2000.dns (More info?)

In news:85c701c495d8$4bd21430$a501280a@phx.gbl,
W. C. Earl <anonymous@discussions.microsoft.com> made a post then I
commented below
> W2K SP4 Have s similar problem to a prior post on here
> already. WS is on a network along with several other WS on
> a W2K domain server.
>
> I can ping IP adresses locally on our intranet and out on
> to the internet. Can ping a known DNS server out on the
> internet and get a reply back from all locations. Canot
> ping using a www.xxxx.com and get a reply back
>
> I cannot access any web site requiring DNS translation
> from within IE however, can open the web pages of known
> sources that have the IP address for.
>
> Have already checked the host file (clean). Have ran a
> couple of winsock repair tools, have edited the registry
> for winsock and winsock32 and imported registry settings
> from one of the working WS. Have ran adaware etc and
> cleaned up everything that I could - all to no avail.
>
> A second WS is showing the same problems today which makes
> me very nervous that something is getting in, while I
> haven't found the resolve for the first one yet.
>
> I amhoping that someone out there can point me in the
> right direction to a resolve. There has tobe something I
> am not thinking about or something that someone has found
> that will work.
>
> Regards
>
> Bill

Howlong has this been going on?
What sort of internet conenction do you have? ADSL? Could be an MTU issue.

MTU - How to test and how to set in registry:
http://gw.renner.bei.t-online.de/windowsxp/mtu.htm

Optimal MTU configuration for PPPoE ASDL Connections:
http://www.mynetwatchman.com/kb/ADSL/pppoemtu.htm

Troubleshooting MTU Size in PPPoE Dialin Connectivity-ADSL - Cisco ...:
http://www.cisco.com/en/US/tech/tk [...] 3bc7.shtml


--
Regards,
Ace

Please direct all replies ONLY to the Microsoft public newsgroups
so all can benefit.

This posting is provided "AS-IS" with no warranties or guarantees
and confers no rights.

Ace Fekay, MCSE 2003 & 2000, MCSA 2003 & 2000, MCSE+I, MCT, MVP
Microsoft Windows MVP - Windows Server - Directory Services

Security Is Like An Onion, It Has Layers
HAM AND EGGS: A day's work for a chicken;
A lifetime commitment for a pig.
--
=================================

Archived from groups: microsoft.public.win2000.dns (More info?)

In news:85c701c495d8$4bd21430$a501280a@phx.gbl,
W. C. Earl <anonymous@discussions.microsoft.com> made a post then I
commented below
> W2K SP4 Have s similar problem to a prior post on here
> already. WS is on a network along with several other WS on
> a W2K domain server.
>
<snip>

You can also test resolution with nslookup. It doesn't use the machines' DNS
client resolver service but rather its own built in method. You can also set
it to use an external DNS server.

Ace

Archived from groups: microsoft.public.win2000.dns (More info?)

Ace,

Thanks for the response, the issue experienced happened
all of a sudden and on the one WS since last Thursday.
The other WS affected either started late yesterday or
very early this am. On the 1st WS a user was on the net in
the am then went to go back on after lunch and it wouldn't
work.

The one thing that is interesting is that the 2 WS this is
happening on happens to have had the same user surfing on
them. I suspect the same sites were visited by the user.
I have cleared out IE but this didn't help.

Two things that I forgot to mention in my origional post
are IE errors with a "cannot find DNS server" message.
The other is on boot and intialization of services NAV is
returning a TCP error code 1003,13 and can't initialize
email scanning.

It seems to me I am fighting a TCP/IP stack issue that I
haven't been able to resolve yet that is somehow affecting
its DNS ability.

I have forced the update of Norton with the latest
definition tables and ran a virus scan but nothing was
found.

Does any of this further information trigger any more
thoughts or suggestions?

Regards

Bill
>-----Original Message-----
>In news:85c701c495d8$4bd21430$a501280a@phx.gbl,
>W. C. Earl <anonymous@discussions.microsoft.com> made a
post then I
>commented below
>> W2K SP4 Have s similar problem to a prior post on here
>> already. WS is on a network along with several other WS
on
>> a W2K domain server.
>>
>> I can ping IP adresses locally on our intranet and out
on
>> to the internet. Can ping a known DNS server out on the
>> internet and get a reply back from all locations. Canot
>> ping using a www.xxxx.com and get a reply back
>>
>> I cannot access any web site requiring DNS translation
>> from within IE however, can open the web pages of known
>> sources that have the IP address for.
>>
>> Have already checked the host file (clean). Have ran a
>> couple of winsock repair tools, have edited the registry
>> for winsock and winsock32 and imported registry settings
>> from one of the working WS. Have ran adaware etc and
>> cleaned up everything that I could - all to no avail.
>>
>> A second WS is showing the same problems today which
makes
>> me very nervous that something is getting in, while I
>> haven't found the resolve for the first one yet.
>>
>> I amhoping that someone out there can point me in the
>> right direction to a resolve. There has tobe something
I
>> am not thinking about or something that someone has
found
>> that will work.
>>
>> Regards
>>
>> Bill
>
>Howlong has this been going on?
>What sort of internet conenction do you have? ADSL? Could
be an MTU issue.
>
>MTU - How to test and how to set in registry:
>http://gw.renner.bei.t-online.de/windowsxp/mtu.htm
>
>Optimal MTU configuration for PPPoE ASDL Connections:
>http://www.mynetwatchman.com/kb/ADSL/pppoemtu.htm
>
>Troubleshooting MTU Size in PPPoE Dialin Connectivity-
ADSL - Cisco ...:
>http://www.cisco.com/en/US/tech/tk175/tk15/technologies_te
ch_note09186a0080093bc7.shtml
>
>
>--
>Regards,
>Ace
>
>Please direct all replies ONLY to the Microsoft public
newsgroups
>so all can benefit.
>
>This posting is provided "AS-IS" with no warranties or
guarantees
>and confers no rights.
>
>Ace Fekay, MCSE 2003 & 2000, MCSA 2003 & 2000, MCSE+I,
MCT, MVP
>Microsoft Windows MVP - Windows Server - Directory
Services
>
>Security Is Like An Onion, It Has Layers
>HAM AND EGGS: A day's work for a chicken;
>A lifetime commitment for a pig.
>--
>=================================
>
>
>.
>

Archived from groups: microsoft.public.win2000.dns (More info?)

Ace,

I have never used nslookup before so before can be
effective or use have to do some research into its use.

I have posted further information in my other reply mybe
this info will trigger something for you.

Thanking you for your response.

Regards

Bill
>-----Original Message-----
>In news:85c701c495d8$4bd21430$a501280a@phx.gbl,
>W. C. Earl <anonymous@discussions.microsoft.com> made a
post then I
>commented below
>> W2K SP4 Have s similar problem to a prior post on here
>> already. WS is on a network along with several other WS
on
>> a W2K domain server.
>>
><snip>
>
>You can also test resolution with nslookup. It doesn't
use the machines' DNS
>client resolver service but rather its own built in
method. You can also set
>it to use an external DNS server.
>
>Ace
>
>
>.
>

Archived from groups: microsoft.public.win2000.dns (More info?)

In news:89ae01c49625$14b09650$a301280a@phx.gbl,
anonymous@discussions.microsoft.com <anonymous@discussions.microsoft.com>
made a post then I commented below
> Ace,
>
> Thanks for the response, the issue experienced happened
> all of a sudden and on the one WS since last Thursday.
> The other WS affected either started late yesterday or
> very early this am. On the 1st WS a user was on the net in
> the am then went to go back on after lunch and it wouldn't
> work.
>
> The one thing that is interesting is that the 2 WS this is
> happening on happens to have had the same user surfing on
> them. I suspect the same sites were visited by the user.
> I have cleared out IE but this didn't help.
>
> Two things that I forgot to mention in my origional post
> are IE errors with a "cannot find DNS server" message.
> The other is on boot and intialization of services NAV is
> returning a TCP error code 1003,13 and can't initialize
> email scanning.
>
> It seems to me I am fighting a TCP/IP stack issue that I
> haven't been able to resolve yet that is somehow affecting
> its DNS ability.
>
> I have forced the update of Norton with the latest
> definition tables and ran a virus scan but nothing was
> found.
>
> Does any of this further information trigger any more
> thoughts or suggestions?
>
> Regards
>
> Bill

Yes this does shine some light. I've been dealing with hijacked machines
lately with my clients and this sure sounds like it, especially if the same
user went to the same website. I have one client that goes to orbitz.com
(among many others) that are known spyware and adware sites. Her machine was
completely useless, can't go anywhere, DNS errors in the browser, among many
other things.

If this is as I suspect, the machine needs to be cleaned out using a combo
of Adaware, Spybot, HIjackthis. Check the Run key in the reg to see if
there's anyother stuff than what should be there be default or your current
apps installed on it. If you see oddball stuff and not sure what it is, use
Google to search for it. Hijackthis can create a log that you can upload to
a site that is listed in the help and they can analyze it for you.

You'll have to come up with some sort of policy to stop this in the future.
Adaware Pro is a great tool to lock down machines, in conjunction with AV
software.

--
Regards,
Ace

Please direct all replies ONLY to the Microsoft public newsgroups
so all can benefit.

This posting is provided "AS-IS" with no warranties or guarantees
and confers no rights.

Ace Fekay, MCSE 2003 & 2000, MCSA 2003 & 2000, MCSE+I, MCT, MVP
Microsoft Windows MVP - Windows Server - Directory Services

Security Is Like An Onion, It Has Layers
HAM AND EGGS: A day's work for a chicken;
A lifetime commitment for a pig.
--
=================================

Archived from groups: microsoft.public.win2000.dns (More info?)

Ace,

I may have stumbled on the culprit as I now have one of
the two WS back working and able to access the DNS
properly again. I found that the user in question had
just download the Living Marine Aquarium from
screensavers.com. On the WS I was spending my time on
this did not show up in add/remove programs sodidn't
realize this had been done. When I checked the other
system I spotted this and of course removed it as I have a
pet peeve about this kind of stuff. Immediately I had the
internet back on this system and my DNS was back to normal
response.

I have emailed screensavers.com for an uninstall utility
that I can use on ther other system to see if this holds
true for it also.

I will post back when I get and let know if this also
works on the other system.

Regards

Bill
>-----Original Message-----
>In news:89ae01c49625$14b09650$a301280a@phx.gbl,
>anonymous@discussions.microsoft.com
<anonymous@discussions.microsoft.com>
>made a post then I commented below
>> Ace,
>>
>> Thanks for the response, the issue experienced happened
>> all of a sudden and on the one WS since last Thursday.
>> The other WS affected either started late yesterday or
>> very early this am. On the 1st WS a user was on the net
in
>> the am then went to go back on after lunch and it
wouldn't
>> work.
>>
>> The one thing that is interesting is that the 2 WS this
is
>> happening on happens to have had the same user surfing
on
>> them. I suspect the same sites were visited by the
user.
>> I have cleared out IE but this didn't help.
>>
>> Two things that I forgot to mention in my origional post
>> are IE errors with a "cannot find DNS server" message.
>> The other is on boot and intialization of services NAV
is
>> returning a TCP error code 1003,13 and can't initialize
>> email scanning.
>>
>> It seems to me I am fighting a TCP/IP stack issue that I
>> haven't been able to resolve yet that is somehow
affecting
>> its DNS ability.
>>
>> I have forced the update of Norton with the latest
>> definition tables and ran a virus scan but nothing was
>> found.
>>
>> Does any of this further information trigger any more
>> thoughts or suggestions?
>>
>> Regards
>>
>> Bill
>
>Yes this does shine some light. I've been dealing with
hijacked machines
>lately with my clients and this sure sounds like it,
especially if the same
>user went to the same website. I have one client that
goes to orbitz.com
>(among many others) that are known spyware and adware
sites. Her machine was
>completely useless, can't go anywhere, DNS errors in the
browser, among many
>other things.
>
>If this is as I suspect, the machine needs to be cleaned
out using a combo
>of Adaware, Spybot, HIjackthis. Check the Run key in the
reg to see if
>there's anyother stuff than what should be there be
default or your current
>apps installed on it. If you see oddball stuff and not
sure what it is, use
>Google to search for it. Hijackthis can create a log that
you can upload to
>a site that is listed in the help and they can analyze it
for you.
>
>You'll have to come up with some sort of policy to stop
this in the future.
>Adaware Pro is a great tool to lock down machines, in
conjunction with AV
>software.
>
>--
>Regards,
>Ace
>
>Please direct all replies ONLY to the Microsoft public
newsgroups
>so all can benefit.
>
>This posting is provided "AS-IS" with no warranties or
guarantees
>and confers no rights.
>
>Ace Fekay, MCSE 2003 & 2000, MCSA 2003 & 2000, MCSE+I,
MCT, MVP
>Microsoft Windows MVP - Windows Server - Directory
Services
>
>Security Is Like An Onion, It Has Layers
>HAM AND EGGS: A day's work for a chicken;
>A lifetime commitment for a pig.
>--
>=================================
>
>
>.
>

Archived from groups: microsoft.public.win2000.dns (More info?)

In news:933701c496be$910da640$a501280a@phx.gbl,
anonymous@discussions.microsoft.com <anonymous@discussions.microsoft.com>
made a post then I commented below
> Ace,
>
> I may have stumbled on the culprit as I now have one of
> the two WS back working and able to access the DNS
> properly again. I found that the user in question had
> just download the Living Marine Aquarium from
> screensavers.com. On the WS I was spending my time on
> this did not show up in add/remove programs sodidn't
> realize this had been done. When I checked the other
> system I spotted this and of course removed it as I have a
> pet peeve about this kind of stuff. Immediately I had the
> internet back on this system and my DNS was back to normal
> response.
>
> I have emailed screensavers.com for an uninstall utility
> that I can use on ther other system to see if this holds
> true for it also.
>
> I will post back when I get and let know if this also
> works on the other system.
>
> Regards
>
> Bill

Don't you just love it when your users install stuff (even inadvertenly by
just visting a website) that they shouldn't be not realizing the
ramifications?

Ace