Experts,
You would think something like this would be an easy solution, but I've probably spent a good few hours looking into it to find absolutely nothing worthwhile. Naturally, I give the fate of this to all fellow Experts.
So my understanding of XP and how it handles dns (correct me if I'm wrong) follows.
Note : Assuming the "Dns Client" service and dependencies "TCP/IP Protocol" are running,
1) If the dns/IP address is not in the dns cache it will first check the registry to find out where the host file is located.
\HKEY_LOCAL_MACHINE\SYSTEM
\CurrentCo
ntrolSet\S
ervices\Tc
pip\Parame
ters\DataB
asePath
2) Will load up the host file to see if the dns name is located within. If not, it sends a broadcast to the preferred dns server, in hopes that will resolve the dns address to an IP.
3) The router looks at the dns name in it's own dns cache and if the dns name isn't located there, it goes to it's dns server and so forth until it resolves the dns name to an ip.
That's atleast my understanding of how XP resolves dns names.
Now to get to the problem. I realize that XP has a tendency of not using the host file (for whatever reason) and that's all fine and dandy since I don't really need it per-say. However, while trying to ping grisoft.com, it returns my loopback, 127.0.0.1. When I ping google, it resolves the dns name to an ip and everything is A-ok.
I should say that this computer had spyware (which added around 200 entries to the original host file) as well as a few viruses and trojans. After removing (hopefully) all that could be seen, I was faced with this new issue.
Steps I've tried in no particular order.. But numerous times on a few of them.
1) ipconfig /flushdns
2) Made sure the registry was pointing to the correct host file.
3) Ran Hijackthis to make sure nothing was running in the background.
4) Added static entries to the host file (seemed like Windows bypassed it anyways). Renamed host file to allow windows to possibly recreate one. Created a new host file. Copied the host file from another machine.
5) Made a bogus dns preferred/alternate entry
6) Winsock repair
7) lsp repair
8) Searched registry for any entry for "Grisoft" and the loopback address
9) Made sure no bogus proxy was being used - anywhere - .
10) Restarted machine before and after each change (including ipconfig /flushdns)
Can't remember exactly what else I've tried.. It almost seems like XP is using an old host file somewhere (apart from C:\Windows\System32\Driver
s\etc\). I'm not entirely sure as I'm not 100% clear on the order of how XP resolves DNS names.
Any help whatsoever would be appreciated.. Also, I realize I could merely reimage the PC and redo everything, but I'm a firm believer in getting my hands dirty and trying to fix it the long and hard way.
Thank you kindly guys!
Start Free Trial
