I’ll let you all know how that went when I’m done.

Bob

A good resource for looking up those Event log errors is http://www.eventid.net. I’ve seen DCOM+ cause problems for DNS Servers in Active Directory and for Microsoft Exchange Server, but I don’t believe it does anything for the local DNS as I’ve disabled the COM before on a machine and it still worked.

Microsoft says:
Warning If you disable DCOM, may you may lose operating system functionality. After you disable support for DCOM, the following may result:
? Any COM objects that can be started remotely may not function correctly.
? The local COM+ snap-in will not be able to connect to remote servers to enumerate their COM+ catalog.
? Certificate auto-enrollment may not function correctly.
? Windows Management Instrumentation (WMI) queries against remote servers may not function correctly.

Found here: http://support.microsoft.com/default.aspx?scid=kb;en-us;825750

Since it’s only used for remote COM functionality, it shouldn’t affect you and you don’t want/need WMI.

Hope this helps.

SF

One other I forgot to post.

http://www.snapfiles.com/get/winsockxpfix.html

Try that download. It is a Winsock registry repair tool for WinXP.

Greenie.

As for uninstalling DNS – I doesn’t appear to be possible. I already tried uninstalling TCP/IP and discovered that it’s not allowed.

As for registry entries – I agree PeterMac – and suspected that it might have been hacked to disable it – the question is how and where. I’m trying to do comparisons with a clean system also running WinXP Home – but the level and volume of detail is daunting.

The netsh tool is a whole new toybox. The exact command provided didn’t work, but there’s a LOT to look at there – Thanks VERY much dwiebesick!

Thanks greenie – for the IP articles – I’ll review them as well.

Bob
(a serious tool junkie)

A few good links for repairing issues with TCP/IP and Winsock on an XP system.

Hope this helps with the repair process.

http://support.microsoft.com/default.aspx?scid=kb;en-us;314067

http://support.microsoft.com/default.aspx?scid=kb;en-us;811259

I have to take a look at that Sysinternals tool. Sounds like a good one to have.

Greenie.

Yes, I’ve checked the DNS Client, and Yes, it’s running.

I’ve also loaded ntregmon (from the nice people at SysInternals) and watched registry calls go by while doing an nslookup. This showed that ControlSet001 did not recognize that DNS was there – there was a missing key, and further comparisons with a clean XP Home system showed more. So at this point, I’ll experiment with the Repair Console.

I’ll try to keep you all up on whatever I find, but any way you look at it, I love a challenge.

Bob

All – One point I should make clear here is that clearing out difficult spyware is one of the things I do for a living, so I (almost) never do a complete rebuild from scratch simply because of the nasties – I take pride in rooting them out (Pun intended). I use this cleaning activity as “fill-in” work when I don’t have other better paying jobs. This intended result is that I’m learning a LOT about exactly how spyware works. We’re planning on doing a webcast later this year on the subject of spyware.

All systems I work on get “ghosted” for backup safety, and the first cleaning is done with the “guest” hard disk driven from a known clean system with a combination of Norton Anti-Virus, Ad-aware, Pest Patrol, Microsoft Anti-Spyware, Spybot Search & Destroy, and Safer-Networking’s ADS Locator.

After that, then I reconnect the “guest” system to its own hard drive and allow it to boot, for further cleanup.

As for a rootkit, there didn’t appear to be any, but then it may have been wiped by some of the cleanup utilities

There are a number of error messages in the Event logs about services and such that aren’t starting. DCOM+ in particular – which I think might be related to this.

Neither the hosts nor the LMHOSTS files contain anything that I haven’t put there on purpose. As sonyfreek points out, the Hosts files works just fine for forcing names – that’s why I’ve been populating it – as a way of testing what’s broken. It’s DNS that’s not working.

Two things I’m exploring are 1) find the actual cause of this DNS malfunction and 2) Do a clean build of the OS after exporting the legit software registry for later re-import.

Bob

Another quick fix is to delete the Ethernet card from system devices and let the computer find it again.