SP4 kills DNS?

[bob]

After upgrading a workstation with SP4, DNS stopped working.

I have two machines next to each other. Using nslookup works on one but
not the other. Both have the same DNS entry (my firewall).

The one that fails says:
*** Can't find server name for address x.x.x.x: No response from server
*** Default servers are not available
Server: Unknown
Address: x.x.x.x

If I lookup the address and type it into the browser (like
64.233.187.104 for google) it works just fine.


The problem impacts browsing, email, news.

There are entries in the event viewer:
Source: Dnscache
Event 11050
"The DNS Client could not contat any DNS servers for a repeated number
of attempts." etc.

The warning appears for the first time just after the NTServicePack entry.

Bob

 

[Herb Martin]

After upgrading a workstation with SP4, DNS stopped working.

Probably NOT due to the upgrade.

I have two machines next to each other. Using nslookup works on one but
not the other. Both have the same DNS entry (my firewall).

The one that fails says:
*** Can't find server name for address x.x.x.x: No response from server
*** Default servers are not available
Server: Unknown
Address: x.x.x.x

The above is a BOGUS error from NSLookup and
can be safely ignored (failure to REVERSE the DNS
server name is ok as long as you get the answer to the
REAL question your asked.)

If I lookup the address and type it into the browser (like
64.233.187.104 for google) it works just fine.

Then likely one the real answer is working even
in NSLookup.

When a resolution works but DNS is failing it
CAN resolve the name through other methods
(Hosts file, WINS/broadcasts using NetBIOS)
but these other methods are generally only
effective at resolving INTERNAL names (Not
those like Google which are only on the Internet.)

The problem impacts browsing, email, news.

There are entries in the event viewer:
Source: Dnscache
Event 11050
"The DNS Client could not contat any DNS servers for a repeated number
of attempts." etc.

The warning appears for the first time just after the NTServicePack entry.

Show us your "IPConfig /all" output by dumping
it to a file (NOT by typing it in) and tell us about
any internal DNS servers you have.

Internal machines should be set STRICTLY to
internal DNS servers IF any exist. Internal DNS
servers should generally forward to the ISP (or
firewall/router/DMZ) DNS server.

 

[bob]

Probably NOT due to the upgrade.

It doesn't make much sense that it would be, but I made no other
changes, and it doesn't seem likely that it would just spontaneously
quit working, either...

Show us your "IPConfig /all" output by dumping
it to a file (NOT by typing it in) and tell us about
any internal DNS servers you have.

Windows 2000 IP Configuration



Host Name . . . . . . . . . . . . : bob
Primary DNS Suffix . . . . . . . :
Node Type . . . . . . . . . . . . : Broadcast

IP Routing Enabled. . . . . . . . : No

WINS Proxy Enabled. . . . . . . . : No


Ethernet adapter Local Area Connection:



Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : 3Com EtherLink 10/100 PCI For
Complete PC Management NIC (3C905C-TX)
Physical Address. . . . . . . . . : 00-50-DA-21-79-23

DHCP Enabled. . . . . . . . . . . : No

IP Address. . . . . . . . . . . . : 192.168.0.5

Subnet Mask . . . . . . . . . . . : 255.255.255.0

Default Gateway . . . . . . . . . : 192.168.0.252

DNS Servers . . . . . . . . . . . : 192.168.0.252

<<<<<<<


The DNS server is on 192.168.0.252. It's also the firewall so it serves
as the gateway. It works fine for all the other computers on the
network. The only real difference I see between these results and the
results for other computers on the network ist that "Node Type" is
"Broadcast" for this machine, whereas the others are "Hybrid." I do not
know what "node type" is.

Bob

 

[Herb Martin]

The DNS server is on 192.168.0.252. It's also the firewall so it serves
as the gateway. It works fine for all the other computers on the
network.

Firewall? What OS is the firewall?

What exact errors or problems are you seeing?

Do you have your own zones?
(This does not seem to be an AD domain, correct?)

The only real difference I see between these results and the
results for other computers on the network ist that "Node Type" is
"Broadcast" for this machine, whereas the others are "Hybrid." I do not
know what "node type" is.

NetBIOS resolution type -- it is B-node due to
not haveing a WINS server configured. That
your other machines are H-node implies you have
a WINS server and so even though it is not part
of this problem it should be fixed by telling this
machine the address of the WINS server(s).

Internal machines should be clients of STRICTLY
internal DNS and WINS servers (if you have those
services.)

Although some of the following may not true for
you if you have no AD you might wish to review it:

DNS for AD
1) Dynamic for the zone supporting AD
2) All internal DNS clients NIC\IP properties must specify SOLELY
that internal, dynamic DNS server (set.)
3) DCs and even DNS servers are DNS clients too -- see #2
4) If you have more than one Domain, every DNS server must
be able to resolve ALL domains (either directly or indirectly)

netdiag /fix

....or maybe:

dcdiag /fix

(Win2003 can do this from Support tools):
nltest /dsregdns /serverC-ServerNameGoesHere
http://support.microsoft.com/kb/q260371/

Ensure that DNS zones/domains are fully replicated to all DNS
servers for that (internal) zone/domain.

Also useful may be running DCDiag on each DC, sending the
output to a text file, and searching for FAIL, ERROR, WARN.

Single Label domain zone names are a problem Google:
[ "SINGLE LABEL" domain names DNS 2000 | 2003 microsoft: ]

 

[bob]

Firewall? What OS is the firewall?

Linux: IPcop. Since none of the other machines have a problem I don't
think the firewall is the issue.

What exact errors or problems are you seeing?

That was in the first post. One, and only one PC on the network is not
able to resolve names. If I launch internet explorer and type in a name
(i.e. www.google.com) it doesn't go there. If I type in the IP address
then it will go there. Similarly, the mail program is unable to connect
to the named mail server and the news program can't connect to the named
news server. The event viewer reports that "The DNS clinet service could
not contact any DNS servers." I know the network connections are good
because I can connect to the PC from any of the others and navigate the
folders.

Do you have your own zones?
(This does not seem to be an AD domain, correct?)

It's just 5 PCs and a printer plugged into a switch. The PCs are
assigned ip addresses in the 192.160.0.x range. (No DHCP, No WINS). The
switch is plugged into the firewall. The firewall is plugged into the
DSL router/modem.

NetBIOS resolution type -- it is B-node due to
not haveing a WINS server configured. That
your other machines are H-node implies you have
a WINS server and so even though it is not part
of this problem it should be fixed by telling this
machine the address of the WINS server(s).

There is no WINS server. On the WINS tab of the Advanced TCP/IP
settings, all the machines have no values in the WINS addresses box.
They all have the Enable LMHOSTS lookup checked, and the Enable NetBIOS
over TCP/IP radio button selected.

Bob

 

[Herb Martin]

The DNS server is on 192.168.0.252. It's also the firewall so it serves
Show the IPConfig /all for at a working machine.
(for comparison)

Linux: IPcop. Since none of the other machines have a problem I don't
think the firewall is the issue.

That was in the first post. One, and only one PC on the network is not
able to resolve names. If I launch internet explorer and type in a name
(i.e. www.google.com) it doesn't go there. If I type in the IP address
then it will go there. Similarly, the mail program is unable to connect
to the named mail server and the news program can't connect to the named
news server. The event viewer reports that "The DNS clinet service could
not contact any DNS servers." I know the network connections are good
because I can connect to the PC from any of the others and navigate the
folders.

What happens when you perform NSlookup (from
the client directly)?

nslookup www.google.com

....and...

nslookup www.google.com

(past results from both)

What firewalls are you running on this machine?
(Norton, etc?)

It's just 5 PCs and a printer plugged into a switch. The PCs are
assigned ip addresses in the 192.160.0.x range. (No DHCP, No WINS). The
switch is plugged into the firewall. The firewall is plugged into the
DSL router/modem.

Were the above true that would be your problem
(192.160.0.x is NOT your range) but it is likely
a type.

IP Address. . . . . . . . . . . . : 192.168.0.5
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 192.168.0.252
DNS Servers . . . . . . . . . . . : 192.168.0.252

There is no WINS server. On the WINS tab of the Advanced TCP/IP
settings, all the machines have no values in the WINS addresses box.

Then the other machines are NOT "H-node" as
you claimed in the previous post.

H-node only applies to a WINS client (or perhaps
to a machine which is receiving an incorrect node
type from the DHCP server which is unlikely with
a Linux server.)

They all have the Enable LMHOSTS lookup checked, and the Enable NetBIOS
over TCP/IP radio button selected.

With one subnet and so few machines there is no reason
for LMHosts (nor WINS server) and you likely don't
have the file containing any useful values anyway.

None of this (NetBIOS) is relevant to Internet name
resolution -- only to your own network -- and is even
unnecessary for NetBIOS on a single subnet (i.e.,
a single broadcast domain.)

 

[bob]

Show the IPConfig /all for at a working machine.
(for comparison)

Windows 2000 IP Configuration



Host Name . . . . . . . . . . . . : LEO
Primary DNS Suffix . . . . . . . :
Node Type . . . . . . . . . . . . : Hybrid
IP Routing Enabled. . . . . . . . : No
WINS Proxy Enabled. . . . . . . . : No


Ethernet adapter Local Area Connection:

Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Intel(R) PRO/1000 MT Network Connection
Physical Address. . . . . . . . . : 00-08-74-B4-35-95
DHCP Enabled. . . . . . . . . . . : No
IP Address. . . . . . . . . . . . : 192.168.0.12
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 192.168.0.252
DNS Servers . . . . . . . . . . . : 192.168.0.252

What happens when you perform NSlookup (from
the client directly)?

nslookup www.google.com

...and...

nslookup www.google.com

(past results from both)

I don't see any difference between these commands. I posted the results
two posts ago, but I did it again:

*** Can't find server name for address 192.168.0.252: No response from
server
*** Default servers are not available
Server: Unknown
Address: 192.168.0.252
*** UnKnown can't find www.google.com: No response from server

The lines with *** don't redirect, so I had to type them in.

What firewalls are you running on this machine?
(Norton, etc?)

No software firewall. Norton AV 2002 is installed, and has been since 2002.

Were the above true that would be your problem
(192.160.0.x is NOT your range) but it is likely
a type.

IP Address. . . . . . . . . . . . : 192.168.0.5
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 192.168.0.252
DNS Servers . . . . . . . . . . . : 192.168.0.252

Yes, a typo = 192.168.0.x, not 192.160.0.x

Everything has been working fine with this machine for years -- it
suddenly started acting the way it is just the other day.

Then the other machines are NOT "H-node" as
you claimed in the previous post.

H-node only applies to a WINS client (or perhaps
to a machine which is receiving an incorrect node
type from the DHCP server which is unlikely with
a Linux server.)

For some reason the output from ipconfig /all reports "Hybrid" on this
machine. Three of the others are also hybrid, while the final machine is
broadcast. DHCP is not enabled on the Linux box.

With one subnet and so few machines there is no reason
for LMHosts (nor WINS server) and you likely don't
have the file containing any useful values anyway.

I assume that it's the default value, because I didn't set it.

None of this (NetBIOS) is relevant to Internet name
resolution -- only to your own network -- and is even
unnecessary for NetBIOS on a single subnet (i.e.,
a single broadcast domain.)

I have discovered another piece of information that might help:

On the machine that can't seem to resolve names into IP addresses, I
can't print. The printer is a standard netowrk printer. The printer
works fine (I can print from the other machines), and I haven't changed
any settings on the PC that now can't print.

On the other hand, the PC with the problems is able to navigate to the
other computers on the network by name -- for example if I click on
network neighborhood, I can see the other machines and double click on
them and open their shared folders.

Bob

 

[Herb Martin]

Windows 2000 IP Configuration

Host Name . . . . . . . . . . . . : LEO
Primary DNS Suffix . . . . . . . :
Node Type . . . . . . . . . . . . : Hybrid
IP Routing Enabled. . . . . . . . : No
WINS Proxy Enabled. . . . . . . . : No


Ethernet adapter Local Area Connection:

Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Intel(R) PRO/1000 MT Network Connection
Physical Address. . . . . . . . . : 00-08-74-B4-35-95
DHCP Enabled. . . . . . . . . . . : No
IP Address. . . . . . . . . . . . : 192.168.0.12
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 192.168.0.252
DNS Servers . . . . . . . . . . . : 192.168.0.252

Ok, the working machine (above here) uses the
same DNS server as the failing machine.

I don't see any difference between these commands.

Sorry. I left off the address for some (silly reason).

Second one should have been:

nslookup www.google.com 192.168.0.252

....but it isn't likely to be different.

I posted the results two posts ago, but I did it again:

That post snippet was confused and looked like it might
be incomplete (due to editing.)

Can't find server name for address 192.168.0.252: No response from
server
Default servers are not available
Server: Unknown
Address: 192.168.0.252

Everything above for NSLookup is irrelevent
except that it confirms we are using the same
DNS server ("Can't find name..." is a bogus
error from NSLookup's funky practices.)

It's the following line that matters:

UnKnown can't find www.google.com: No response from server

Ok it fails -- I should have given you this
(following) line to try as the same time:

That by the way LOOKS like your DNS server
answered but couldn't resolve Google, not that
your server failed to answer.

The lines with *** don't redirect, so I had to type them in.

I removed those but you can just COPY them from the screen
with the select AND paste them in.

So let's try this:

nslookup -time=20 www.google.com 192.168.0.252

(long timeout to make sure it isn't time sensitive)

And this:

nslookup www.learnquick.com 216.21.234.71

(can't be yahoo because that server won't resolve
just any zone for you.)

If the latter works, then you station is resolving DNS
and the problem is at the Linux router -- some kind
of filter or something odd about it's DNS server.

No software firewall. Norton AV 2002 is installed, and has been since

2002.

That would be my main suspect then.

Yes, a typo = 192.168.0.x, not 192.160.0.x

For some reason the output from ipconfig /all reports "Hybrid" on this
machine. Three of the others are also hybrid, while the final machine is
broadcast. DHCP is not enabled on the Linux box.

That's odd especially if you didn't leave out
any lines (that's why I don't like for you to type
them in--adds uncertainty) since it doesn't show
a WINS server line.

This implies someone has messed with the
registry or the NICs have a WINS server listed
but that it cannot be contacted (because it doesn't
exist?)

But again it is unrelated to your real problem unless
it is an indication of these machines have been
hacked (not necessarily in a bad way.)

I assume that it's the default value, because I didn't set it.

Not unless there is a WINS server listed.

On the machine that can't seem to resolve names into IP addresses, I
can't print. The printer is a standard netowrk printer.

There is no "standard" so that is meaningless but
I presume you mean an IP printer attached directly
to the network.

And the "can't print" report is near meaningless
unless you try to connect by name and IP and say
precisely what the errors are.

Can you ping the printer? (Always try ping by
both name and IP and specify which works...)

The printer
works fine (I can print from the other machines), and I haven't changed
any settings on the PC that now can't print.

On the other hand, the PC with the problems is able to navigate to the
other computers on the network by name -- for example if I click on
network neighborhood, I can see the other machines and double click on
them and open their shared folders.

That is probably due to NetBIOS name resolution
which in your case is broadcast based.

If the Printer is not a "Windows" machine it would
not respond to NetBIOS and so would only be available
by IP and not by name since you have no internal DNS
resolution (it appears.)

 

[bob]

I removed those but you can just COPY them from the screen
with the select AND paste them in.

I forgot about "copy" from the command prompt.

So let's try this:

nslookup -time=20 www.google.com 192.168.0.252

(long timeout to make sure it isn't time sensitive)

And this:

nslookup www.learnquick.com 216.21.234.71

Here I have copied and pasted the commands and their results:
E:\>nslookup -time=20 www.google.com 192.168.0.252
*** Can't find server name for address 192.168.0.252: No response from
server
Server: UnKnown
Address: 192.168.0.252

*** UnKnown can't find www.google.com: No response from server

E:\>nslookup www.learnquick.com 216.21.234.71
*** Can't find server name for address 216.21.234.71: No response from
server
Server: UnKnown
Address: 216.21.234.71

*** UnKnown can't find www.learnquick.com: No response from server
<<<<<<<<<<<<<<<<<

The first command reported the server UnKnown message instantly. I
changed the -time switch to 200 and the same thing happened (instant
response).

2002.

That would be my main suspect then.

Before I ran the above commnads, I uninstalled Norton AV and LiveUpdate.
There are now no antivirus or firewall type programs installed on the
machine.

That's odd especially if you didn't leave out
any lines (that's why I don't like for you to type
them in--adds uncertainty) since it doesn't show
a WINS server line.

No I did not leave out any lines.

This implies someone has messed with the
registry or the NICs have a WINS server listed
but that it cannot be contacted (because it doesn't
exist?)

But again it is unrelated to your real problem unless
it is an indication of these machines have been
hacked (not necessarily in a bad way.)

That's curious. Several of the machines are occasionally used by a high
school student, and he does things that I wish he did not, but I do not
believe he has used the machine in question, nor one of the machines
reporting "hybrid". Since those machines seem to be working properly and
show no evidence of being compromised, I'm not going to worry about them
right now.

There is no "standard" so that is meaningless but
I presume you mean an IP printer attached directly
to the network.

Yes, it is a HP printer with a jetdirect card. By "standard" I meant
that the machine is configured with the built in (Win2k) TCP/IP printer
services.

And the "can't print" report is near meaningless
unless you try to connect by name and IP and say
precisely what the errors are.

Can you ping the printer? (Always try ping by
both name and IP and specify which works...)

In the printers control panel, my printer is named "4650" the computer
is named "bob"
E:\>ping 192.168.0.71

Pinging 192.168.0.71 with 32 bytes of data:

Reply from 192.168.0.71: bytes=32 time<10ms TTL=64
Reply from 192.168.0.71: bytes=32 time<10ms TTL=64
Reply from 192.168.0.71: bytes=32 time<10ms TTL=64
Reply from 192.168.0.71: bytes=32 time<10ms TTL=64

Ping statistics for 192.168.0.71:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 0ms, Maximum = 0ms, Average = 0ms

E:\>ping \\bob\4650
Unknown host \\bob\4650.

<<<<<<<<<<<<<<<<<<<<<

There is roughly a 2 second delay between pressing enter and getting the
unknown host response.

That is probably due to NetBIOS name resolution
which in your case is broadcast based.

If the Printer is not a "Windows" machine it would
not respond to NetBIOS and so would only be available
by IP and not by name since you have no internal DNS
resolution (it appears.)

I really appreciate all the help, and I feel like we must be narrowing
in on the cause.

Bob

 

[Kevin D. Goodknecht Sr. [MVP]]

In

E:\>ping \\bob\4650
Unknown host \\bob\4650.

DNS won't resolve host names on this box, it has no DNS suffix search list
to send to a DNS server. This machine would require NetBIOS resolution to
resolve host names.
try this you'll see:
nslookup -d2 bob

Wihtout a DNS suffix search list, the DNS server doesn't know where to look
for the host..

I've seen this before and I'm searching my memory for what the problem was.
IIRC, on the one before, the machine had ZoneAlarm on it that was removed
but not fully removed. Did this box previously have ZoneAlarm on it?

 

[bob]

try this you'll see:
nslookup -d2 bob

E:\>nslookup -d2 bob
------------
SendRequest(), len 44
HEADER:
opcode = QUERY, id = 1, rcode = NOERROR
header flags: query, want recursion
questions = 1, answers = 0, authority records = 0,
additional = 0

QUESTIONS:
252.0.168.192.in-addr.arpa, type = PTR, class = IN

------------
connect: No error
SendRequest failed
*** Can't find server name for address 192.168.0.252: No response from
server
*** Default servers are not available
Server: UnKnown
Address: 192.168.0.252

------------
SendRequest(), len 21
HEADER:
opcode = QUERY, id = 2, rcode = NOERROR
header flags: query, want recursion
questions = 1, answers = 0, authority records = 0,
additional = 0

QUESTIONS:
bob, type = A, class = IN

------------
connect: No error
SendRequest failed
*** UnKnown can't find bob: No response from server

<<<<<<<<<<<<<<<<

Wihtout a DNS suffix search list, the DNS server doesn't know where to look
for the host..

I've seen this before and I'm searching my memory for what the problem was.
IIRC, on the one before, the machine had ZoneAlarm on it that was removed
but not fully removed. Did this box previously have ZoneAlarm on it?

It did, but that was maybe 6 months or a year ago. It's been working
fine since then. Just in case, I searched the registry and deleted all
the keys with "zonelab", "zone alarm" and "zapro" in them. After
rebooting the computer it still doesn't work.

I read through this kb article on suffix serch lists, but it doesn't
seem applicable. None of my other machines seem to have suffix search
lists either.
http://support.microsoft.com/default.aspx?scid=kb;en-us;162844

Bob

 

[Herb Martin]

Herb Martin wrote:
I forgot about "copy" from the command prompt.

Here I have copied and pasted the commands and their results:
E:\>nslookup -time=20 www.google.com 192.168.0.252
*** UnKnown can't find www.google.com: No response from server

Ok, it isn't time sensitive (even 10 seconds is enough.)

E:\>nslookup www.learnquick.com 216.21.234.71
*** UnKnown can't find www.learnquick.com: No response from server
<<<<<<<<<<<<<<<<<

The first command reported the server UnKnown message instantly. I
changed the -time switch to 200 and the same thing happened (instant
response).

I know for a fact that 2168.21.234.71 will answer
DNS reliably. Something is blocking the request
OR the response.

The instant answer from the near DNS server seems
to indicate that IT is causing the problem.

Some versions of Norton include firewall
software (all of which I consider to be junk
but I think this is on the DNS-server/router

Before I ran the above commnads, I uninstalled Norton AV and LiveUpdate.
There are now no antivirus or firewall type programs installed on the
machine.

Then this tends to put it more fully on
the DNS server.

That's curious. Several of the machines are occasionally used by a high
school student, and he does things that I wish he did not, but I do not
believe he has used the machine in question, nor one of the machines
reporting "hybrid". Since those machines seem to be working properly and
show no evidence of being compromised, I'm not going to worry about them
right now.

That makes sense.

Yes, it is a HP printer with a jetdirect card. By "standard" I meant
that the machine is configured with the built in (Win2k) TCP/IP printer
services.

In the printers control panel, my printer is named "4650" the computer
is named "bob"

[Which computer? ]

I would be able to troubleshoot better if I
knew you could/could-not connect by number
and or name individually.

E:\>ping 192.168.0.71

Pinging 192.168.0.71 with 32 bytes of data:

Reply from 192.168.0.71: bytes=32 time<10ms TTL=64
Reply from 192.168.0.71: bytes=32 time<10ms TTL=64
Reply from 192.168.0.71: bytes=32 time<10ms TTL=64
Reply from 192.168.0.71: bytes=32 time<10ms TTL=64

So the printer is "There" and reachable.

E:\>ping \\bob\4650
Unknown host \\bob\4650.

Ping doesn't work that way.

ping bob

You really cannot have a "device" using
a NUMBER for a name on an IP network.

All names should begin with an alphabetic
character, and have no more than a 13
additional alphanumerics (per NetBIOS
name and per label for DNS.)

I really appreciate all the help, and I feel like we must be narrowing
in on the cause.

Let's talk about the DNS server...it's also a
router, might there be filters etc on it....?

 

[Herb Martin]

DNS won't resolve host names on this box, it has no DNS suffix search list

to send to a DNS server. This machine would require NetBIOS resolution to
resolve host names.

To resolve bare names -- it will
resolve explicit names just fine.

 

[Kevin D. Goodknecht Sr. [MVP]]

In

It did, but that was maybe 6 months or a year ago. It's
been working fine since then. Just in case, I searched
the registry and deleted all the keys with "zonelab",
"zone alarm" and "zapro" in them. After rebooting the
computer it still doesn't work.

It is not a registry entry, it is a loaded driver. I will see if I can find
it.
I know Ace used to have the directions, It has just been so long since the
issue surfaced. But in that case, I think my memory says it didn't surface
until SP4 was installed.

Keep watching here, I'll find the fix. I don't think at that time it was on
the Zone Labs website. But you might take a look there to see. But I can
almost guarantee it is a ZoneAlarm issue, this is the third or fourth time
in this group alone, that this has shown it ugly head on a machine that had
ZoneAlarm removed.

I read through this kb article on suffix search lists, but
it doesn't seem applicable. None of my other machines
seem to have suffix search lists either.
http://support.microsoft.com/default.aspx?scid=kb;en-us;162844

You are correct this is not relevant, actually there is another reason why
DNS can't resolve host names. You don't have or are not using a local DNS
server. That tells me that you don't have an Active Directory domain, if you
do, then your using the wrong DNS because it appears you're using your
router for DNS.

 

[Herb Martin]

In

It is not a registry entry, it is a loaded driver. I will see if I can find
it.
I know Ace used to have the directions, It has just been so long since the
issue surfaced. But in that case, I think my memory says it didn't surface
until SP4 was installed.

I had ZoneAlarm blowup a dual processor
machine (not properly multi-threaded at least
at one time) and the Service name I needed to
stop in Recovery Console was NOT obvious.

If you cannot find the name you might check
their site for KB type articles related to multiprocessors
or dual etc.

(Not that this applies but it does list the name
and that is where I found it -- buried way down
in their support questions.)

 

[Kevin D. Goodknecht Sr. [MVP]]

In

It did, but that was maybe 6 months or a year ago. It's
been working fine since then. Just in case, I searched
the registry and deleted all the keys with "zonelab",
"zone alarm" and "zapro" in them. After rebooting the
computer it still doesn't work.

You're in luck, here are the instructions.

http://nh2.nohold.net/noHoldCust25/Prod_1/Articles55646/ManualUninstall.html

 

[bob]

You're in luck, here are the instructions.

http://nh2.nohold.net/noHoldCust25/Prod_1/Articles55646/ManualUninstall.html

That was it!

So my old version of Zone Alarm Pro had left something behind when I
used the uninstall. Whatever that something was, it was not a problem
until SP4 was installed.

My computer is now browsing the internet, printing, and receiving email.

Thank both of you very much.

Bob

 

[Kevin D. Goodknecht Sr. [MVP]]

In

http://nh2.nohold.net/noHoldCust25/Prod_1/Articles55646/ManualUninstall.html

That was it!

So my old version of Zone Alarm Pro had left something
behind when I used the uninstall. Whatever that something
was, it was not a problem until SP4 was installed.

If I remember correctly, the last three exhibited the same behavior, no
problem until SP4 was installed. When you first posted, I knew I had seen
this before, none of the previous users had connected it to ZoneAlarm since
ZoneAlarm was uninstalled long before SP4. The way it was discovered to be
ZoneAlarm, the first user called Microsoft, they found it possibly by
happenstance, then the original poster came back to let us know. That was a
couple of years ago, when SP4 was first released. The last poster with the
problem was last August, it just took a while for me to remember. I
remembered it while I was making a reply to you.
After you said you did have ZA on the machine, that nailed it in my mind. I
had to go back and search my archived email for the resolution.

 

[Herb Martin]

Good catch Kevin.