DNS in XP has a mind of it's own!?

[Stephen Beasley]

Hi, and thanks in advance!
Ok, here is what I have:
win2k3 AD domain
DNS client settings controlled by GPO
DNS server resolves external requests (split-DNS)
This all works

Problem child (XP SP3 box):
Only problem in domain
ipconfig /all showing only 1 dns ip - internal server
ipconfig /flush dns - multiple times
Hosts file - 127.0.0.1 local host (only entry)
deleted cookies, reset ie7
Visual Studio - find/replace searched several dns entries within files for
all drives - not found
Virus scans, adware/malware scans - shows clean
IN IE7 requests are forwarded to internal server
when idle (apps running though) some requests are to external DNS servers -
verisign, Univ of maryland (root hints servers)
Currently setting up netmon to find out why it is requesting.

So my question is: Where is it getting this list of dns servers to search?
The domain controller? If so, how do i stop it?

Steve

[Ace Fekay [MVP]]

In news:690F68A5-B20D-4612...@microsoft.com,
Stephen Beasley <Stephen...@discussions.microsoft.com> typed:

You are saying it is only getting one of the internal DNS servers? Are all
other DHCP clients getting two internal DNS servers? WHen you do an ipconfig
/all on this machine, who is the DHCP server?

Any event log errors indicating any issues with GPOs or anything else on the
client?
Any third party DNS resolvers installed or any spyware that possibly your
scans may not have shown? Just in case, and not sure what you used to scan
for spyware, but I would run an Ad-Aware scan along with a SPybot scan, and
if that doesn't help, run a HiJackThis scan and post the logs to their
forum.

Ad-Aware
http://www.lavasoftusa.com/software/adaware/

Spybot search and destroy
http://www.safer-networking.org/en/download/

HiJackThis Download:
http://www.spywareinfo.com/~merijn/downloads.html

SWI Forums- Post your HiJackThis logfile (Powered by Invision Power Board):
http://forums.spywareinfo.com/

HiJackThis Tutorial and Forums-
How to use HijackThis to remove Browser Hijackers & Spyware. Post your
logfile here:
http://www.bleepingcomputer.com/forums/index.php?showtutorial=42

Ace