Unable to access websites by name with various browsers

Avast Free Antivirus / Premium Security
1

After Avast! 2014 Free removed a rootkit, I’m no longer able to access any websites by name on my main PC (Win XP Home, SP3), whether the browser is IE8, Safari or Chrome. (The timing may be coincidental and the two are not related). My laptop, connected to the same router, can access websites by name as normal, and I have no problem when using the laptop.

Pinging the name of a few sites on my PC displays IP addresses every time, sometimes getting a good response and sometimes not getting any at all. Using these IP addresses on my laptop brings up the website every time.

Most of the sites that I’ve tried on my PC when I specify their IP addresses open whichever browser I use.

The rootkit that Avast! identified was Win32 : Evo-gen[Susp]. At first Avast! didn’t fix it on re-booting scans and whenever I opened the Avast! client window it declared: “Everything is good”, even after the pop-up alerted me to the presence of the rootkit each time. I repeatedly scanned the file that Avast! said contained it. I did this with Avast! itself, Malwarebytes, Spybot and SuperAntiSpyware, and they all reported no problem. I assumed I may have been experiencing a false positive, as I understand the scan is heuristic and the rootkit generic.

The file and path that Avast! had reported as containing the rootkit was c:\windows\ATKKBService.exe and the file has now gone from this folder, presumably removed by Avast!.

However, I’m still left with being unable to open any website by name even though I can successfully ping them by name.

I’ve cleared the DNS cache using ipconfig.

I’ve turned off the PC’s firewall and the virus checker in turn with no change in results.

In case it was some selective firewall fault in the router I’ve re-set that.

My email system works normally except that many commercial emails with graphics don’t show the graphics.

Could anyone suggest how I can go about finding the source of the problem and fixing it please?

2

Try this:
Start button.
Click Control Panel.
Choose Network Connections.
Right click Local Area Connection.
Choose Properties.
Click on the words Internet Protocol (TCP/IP) so the background to the words highlight.
Click the Properties button.
Make sure “Obtain DNS server addresses automatically” is checked.
Reboot and see if the problem is solved.

3

Thanks for your response, Eddy.
It was already checked, and to be sure I clicked OK on the way out.
Unfortunately I still have the same problem after rebooting.

4

If the rootkit is in the virus chest right click then click “scan”.
If it comes up clean from the chest right click the select “replace”.

5

Reinstall the networkcard/-chip drivers.
If it is a card they can be found on the card manufacturers website.
If it is onboard they can be found on the motherboard manufacturers website.

6

Para-Noid, thanks for your response too. The file was clear. I restored it along with the only other one in the chest (which was put there at the same time and which was also clear). I rebooted but it’s made no difference.

Eddy, the drivers for my main board are on this page:
http://www.gigabyte.com/products/product-page.aspx?pid=4150&dl=1#driver
I started off by downloading the Realtek PCIe LAN Driver, but when I run the file I get the message “[path]motherboard_driver_lan_realtek_8111.exe is not supported archive”. I’m sure this is the network file you mean, but what do I need to do to unpack it?
Which of the two chipset files is the one I need?

7

You can extract the files with 7zip.
After doing so, run setup.

8

Eddy, I’ve installed 7zip and the readme file says: Unpacking only: ARJ, CAB, CHM, CPIO, CramFS, DEB, DMG, FAT, HFS, ISO, LZH, LZMA, MBR, MSI, NSIS, NTFS, RAR, RPM, SquashFS, UDF, VHD, WIM, XAR and Z. No mention of EXE.
Nevertheless I tried using it to unpack the exe file without success. I tried an old version of WinRAR too.
I guess I need to find out from Gigabyte what to do with the file. It’s dated 2012/01/17 which is well before I had the board installed.
In the meantime I tried ‘updating’ the driver for the Realtek network adapter from the driver files for the main board already on my hard drive, but it just said it ‘could not find a better match’. At the moment I’m a little nervous about removing the driver and then re-installing it to fix any corruption, but I’ll follow any recommendation you make.

9

OK, the exe file was corrupted during the download. The uncorrupted file self-extracted with no problem and I ran the Repair option of the utility which included the automatic re-installation of the driver. I’ve rebooted the PC but the problem remains.
Any thoughts what I should try next?

10

Give THIS tool a try or THIS one. Either should be able to repair the dns.

11

Thanks Eddy. Sorry for lack of response but I’ve been unable to deal with this for a few days. I’ll give them a try and come back.
Rob

12

Success!!
Thanks ever so much Eddy. I used the first utility you suggested (Tweaking.com – Windows Repair). I tried option 12 first (Repair Winsock & DNS cache) without success, and then others in groups. So I know that it was either 05, 06, 07, 09, 11 or 14 that did it. I wish I knew which, but I suspect it may have been 14 (repair proxy settings). The fact is, it did the job – Chrome and Safari work too, and I can see the graphics in emails.
So thanks again!
Rob

13

You’re welcome.
I knew right from the beginning that is was a dns problem.
If you can’t access a website by name but you can by IP, it always is a dns problem.
But that still leaves a lot of places/options about which one it is exactly.
So we (or rather you) had to try a few things to find out where the problem exactly was in order to solve it.
Good to hear it is solved now.
Take care and keep your system safe.

14

The curious thing, though, was that I could ping sites by name, and the IP address would be shown. I could then use those IP addresses in the browsers to bring up the site.
Presumably ‘DOS’ had access to a DNS database but the browsers didn’t.

15

No, ping uses another protocol and gets the ip address in another way than your web browser (to put it simply)
It is like you want to go from A to B with a car but you can’t because there are a lot of obstacles in the way.
But you are able on a bicycle to get from A to B because you can get around them.

16

OK, thanks. That helps me to come to terms with the apparent paradox (without of course needing to understand the technical details!)