I was recently troubleshooting a computer for a family member, where they reported “I can’t access the Internet” and the resolution was something I’ve never seen before.
This was a laptop with both an Ethernet and Wifi connection. They were both set to DHCP with dynamic DNS, and IPCONFIG displayed the correct information.
I could ping to 8.8.8.8 confirming network connectivity, and an NSLookup found my gateway acting as a DNS server which could properly resolve external names.
However, as soon as any browser attempted to access a DNS name, it failed. Chrome gave a “DNS_Probe_Finished_Nxdomain” error, and IE simply stated “Page could not be found”.
I checked the Hosts file for malicious entries, ensured no proxy was enabled within IE, and verified the routing table was all normal.
I ran ComboFix and GMER to look for rootkits, and started the computer in Safe Mode with Networking but none of these resolved the issue.
Finally I decided to install WireShark and run ProcessMon while the browser connection was made, in an attempt to see where these requests were going.
When trying to run WireShark after the install though, it gave an error about a missing “dnsapi.dll” file. I verified the file was in the proper location (c:\windows\system32), but on a hunch decided to refresh it from SFC with this command:
sfc /scanfile=c:\windows\system32\dnsapi.dll
The output confirmed a corrupted file was replaced, and then I rebooted Windows. Once it came back up, all external browsing worked!
I suspect that some malware had gotten onto this machine and modifed the dnsapi.dll file, but at some point had been partly removed.
This one left me confused for a while, so hopefully this helps anyone else coming across the issue.
