Can only view websites via IP addresses

First time poster
Im a junior tech and this clients computer has got me stumped.
Internet explorer (or any other browser) isn’t able to connect to the net
The computer has been given a IP address
i CAN connect to websites if i type in their IP address, 66.102.11.104 for google works
all other computers on the network can connect to the internet fine
Malware bytes originally picked up a DNS changing virus, that was removed and now nothing is picked up with malware bytes, superantispyware, end point or combofix

A windows repair install didn’t fix the problem.

ipconfig /all log:
Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.

C:\WINDOWS\system32>ipconfig /all

Windows IP Configuration

Host Name . . . . . . . . . . . . : HOMEUSER-5BA57B
Primary Dns Suffix . . . . . . . :
Node Type . . . . . . . . . . . . : Unknown
IP Routing Enabled. . . . . . . . : No
WINS Proxy Enabled. . . . . . . . : No

Ethernet adapter Wireless Network Connection:

Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : D-Link AirPlus DWL-G520 Wireless PCI
Adapter(rev.B)
Physical Address. . . . . . . . . : 00-0F-3D-E0-F6-F7
Dhcp Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
IP Address. . . . . . . . . . . . : 172.16.0.42
Subnet Mask . . . . . . . . . . . : 255.240.0.0
Default Gateway . . . . . . . . . : 172.16.0.220
DHCP Server . . . . . . . . . . . : 172.16.0.16
DNS Servers . . . . . . . . . . . : 172.16.0.200
Lease Obtained. . . . . . . . . . : Tuesday, 20 July 2010 1:17:31 PM
Lease Expires . . . . . . . . . . : Tuesday, 20 July 2010 7:17:31 PM

Ethernet adapter Local Area Connection 7:

Media State . . . . . . . . . . . : Media disconnected
Description . . . . . . . . . . . : Intel(R) 82566DM Gigabit Network Con
nection
Physical Address. . . . . . . . . : 00-1A-4B-C1-97-3E

C:\WINDOWS\system32>

 

You have an odd subnet mask and you are showing an internal dns server that is not the same as the gateway but is internal. If this is in a very large company environment with their own DNS server, they may be correct. I would suggest checking these on another computer that IS able to use the internet.

Try manually setting the primary and secondary DNS servers to 208.67.222.222 and 208.67.220.220 and see what happens. These are public DNS servers.

There may be some leftovers from the virus.

 

still no luck with those DNS servers, nslookup is acting like everything is fine :|

 

Is this on a large network?

What does ipconfig /all show with the new DNS servers assigned. No offense, I just want to make sure they are assigned to the correct adapter.

 

Obviously the problem isn't conectivity, is DNS resolution.

3 things are really important to check, the cached DNS adresses the hosts file and the adapter configuration.

1. Set your adapter configuration to automatic (if you used it) or the typical configuration.

Now, do this:

A). Start > Run > cmd

in the console windows type:

ipconfig /flushdns

You will reset any cached dns resolution.

Now, check the host file isn't with any strange information. To do that do this:

B) Start > Run > drivers

Staying in the folder drivers,go into the folder "etc" there you will get the file hosts. To open it use "notepad".

or go through directyl: C:\Windows\System32\drivers\etc

In that file you will found info like this:

# Copyright (c) 1993-2009 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host

# localhost name resolution is handled within DNS itself.
# 127.0.0.1 localhost

Save a copy of the file and delete everything below # 127.0.0.1 localhost

If nothing have worked, you could use this tool:

http://go.microsoft.com/?linkid=9664547


Tell us what happened.

 

The problem is definitely DNS so if the computer is specifically directed to a nonexistent DNS server such as 172.16.0.200 when it should be 172.16.0.220 which is the gateway and the normal DNS server or an external DNS server, it will have exactly the problem he is describing. Some companies have a specific machine setup as a DNS server but that is usually only found in large companies. Most small companies and private homes use the router as the DNS server which passes the requests to the ISP's DNS servers.

The reason I question the subnet mask is because it has him open to a very large address range which can be a potential problem.