A message appears on the computer that “Gtbf.tmp.exe is attempting to connect to a DNS server. The remote address is 203.12.160.35:53”. What does this message mean? The computer is running Windows XP.

The message which is appearing is not a standard Windows message, so I imagine this is from a piece of security software installed on the computer (from the wording of the message it seems to be Norton Internet Security). The file which is mentioned in the message “Gtbf.tmp.exe” is related to Google Toolbar, an add-on for web browsers allowing you to access Google services using a toolbar within your web browser. In particular, Google Toolbar periodically checks for updates to ensure that you have the latest version of Google Toolbar, with all the latest security updates and various fixes. Norton Internet Security is alerting you that the Google Toolbar update program is attempting to access a DNS server so that it can connect to Google and check whether any updates are available and, if so, download the updates. If you are unfamiliar with the purpose of DNS, read the response to the previous question in this column which provides an explanation.

Assuming that you want to keep Google Toolbar up-to-date you should be able to allow this request when the warning message you described appears. However, it would be worthwhile to do a quick check to make sure that the “Gtbf.tmp.exe” is the legitimate Google Toolbar file, rather than another file which is named the same and impersonating Google Toolbar. The first indicator as to whether this file is legitimate is that you have Google Toolbar installed on your computer. If not, then this would be quite a strong indicator that the file is not legitimate! The second indicator is that the full path to the file requesting access to the DNS server is in a Google Toolbar directory (most likely, C:\Documents and Settings\\Local Settings\temp\Google Toolbar (although this may have changed in different versions of the software). Note that searching for this directory using My Computer may not be successful, as the directory is only temporarily used when Google Toolbar is updating. However, you should be able to click a More Information (or like) button in the security message that appears which should display the full path of the file.

If all looks legitimate, then you should be able to let the request through. However, if anything looks awry, or you feel uncomfortable, then you can always err on the side of caution and deny the request. In this situation please feel free to contact me for further guidance on how to proceed.