I've found this on clean machines but had to clean again with Ewido.
I just realized that the help system in MS Office refuses to use a local DNS server. I had never used Zone Alarm before to do fine grain monitoring of traffic until recently when trying to get rid of some nasty hijack issues on a friends PC. When trying to get help from MS Office I'd stop anything trying to access an external DNS server with the result that MS Office Help would display "Action Canceled" page not found error message!
I then tried on a clean system with MS Office 2003 and Zone Alarm as the only installed apps and guess what - it did the exact same thing - it queried a different DNS server on each request. I checked with dnsstuff.com and noticed one ip address was registered to a company with a contact email address ending in webtrends.com - what is going on here?
Why would MS Office applications refuse to use a local DNS server?