Many thanks for the suggestions on this one. Here's an update.
The DNS service thinks it's running. Stopped it. Re-started it. No difference.
Booting up in safe mode with networking works exactly the same - DNS works on one user, not on any of the others.
Tried creating a new user -- but the new user, as with some of the old ones, can ping numeric IP addresses, but can't successfully do a DNS lookup.
The hosts file and dnscache are empty.
Running nslookup with the debug option on www.ntlworld.com for example gives the following message:
-----------
socket (dg) failed: No error
*** Unknown can't find www.ntlworld.com: No response from server
-----------
Googling this error message took me to a year old post on www.blu.org, which includes a link to instructions to fix this -- but the link is broken.
This is really puzzling me. There is something different about one user profile which is allowing a basic DNS lookup, where all other user profiles are preventing it.
I can only think of three things which might be different:
1. Some program running somewhere - but I've been through the running processes lists for both users and found no differences
2. The registry - but the only registry entries affecting DNS that I am aware of are the set about the DNSCACHE, and they are the same on both users. And anyway, they are under HKEY_LOCAL_MACHINE not HKEY_CURRENT_USER, so ought not to be different for different users.
3. Could the firewall (NIS 2002) be blocking outgoing port 53 for DNS requests on one user but not the others? And if so, how could I confirm it. Mooching around the NIS 2002 menus I can't see anything recognisable as a simple list of rules about which port to block when.
The suggestion that the WXP internal firewall might be kicked in is also an interesting one, but I'm not sure how to check for this.
All suggestions much appreciated, otherwise a Windows re-install awaits, I fear.