DNS issue when not logged onto my normal domain

Question

I'm having a very strange problem which I'm having difficulty understanding.   Normally, I use my laptop (D620) to logon to the network via a dock.  I have no connectivity issues. I logon to the network via netware.   When offline at home or travelling I logon either as a local user or as a Windows user. In these circumstances I normally use the wireless card BUT the problem I am having also occurs using the wired NIC, so I don't think it is hardware related.   What happens is that I have normal connectivity for about 10-20 minutes after starting up. Then suddenly I start getting DNS errors when browsing the web. This occurs whether I use Mozzila or Internet Explorer 7 so it is not related to browser settings. A ping and tracert to a FQDN succeeds and I can use non web services. For example I can logon to ftp normally. In fact I can even telent out on port 80 so I'm sure its not firewall related.   The problem is replicated on a number of different broadband and wireless networks and other laptops work fine - the problem only occurs with mine.   It doesn't show that the network is disconnected, and I can use ftp, email fine - only web use is affected. A reboot starts the cycle again - however anything other than a reboot fails to resolve. If its any help the last thing I see in the bottom bar is a reference to c:\windows\system32\dnsapi.dll so I am wondering if it is something to do with DNS settings? Or my tcp/ip settings? Any ideas?

RKinner · Answer

You can check your DNS with:

Start, Run, cmd, OK then type (with an Enter after each bold line)

nslookup att.com

(just an example. You can use any website. On my pc the output is:

>nslookup att.com
Server: whatever.com

Address: A.B.C.D

Name: att.com
Addresses: 144.160.134.80, 144.160.103.104)

ipconfig /all

(Shows your IP address, your Default Gateway and that of your DNS server. Make sure the DNS server has an address close to that of the default gateway (same first A.B.) If it says 85.255 something then you have something like a wareout infection)

ipconfig /release

ipconfig /renew

ipconfig /all

(Now go back and see if your IE works.)

(Close the cmd window)

There may be a clue hidden in the event logs. Check the Event logs for errors:
Start, Run, eventvwr.msc, OK then select System. Look for red marked files that have a time stamp about the time of the IE/Firefox hang. Open the event then click on the bottom of the three buttons to copy the text. Move to a reply and Edit, Paste. Repeat for any other different errors that happened during the hang. Please don't go back to the beginning of time and no events from a Safe Mode boot. Repeat for Application. If your PC speaks something other than English don't translate it unless it doesn't use the Latin alphabet and then please include the timestamps.

What firewall are you using?

Ron

headcase · Answer

Hi R and thanks for the response - I didn't bother using NSLOOKUP as the names are resolved fine using ping and tracert, even after clearing the cache.   I did try the ipconfig /release and /renew but this made no difference.  Only a reboot fixes the problem, and it returns again, within 10-20 minutes.   I did check event viewer to see if anything is happening their but no joy there either - however I will scour the application log to see if there is anything else happening.   I've also reset my hosts file to default - this didn't help either.   I'm not using a firewall - the service is disabled entirely. Will check again when I get home tonight.  I've also scoured for malware etc (the problem actually started after I had some issues with popups that disappeared at the same time the problem started!)

RKinner · Answer

I like nslookup because it also tells you which DNS is providing the info.

Let's look for a rootkit:

Download Blacklight trial from here:
http://www.f-secure.com/blacklight/

Hit "I accept." It will take you to the download page.
Download blbeta.exe and save it to the Desktop.
Once saved... double click blbeta.exe (you may not be able to see the .exe) to install the program.
Click Accept Agreement and click Scan
This app may trigger a warning from your antivirus. Let the driver load.
Wait for it to finish.
If it displays any items...don't do anything with them yet. Just hit exit (close)
It will drop a log on Desktop that starts with fsbl....big number

Please post contents of log in your next reply.

Ron

Networking, Internet, & Bluetooth

DNS issue when not logged onto my normal domain

Was this post helpful?