Annoying DNS problem - need help!

king_of_inismac · 06-04-2011 8:24am #1

Hey guys,

Need some help. My g/f has been having some problems connecting to the internet on her laptop.

Neither IE or Firefox work. However, she can connect to Skype, and if I give her an IP address (in IE's address bar), she can go to that address. So I assume it's a DNS problem?

I've tried the following:
1. Restarting the PC in safe mode with Networking (didn't work).
2. Changed the DNS to googles DNS 8.8.8.8 and 8.8.4.4 (didn't work).
3. Unchecked all the auto-configuration settings (didn't work)
4. Restarting the router (didn't work)

I'm not really sure what to do next?

Thanks,
M

Spear · 06-04-2011 8:32am

king_of_inismac wrote: »

Hey guys,

Need some help. My g/f has been having some problems connecting to the internet on her laptop.

Neither IE or Firefox work. However, she can connect to Skype, and if I give her an IP address (in IE's address bar), she can go to that address. So I assume it's a DNS problem?

Run ipconfig /all and show us the results. It's possible the DNS servers in the network options aren't being used, as they can be overriden by registry entries instead, potentially as the result of a trojan/malware.

king_of_inismac · 06-04-2011 8:37am

I don't have access to the laptop to run ipconfig. I'm trying to fix it over the phone for her, but I'll try to get her to send that to me later today.

If it was an issue with DNS servers, wouldnt me changing them to the google DNS fix that?

Thanks!

Spear · 06-04-2011 10:21am

king_of_inismac wrote: »

If it was an issue with DNS servers, wouldnt me changing them to the google DNS fix that?

No it wouldn't, as already mentioned, the reg entries override the network panel settings.

king_of_inismac · 06-04-2011 10:33am

Yep, sounds exactly like that! What's the best/easiest fix for something like that? Some sort of restore?

Spear · 06-04-2011 10:40am

king_of_inismac wrote: »

Yep, sounds exactly like that! What's the best/easiest fix for something like that? Some sort of restore?

Removing the reg entries sorts the immediate DNS issue. On the large scale, the machine will need to be disinfected of the trojan itself, and patched to avoid further infections.

This is all assuming of course that a trojan is doing this.

king_of_inismac · 06-04-2011 11:48am

How exactly do I remove the problem reg entries?

I should really know how to do this, but I dont

I'll probably do a full reinstall at some stage soon to sort the trojan, but I just need to get it up and running for now.

Thanks again for the help!

Spear · 06-04-2011 11:51am

king_of_inismac wrote: »

How exactly do I remove the problem reg entries?

I should really know how to do this, but I dont

I'll probably do a full reinstall at some stage soon to sort the trojan, but I just need to get it up and running for now.

Thanks again for the help!

You can just locate them in regedit and manually delete them. But first it's best to make sure what's happening rather then mess in the registry needlessly.

king_of_inismac · 06-04-2011 11:54am

Thanks Spear,

I'll try to get more info when she has access to the laptop tonight.

I've used regedit before, but how do I know exactly which ones to delete?

Spear · 06-04-2011 12:18pm

king_of_inismac wrote: »

Thanks Spear,

I'll try to get more info when she has access to the laptop tonight.

I've used regedit before, but how do I know exactly which ones to delete?

A search for NameServer should show them.

king_of_inismac · 06-04-2011 12:24pm

Excellent! Really appreciate the help man!

king_of_inismac · 06-04-2011 6:44pm

asked the girlfriend to do a find in regedit for nameserver.

there were three entries. Should I suggest that she delete them all?

Thanks,
M

Spear · 06-04-2011 7:02pm

king_of_inismac wrote: »

asked the girlfriend to do a find in regedit for nameserver.

there were three entries. Should I suggest that she delete them all?

Thanks,
M

There could be innocent values in there, so best post the values first.

king_of_inismac · 06-04-2011 10:48pm

Here's the result from ipconfig /all:

Windows IP Configuration

Host Name . . . . . . . . . . . . : PJs_LENOVO
Primary Dns Suffix . . . . . . . :
Node Type . . . . . . . . . . . . : Unknown
IP Routing Enabled. . . . . . . . : No
WINS Proxy Enabled. . . . . . . . : No

Ethernet adapter Wireless Network Connection:

Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Intel(R) WiFi Link 5100 AGN
Physical Address. . . . . . . . . : 00-22-FA-D1-C4-2A
Dhcp Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
IP Address. . . . . . . . . . . . : 192.168.100.11
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 192.168.100.254
DHCP Server . . . . . . . . . . . : 192.168.100.254
DNS Servers . . . . . . . . . . . : 8.8.8.8
192.168.1.1
Lease Obtained. . . . . . . . . . : 06 April 2011 22:24:17
Lease Expires . . . . . . . . . . : 06 April 2011 23:24:17

Ethernet adapter Local Area Connection:

Media State . . . . . . . . . . . : Media disconnected
Description . . . . . . . . . . . : Broadcom NetLink (TM) Fast Ethernet
Physical Address. . . . . . . . . : 00-23-5A-1A-F1-17

%=======================================%

The three entries in regedit when i do a find for nameserver are:
Default
KeyType
RegLocation

Which one of these will I delete and does anyone know if this is causing the problem?

Thanks,
Martin

Spear · 06-04-2011 10:58pm

http://www.windowsreference.com/networking/dhcp-static-ip-settings-in-windows-registry/

That will illustrate what you're looking for and has both cases, DHCP and static addresses.

king_of_inismac · 08-04-2011 8:41pm

Ok the problem just got deeper.

Im connecting to the internet here using my mac. I am using the exact same DNS as the laptop that cannot connect to the internet.

On the unconnected laptop, using the command prompt, I can ping 8.8.8.8, but when I try to ping google, its say the usual "unresolved host". Skype also works fine.

In regedit, I've checked the "Nameserver" settings, and they're all set to the proper DNS value that's working for my mac. No other NameServer entries (under interfaces at least).

Another symptom is that if I type an ip address in IE, it still doesn't find the website (eg. http://72.244.3.44 or whatever).

It's so weird. I'm running an antivirus/malware tool now, but I dont think that's the problem.

Any help greatly appreciated.

Thanks,
M

Spear · 08-04-2011 9:05pm

king_of_inismac wrote: »

Ok the problem just got deeper.

Im connecting to the internet here using my mac. I am using the exact same DNS as the laptop that cannot connect to the internet.

On the unconnected laptop, using the command prompt, I can ping 8.8.8.8, but when I try to ping google, its say the usual "unresolved host". Skype also works fine.

In regedit, I've checked the "Nameserver" settings, and they're all set to the proper DNS value that's working for my mac. No other NameServer entries (under interfaces at least).

Another symptom is that if I type an ip address in IE, it still doesn't find the website (eg. http://72.244.3.44 or whatever).

It's so weird. I'm running an antivirus/malware tool now, but I dont think that's the problem.

Any help greatly appreciated.

Thanks,
M

Is there a firewall on the Windows machine? Did it get updated recently?

king_of_inismac · 08-04-2011 11:17pm

There is a firewall, but even when its off the problem persists....

Spear · 08-04-2011 11:19pm

king_of_inismac wrote: »

There is a firewall, but even when its off the problem persists....

I doubt it's DNS related, it sounds more like there's no connectivity at all. Is it wired or wireless? Is there a link light on at the network adapter? What does tracert www.boards.ie produce?

king_of_inismac · 08-04-2011 11:28pm

Using the command window:
Tracert www.boards.ie says "unable to resolve"

but if I tracert the ip address of boards.ie, it does give 8 ip addresses.

The weird thing is when I put http://(the boards ip address), it still doesnt work in the browser

Sorry: It's wireless. Seems to be connected fine because I can use ping in the command window.

Spear · 08-04-2011 11:33pm

There's something a little odd in the settings you posted before. You have a DNS server at 192.168.1.1 but keep the machines on a different subnet of 192.180.100.x? Is there a reason for this?

king_of_inismac · 08-04-2011 11:37pm

No sorry.

Ip address is 192.168.100.11

and

DNS is 192.168.100.254

Spear · 08-04-2011 11:46pm

king_of_inismac wrote: »

No sorry.

Ip address is 192.168.100.11

and

DNS is 192.168.100.254

One simple enough thing to try, ipconfig /flushdns.

king_of_inismac · 08-04-2011 11:49pm

No joy I'm afraid... It's so weird. I can ping ip address, but can't ping domain names (which would normally indicate DNS problems), but I'm using the same DNS for my mac and even when I type the IP address into IE, it still cant find the site!

Spear · 08-04-2011 11:55pm

king_of_inismac wrote: »

No joy I'm afraid... It's so weird. I can ping ip address, but can't ping domain names (which would normally indicate DNS problems), but I'm using the same DNS for my mac and even when I type the IP address into IE, it still cant find the site!

Where are you based?

king_of_inismac · 08-04-2011 11:57pm

Louth. I'm kinda out of ideas at this stage!

Spear · 09-04-2011 12:08am

king_of_inismac wrote: »

Louth. I'm kinda out of ideas at this stage!

Bit too far for a look see in person then I'm afraid.

But there is one thing:

Node type unknown, which is related to a broken proxy setting according to MS

http://support.microsoft.com/kb/310570

king_of_inismac · 09-04-2011 10:38am

Thanks Spear.

I tried changing the setting but still no joy.

I also did a system restore but that didn't work either. Considering a reinstall now, which is a total pain because there's a lot of custom software installed on the machine.

Spear · 09-04-2011 1:07pm

king_of_inismac wrote: »

Thanks Spear.

I tried changing the setting but still no joy.

I also did a system restore but that didn't work either. Considering a reinstall now, which is a total pain because there's a lot of custom software installed on the machine.

A full re-install is probably overkill.

You could try resetting the entire network stack:

http://www.zimbio.com/Windows+Vista/articles/43/Reinstall+Reset+TCP+IP+Internet+Protocol+Windows

Annoying DNS problem - need help!

Comments