Slow DNS resolution with potential to completely free system

[ATCtech]

I've been experiencing the DNS lookup problem for the last few weeks on my Windows 10 Home PC. For me it surfaces after the PC sits idle overnight, the only scheduled tasks being nightly backups (Marcrium Reflect) and NOD32 checks done twice per week per partition. On first use in the morning the DNS lookup delay is present, rebooting clear it and the computer performs normally all day. I have also let it sit during the day, no 'primary' programs like email or web browsers open and it will begin to show DNS delays after it sits for a few hours (5 or more typically). 

The other thing I noticed is that when the DNS delay problem is present if I quit MalwareBytes, wait a minute or so, then relaunch the program I get a message that "MalwareBytes cannot connect to the service". I have rebooted the PC in the last hour today because the DNS delay was happening this morning and quitting then relaunching MalwareBytes works normally, no error message and the program runs normally.

I have delayed both NOD32 and backup tasks to daytime hours and the DNS problem still happens overnight. Reinstalling it using the provided repair program does not change anything, the DNS delay was there the very next morning as expected. For the time being killing Malwarebytes overnight seems to be the only work-around.

FWIW, I'm a "premium" user going back to the days of the perpetual license versus annual subscription.

 

[Firefox]

Hello and Welcome @ATCtech

Sorry to hear about your issues.

Please do the following so that we may take a closer look at what is going on:

1. Run the Malwarebytes Support Tool
2. Accept the EULA and click Advanced tab on the left (not Start Repair)
3. Click the Gather Logs button, and once it completes, attach the zip file it creates on your desktop to your next reply

Please let us know how it goes.

Thanks

[ATCtech]

This morning the PC exhibited the usual slowness/refusal with DNS as I expected. I want to mention that for whatever reason, Firefox as my default browser is the primary victim of this problem, my email collection program (Mailwasher) a close second, basic command prompt traceroutes using DNS names versus IP addresses never complete but for whatever reason Microsoft Edge doesn't seem to have a problem, at least nothing noticeable, when everything else refuses to complete.

So, after confirming it was status quo early this morning I ran the support tool. The 'collecting logs' process took in excess of 25 minutes. The second stage, FRST sat for almost half an hour at which point I clicked "cancel". It wouldn't cancel, so I killed it through Task Manager and rebooted the computer. I re-ran the support tool and it completed everything in about 2 minutes. I was watching Task Manager as it ran the first time. Even before I launched th e support tool as you'll see in the attachment the MWB service was using considerable resources given that the computer was idle after finishing Macrium backups 4 hours earlier. The second image attached is after I rebooted, matter of fact I just did the screen grab as I'm writing this message. Outlook 2010, Mailwasher and Firefox are all running right now and all is well.

The file created by the support tool post-reboot are attached. I was hoping to give you the same while the fault was "live" but clearly that's not possible at this point, sorry!

Cheers!

Bob

mbst-grab-results.zip

[Firefox]

Thanks for the added info and the logs, lets wait for a member of staff to review them, and hopefully they can get to the bottom of whats going on with your system.

A quick look at the logs show you are using ESET Security, which may be conflicting with Malwarebytes. See if you can exclude Malwarebytes files from ESET

Malwarebytes for Windows antivirus exclusions list
https://support.malwarebytes.com/hc/en-us/articles/360038522974

https://support.eset.com/en/kb2769-exclude-files-or-folders-from-scanning-in-eset-windows-home-products

@LiquidTension, when you get a chance can you review the logs please.

[ATCtech]

Thanks! The exclusions listed in the links you provided have now been set in EST NOD32. We'll see what happens over the next 48 hours.

[Firefox]

Great, keep us posted.  Staff may have other recommendations after they review the logs as well.

[ATCtech]

Exactly the same slow to non-existent DNS lookup situation this morning and I see another user has posted virtually identical conditions (affecting browsers etc. but NOT Microsoft Edge) overnight as well. I guess it's good to see that am not alone in my observations.

[tromstar]

I also have had this (resolving address) issue since upgrading to version 4 some months ago. I can confirm that it only seems to affect chrome based browsers. Sometimes a reboot offers a temporary fix but only sometimes. It is very annoying. Another thing that happens on my machine when it is occurring is that I am unable to turn off web protection, the Switch hangs and I then have to reboot. I had no problems at all with Malwarebytes on this PC until I installed version 4.   

[FloridaCTO]

Same problem here.

Running Windows 10 Pro – Latest updates and MalwareBytes Premium (latest released edition). Windows 10 Security center is the only other active product enables.

This has been going on for weeks and is extremely frustrating. Initially, I thought this was related to the Web Protection but I turned it off and the problem persists. It usually occurs after a scan and only a reboot or killing the MB service resolves. The issue appears to occur across Edge, Chrome and (in my case) effects other internet communication services like launching Outlook, establishing VPN connections etc.

I am sure this has nothing to do the our network connection as – when this situation occur- I can spin up a VM on the same computer running a clean Windows 10 and (within that VM) – I see no problems navigating the internet – of course the VM does not have MalwareBytes installed..

[Porthos]

Has any one tried another browser  other than Chrome like Firefox?

[ATCtech]

Yes, I first noticed the problem with Firefox weeks ago.

[FloridaCTO]

Yes, just tested (again) now.

All I had to do was  run a scan, wait for it to complete and “bingo” – slow internet access again.

Firefox was a problem here as well.

Instead of rebooting my laptop to get things going again, I just disabled all the MB protection services and closed out the program form the task-bar link.

Problem resolved.

 

[Porthos]

3 minutes ago, FloridaCTO said:

All I had to do was  run a scan, wait for it to complete and “bingo” – slow internet access again.

Like I mentioned before, I have had success with clients by removing scheduled scans and doing them manually and restarting the computer after the scan.

 

[FloridaCTO]

No doubt that will work...

[FloridaCTO]

I suppose with all the MB protection settings enabled there would be less need to run a manual scan in the first place (unless one suspects some type of malware). So together with Windows 10 Security doing its thing (which does include periodic scanning without interfering with Internet access) – this might be the best possible solution at this time.

[Porthos]

4 minutes ago, FloridaCTO said:

So together with Windows 10 Security doing its thing (which does include periodic scanning without interfering with Internet access)

In many cases to keep Windows 10 security fully active you need to turn off the below setting in MB.

 

[FloridaCTO]

Good point. Thanks

[FloridaCTO]

That was our situation. Seems to be an issue with the scanning. Of course a reboot helps but that sort of defeats the purpose of scanning in the middle of the evening when you want to keep the WS.

Our final solution - don't schedule scans unless you can reboot afterwards.. Only perform them manually when you suspect some issue and then reboot. Between MB and Windows 10 Security Center, we feel our workstations are pretty well protected either way.

 

[Porthos]

On 4/13/2020 at 8:26 AM, FloridaCTO said:

That was our situation. Seems to be an issue with the scanning. Of course a reboot helps but that sort of defeats the purpose of scanning in the middle of the evening when you want to keep the WS.

Our final solution - don't schedule scans unless you can reboot afterwards.. Only perform them manually when you suspect some issue and then reboot. Between MB and Windows 10 Security Center, we feel our workstations are pretty well protected either way.

 

I am glad my solution works for another poster.

[FloridaCTO]

Both

[FloridaCTO]

Yep, good product except for this one really annoying issue.

We used to have workstations perform a scheduled scan every day during work hours since there was no easy way to wake the computer from sleep to perform the scan during the evening. However, we can't do that now because it will interfere with the user. They would be working during the scan and shortly thereafter, they would no longer be able to browse the internet or perform other processes that require DNS (even email was affected). Asking users to reboot their computer whenever this happened was not an option.

From scanning other posts on this forum, I see absolutely no solution from MWB other then to request for debugging logs - so I eventually gave up on this one.

I think the best action is to simply not perform scheduled scans. Just do them manually if you suspect anything strange and then reboot. At least enabling MWB full security in combination with Windows 10 Security Center (ie. MWB provisioned so as to not replace Microsoft Security Center) seems to be the best option for a combined protection blanket)