Jump to content

Slow DNS Resolution

ViperMaul
 Share

Recommended Posts

ViperMaul

ViperMaul

Posted
Posted
On 4/13/2020 at 12:58 AM, gunter said:

The problem I'm having is that over time, host name resolution becomes slower and slower, eventually to the point where resolving host names is so slow that a reboot is required.

I've eliminated the possibility that this is a DNS issue - as host resolution using the command line tool nslookup provides instant name resolution, with no delay whatsoever.

This problem has been going on for several months now.

I don't want to install a previous version of Malewarebytes nor do I want to risk disabling web protection.

I really have liked using Malewarebytes up until now and I've used the support forums to help me out with some maleware that made it onto my computer.

In spite of this, I'm in a predicament - either I have to live with rebooting my computer every 2 or 3 days (sometimes I can't do this as I've long running programs that can't be terminated), or disable website protection - I really don't like that idea - or, ultimately, look to another product for maleware protection.

I have experienced the same problem on two separate computers. 
Disabling website protection so far for me did not resolve the issue. 

This issue for me happens across browsers: Brave, Chrome and believe it or not FireFox as well. All latest versions. 

Link to post
Share on other sites
Porthos

Porthos

Posted
Posted
19 minutes ago, ViperMaul said:

I have experienced the same problem on two separate computers. 
Disabling website protection so far for me did not resolve the issue. 

This issue for me happens across browsers: Brave, Chrome and believe it or not FireFox as well. All latest versions. 

@ViperMaul :welcome:

We need to get information from this machine in order to have the proper detail to help you forward.
 NOTE: The tools and the information obtained is safe and not harmful to your privacy or your computer, please allow the programs to run if blocked by your system.

    Download Malwarebytes Support Tool
    
    
    Once the file is downloaded, open your Downloads folder/location of the downloaded file
    Double-click mb-support xxx.xx.exe to run the report
        You may be prompted by User Account Control (UAC) to allow changes to be made to your computer. Click Yes to consent.
        
    Place a checkmark next to Accept License Agreement and click Next
    You will be presented with a page stating, "Get Started!"

    Do NOT use the button “Start repair” !
    Click the Advanced tab on the left column
    
    Click the Gather Logs button
    
    A progress bar will appear and the program will proceed with getting logs from your computer
   
    Upon completion, click a file named mbst-grab-results.zip will be saved to your Desktop. Click OK
    Please attach the ZIP file in your next reply.

Link to post
Share on other sites
  • 2 weeks later...
  • 1 month later...
ViperMaul

ViperMaul

Posted
  • Author
Posted

Hello @AdvancedSetup

I thought it was resolved however it is not. I am experiencing it now. 

When I was instructed to Download Malwarebytes Support Tool and gather logs back in April, I did so however the tools hung. Which is what some of my programs do when attempting to connect to the internet during this time. 

I think the tools timesout when the DNS is slow. So I rebooted my system a couple of times until the problem temporarily went away. I then had no more Slow DNS symptoms and your Malwarebytes Support Tool worked then. And then life got in the way handling my late mother's estate. 

 

Today... 

Even after my Malwarebytes Premium program has been updated twice since then the problem exists today.  Rebooting until the problem is resolved usually only lasts for 2 or 3 days before the issue returns. 

Disabling web protection and Exploit Protection as has been suggested above does not help in my situation. 

One interesting fact this time. Brave Browser is unaffected. I know this is different from last time. Hmm...

 

Other Symptoms

  1. Unable to connect to any Remote Desktop Locations using URL or direct IP  (in order to bypass any DNS issue ) <-- this is bizarre 
  2. NordVPN will not connect to any of it's servers.

 

Here is my troubleshooting steps: 

  1. Reviewed the following threads: 
    - https://forums.malwarebytes.com/topic/252535-slow-dns-resolution-with-potential-to-completely-free-system/
    - https://forums.malwarebytes.com/topic/255758-disables-internet/
    - https://forums.malwarebytes.com/topic/256041-slow-dns-resolution-with-mb-past-week-or-two
    - https://forums.malwarebytes.com/topic/256949-resolving-host-issue
    - https://forums.malwarebytes.com/topic/259094-slow-dns-resolution
     
  2. I have been monitoring this thread. 
    - https://forums.malwarebytes.com/topic/252535-slow-dns-resolution-with-potential-to-completely-free-system/page/3/
    - https://forums.malwarebytes.com/topic/257042-malwarebytes-41-beta/
     
  3. I have installed the Beta 4.1.1.71 on my desktop since one member @cchilderhose stated everything is running good so far.
    Reference:  https://forums.malwarebytes.com/topic/252535-slow-dns-resolution-with-potential-to-completely-free-system/page/3/?tab=comments#comment-1384592
     
  4. I left my laptop alone for comparison which is also experiencing the same problem.
  5. I intend on reporting back in a few days. 

 

Link to post
Share on other sites
Maurice Naggar

Maurice Naggar

Posted
Posted (edited)

@ViperMaul      do as noted above   ^^^^

b)  stick with the version 4.1.1.71

c) make no changes on your own

d)  I can guide you on DNS issue  / slow internet, etc

e) be sure to say whether the pc is using just a WIFI connection

Edited by Maurice Naggar
Link to post
Share on other sites
Maurice Naggar

Maurice Naggar

Posted
Posted

p.s,  IF the machine gets stuck or stalls out when you do run the MB Support tool, then lets gather up a Farbar F R S T  report.  That will still be very helpful for reviw.

1: Please download FRST from the link below and save it to your desktop:

"Download link for 32-Bit version Windows"



"Download link for 64-Bit Version Windows"



Please wait and look toward the top or bottom of your browser for the option to Run or Save.
Click Save to save the file version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

 

Run report with FRST

Right-click on FRST icon and select Run as Administrator to start the tool , and reply YES to allow it to proceed and run.
 

_Windows 8 or 10 users will be prompted about Windows *SmartScreen protection* - click line More info information on that screen and click button Run anyway on next screen._

Click YES when prompted by Windows U A C prompt to allow it to run.
Note: If you are prompted by Windows SmartScreen, click More info & followup & choose Run anyway.


Approve the Windows UAC prompt on Windows Vista and newer operating systems by clicking on Continue or Yes. 

Click Yes when the* disclaimer* appears in FRST.
The tool may want to update itself - in that case you'll be prompted when the update is completed and ready to use.

Make sure that Addition options is *checked* - the configuration should look exactly like on the screen below (do not mark additional things unless asked).
Press Scan button and wait.




The tool will produce 2  logfiles on your desktop: FRST.txt , Addition.txt 
Click OK button when it shows up. Close the Notepad windows when they show on screen. The tool saves the files.

Please attach these 2 files to your next reply.

Link to post
Share on other sites
ViperMaul

ViperMaul

Posted
  • Author
Posted
44 minutes ago, Porthos said:

Restart the computer and before doing anything else use the support tool to get us the log.

Porthos,

I should clarify.  I am no longer experiencing the problem.  I will continue to monitor. 

It is however only been 1 hour since I installed the beta. 

35 minutes ago, Maurice Naggar said:

@ViperMaul      do as noted above   ^^^^

b)  stick with the version 4.1.1.71

c) make no changes on your own

d)  I can guide you on DNS issue  / slow internet, etc

e) be sure to say whether the pc is using just a WIFI connection

After reading all of the threads and my own experiences, I am all but convinced this has nothing to do with a DNS issue. However, I am not as experienced or qualified as many of you are.

My Desktop PC ( mwb v4.1.1.71 ) is on Ethernet only. 
My Laptop ( mwb v4.1.0.56 ) is WIFI

Link to post
Share on other sites
Porthos

Porthos

Posted
Posted
5 minutes ago, ViperMaul said:

I should clarify.  I am no longer experiencing the problem.  I will continue to monitor. 

It is however only been 1 hour since I installed the beta. 

I have a feeling the issue, if it is still there after the beta was installed will kick in after the next scheduled scan.

The logs are important to the developers on computer experiencing the issue.

Link to post
Share on other sites
Maurice Naggar

Maurice Naggar

Posted
Posted

If there is a "hiccup"  or stall or any problem,  it is very key that we get reports from the problem machine (s).

You say you now have no "problem:.

So these are remarks:

A daily Woindows Start helps out a lot.  Having the machine only use sleep mode over a period of days is generally not a good practice.

I would suggest that you check to see that none of your Windows 10 machines use the Windows Fast Startup option.  Fast Starup needs to be OFF

https://www.tenforums.com/tutorials/4189-turn-off-fast-startup-windows-10-a.html

.

Check on the DNS Name server selections in Network settings

Rather than obtaining the DNS Server dynamically or using Google DNS or another,  try instead using the Cloudfare service.

 link for setting up Cloudflare locally: https://developers.cloudflare.com/1.1.1.1/setting-up-1.1.1.1/windows/

 

 

Link to post
Share on other sites
ViperMaul

ViperMaul

Posted
  • Author
Posted
15 minutes ago, Porthos said:

I have a feeling the issue, if it is still there after the beta was installed will kick in after the next scheduled scan.

Ah I read that reported theory in one of the threads. I too believe that has merit. It could help a lot to further isolate the issue. 
I will task that operation and submit both sets of logs. 

19 minutes ago, Maurice Naggar said:

A daily Woindows Start helps out a lot.  Having the machine only use sleep mode over a period of days is generally not a good practice.

I would suggest that you check to see that none of your Windows 10 machines use the Windows Fast Startup option.  Fast Starup needs to be OFF

https://www.tenforums.com/tutorials/4189-turn-off-fast-startup-windows-10-a.html

 

Check on the DNS Name server selections in Network settings

Rather than obtaining the DNS Server dynamically or using Google DNS or another,  try instead using the Cloudfare service.

 link for setting up Cloudflare locally: https://developers.cloudflare.com/1.1.1.1/setting-up-1.1.1.1/windows/

I don't intentionally use the Fast Startup option. I only learned about that today reading the through all of the posts on this issue. I will look to disable it. 
Last year when I experienced this issue, then not knowing it was related to Malwarebytes, I set all my computers to use 9.9.9.9 (www.quad9.net).
Quad9 showed up as the fastest for my specific area at the time when I used the DNS Benchmark from Security Now (https://www.grc.com/dns/benchmark.htm). 

 

 

Link to post
Share on other sites
  • Root Admin
AdvancedSetup

AdvancedSetup

Posted
  • Root Admin
Posted

Personally I'm not a fan of Hibernation either. In the many years of Windows Support I've done, hibernation has resulted in more than it's fair share of tickets.

How to Enable or Disable Hibernate in Windows 10
https://www.tenforums.com/tutorials/2859-enable-disable-hibernate-windows-10-a.html


 

 

Link to post
Share on other sites
  • 3 weeks later...
Maurice Naggar

Maurice Naggar

Posted
Posted

Hello.

Just so all readers are aware....

A new program version along with a new Component package for Malwarebytes for Windows was just announced on June 30th 2020.

Please be sure that you see the announcement

https://forums.malwarebytes.com/topic/257102-malwarebytes-41/?do=findComment&comment=1391173

 

The latest MB version  is    4.1.2.73    with Component   1.0.972 

 

image.png.9d784ea94e56eb77eb84f27fd353207b.png

Link to post
Share on other sites
ViperMaul

ViperMaul

Posted
  • Author
Posted

The issue back. 

During my time of running  mwb v4.1.1.71, I had no problems after many days of automated daily scans. However I don't think I had any other events that are known or found to trigger the issue. 

One event that I believe triggered it, was when I needed to update my FF Dev Browser. I had trouble updating it the first time. So I killed the process and updated it a second time with success. However from that point on I had the issues described below. I checked making a new RDP connection and could not. My existing RDP connection was still live and working. My Brave browser that was already running still had no impaired issues and was fast as it ever was. This has nothing to do with Brave itself, and more to do with the fact it was open and running during the trigger event. I did not reboot. I wanted to experience as many symptoms as I could. 

I apologize I am not confident of the next order of actions, but I do remember receiving an alert saying there was a beta update. So I updated to MWB  4.1.1.71 component update 1.0.961(I think this was it.) I ran the support tool so I am sure it captured the version. It will be attached. I rebooted. 

All was well until the 2nd alleged trigger event: I updated NordVPN to its latest version. I did not reboot because usually I don't have to. 

The problem was back. 

Trigger Events seem to be when I updating certain programs perhaps. 

I disabled Web Protection. The check box cleared but this did not solve the issue. 

I then attempted to disable Exploit Detection. The check box only greyed out. When that action didn't fix the issue, I attempted to open the MWB GUI and it would not open. I was stuck on that front. 

I tried running the support tool in this state and it hung. Details below. I then ran FRST and it hung as well. Details below. But it created partial logs. I will attach those. 

I have been dealing with life and injured family members so my responses have been slow. But I still haven't rebooted and my computer is still in the bad state. I am confident that a reboot will fix it until the next trigger event. But this time I refuse to reboot to let you the experts have a look. 
I am even open to TeamViewer access. But that is blocked in this state as well. I tried to restart TeamViewer and it hung.  AnyDesk works however by the way. Interesting. 

Here are my observations & thoughts. 

  • I no longer think we can say it is a result of a slow DNS. More of a slow connection problem. And even that statement, I do not have enough information to say that. My reason however follow.
  • Again during this scenario the following programs are unable to make *NEW* connections. Existing connections continue. RDP, NordVPN, TeamViewer. 
  • However there are some tools that can make connections like RawPortTCP, a tool to make manual connections. ShadowLauncher, a remote virtual OS to Windows 10. AnyDesk, a remote desktop tool. WhatsApp desktop,etc
  • mb-support-1.6.1.784 tool runs and seems slow but hangs at the FRST 
  • Running FRST by itself does successfully check for an update and updates but then hangs at "Scanning other areas..."  <== Interesting
  • Another observation, if certain browsers are open at the time of the trigger event, those browsers can continue to make *NEW* connections to new websites. If you close the browser then reopen, then it is impacted with super slow connections with the symptom of "Resolving hosts...." in the status bar. 
  • NordVPN logs gives some good debug that may lead to why some portions of programs hang and some don't 
    See attached. Reference the following timestamp 

2020-06-28 09:26:36.4474 ERROR MQTT: fail on connect: MQTTnet.Exceptions.MqttCommunicationException: Cannot access a disposed object.
Object name: 'System.Net.Sockets.Socket'. ---> System.ObjectDisposedException: Cannot access a disposed object.
Object name: 'System.Net.Sockets.Socket'.
   at System.Net.Sockets.Socket.InternalEndConnect(IAsyncResult asyncResult)
   at System.Net.Sockets.Socket.EndConnect(IAsyncResult asyncResult)
   at System.Net.Sockets.Socket.<>c.<ConnectAsync>b__317_0(IAsyncResult iar)
--- End of stack trace from previous location where exception was thrown ---

 

On 6/9/2020 at 9:49 AM, Maurice Naggar said:

If there is a "hiccup"  or stall or any problem,  it is very key that we get reports from the problem machine (s).

You say you now have no "problem:.

So these are remarks:

A daily Woindows Start helps out a lot.  Having the machine only use sleep mode over a period of days is generally not a good practice.

I would suggest that you check to see that none of your Windows 10 machines use the Windows Fast Startup option.  Fast Starup needs to be OFF

https://www.tenforums.com/tutorials/4189-turn-off-fast-startup-windows-10-a.html

.

Check on the DNS Name server selections in Network settings

Rather than obtaining the DNS Server dynamically or using Google DNS or another,  try instead using the Cloudfare service.

 link for setting up Cloudflare locally: https://developers.cloudflare.com/1.1.1.1/setting-up-1.1.1.1/windows/

 

 

I work from home for years. Historically I do not restart my main work computer. Ever. Except for Windows Updates and the occasional reboot to fix recent issues with MWB due to this issue. 

Today I have turned off Fast Startup per your guidance. 
I had 1.1.1.1 as my secondary. It is now my primary as the DNS Benchmarks found it was the fastest available for my area. 
 

On 6/9/2020 at 10:40 AM, AdvancedSetup said:

Personally I'm not a fan of Hibernation either. In the many years of Windows Support I've done, hibernation has resulted in more than it's fair share of tickets.

How to Enable or Disable Hibernate in Windows 10
https://www.tenforums.com/tutorials/2859-enable-disable-hibernate-windows-10-a.html


 

 

I agree. I checked and discovered that I have already set Hibernate to never on my High Performance profile which I use primarily. 

See attached files as promised...

FRST.txt Addition.txt mbst-grab-results-Sunday-2020-06-21t161957-0500.zip NordVPN_Logs_app-2020-06-28.7z

Link to post
Share on other sites
Porthos

Porthos

Posted
Posted
Quote

Controllers Version:     1.0.967

Please check for program update should 1.0.972

2 hours ago, ViperMaul said:

Today I have turned off Fast Startup per your guidance. 

Log shows ,

Quote

System has been up for:          5 days 20 hours 22 minutes 8 seconds
Hibernation :                    On
Fast Startup:                    On

 

2 hours ago, ViperMaul said:

Historically I do not restart my main work computer. Ever. Except for Windows Updates and the occasional reboot to fix recent issues with MWB due to this issue. 

You have a ton of files needing a restart. Too many to list them all.

Quote

Pending File Rename Operations
==================================
C:\Program Files\Firefox Developer Edition\tobedeleted\moz4f2c859b-9560-48ca-af63-ce95dd7c2dcf
C:\Program Files\Firefox Developer Edition\tobedeleted                               
C:\Program Files\Firefox Developer Edition\tobedeleted\moz4f2c859b-9560-48ca-af63-ce95dd7c2dcf
C:\Program Files\Firefox Developer Edition\tobedeleted\                              
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice_tmp.exe        
C:\Program Files (x86)\Dropbox\Update\Install\{6954137E-C568-4E5F-8058-D151E3E95CAA}\DropboxClient_100.4.409.exe
C:\Program Files (x86)\Dropbox\Update\Install\{6954137E-C568-4E5F-8058-D151E3E95CAA}
C:\Program Files (x86)\Dropbox\Update\Install                                        
C:\Program Files (x86)\Dropbox\Update\Install\{6954137E-C568-4E5F-8058-D151E3E95CAA}\DropboxClient_100.4.409.exe
C:\Program Files (x86)\Dropbox\Update\Install\{6954137E-C568-4E5F-8058-D151E3E95CAA}
C:\Program Files (x86)\Dropbox\Update\Install                                        
C:\Program Files (x86)\Dropbox\Update\Install\{6954137E-C568-4E5F-8058-D151E3E95CAA}\DropboxClient_100.4.409.exe
C:\Program Files (x86)\Dropbox\Update\Install\{6954137E-C568-4E5F-8058-D151E3E95CAA}
C:\Program Files (x86)\Dropbox\Update\Install                                        
C:\Program Files (x86)\Dropbox\Update\Install\{6954137E-C568-4E5F-8058-D151E3E95CAA}\DropboxClient_100.4.409.exe
C:\Program Files (x86)\Dropbox\Update\Install\{6954137E-C568-4E5F-8058-D151E3E95CAA}
C:\Program Files (x86)\Dropbox\Update\Install                                        
C:\Program Files (x86)\Dropbox\Update\Install\{6954137E-C568-4E5F-8058-D151E3E95CAA}\DropboxClient_100.4.409.exe
C:\Program Files (x86)\Dropbox\Update\Install\{6954137E-C568-4E5F-8058-D151E3E95CAA}
C:\Program Files (x86)\Dropbox\Update\Install                                        
C:\Program Files (x86)\Dropbox\Update\Install\{6954137E-C568-4E5F-8058-D151E3E95CAA}\DropboxClient_100.4.409.exe
C:\Program Files (x86)\Dropbox\Update\Install\{6954137E-C568-4E5F-8058-D151E3E95CAA}
C:\Program Files (x86)\Dropbox\Update\Install                                        
C:\Program Files (x86)\Dropbox\Update\Install\{6954137E-C568-4E5F-8058-D151E3E95CAA}\DropboxClient_100.4.409.exe
C:\Program Files (x86)\Dropbox\Update\Install\{6954137E-C568-4E5F-8058-D151E3E95CAA}
C:\Program Files (x86)\Dropbox\Update\Install                                        
C:\WINDOWS\TEMP\MicrosoftEdge_X64_83.0.478.56_83.0.478.54.exe827c9e0                 
C:\Program Files\Firefox Developer Edition\tobedeleted\moz60ce6983-7513-4bf4-b149-5c7a42a0d409
C:\Program Files\Firefox Developer Edition\tobedeleted                               
C:\Program Files\Firefox Developer Edition\tobedeleted                               
C:\Program Files (x86)\Dropbox\Update\Install\{6954137E-C568-4E5F-8058-D151E3E95CAA}\DropboxClient_100.4.409.exe
C:\Program Files (x86)\Dropbox\Update\Install\{6954137E-C568-4E5F-8058-D151E3E95CAA}
C:\Program Files (x86)\Dropbox\Update\Install                                        
C:\Program Files (x86)\Dropbox\Update\Install\{6954137E-C568-4E5F-8058-D151E3E95CAA}\DropboxClient_100.4.409.exe
C:\Program Files (x86)\Dropbox\Update\Install\{6954137E-C568-4E5F-8058-D151E3E95CAA}
C:\Program Files (x86)\Dropbox\Update\Install                                        
C:\Program Files (x86)\Dropbox\Update\Install\{6954137E-C568-4E5F-8058-D151E3E95CAA}\DropboxClient_100.4.409.exe
C:\Program Files (x86)\Dropbox\Update\Install\{6954137E-C568-4E5F-8058-D151E3E95CAA}

 

Link to post
Share on other sites
ViperMaul

ViperMaul

Posted
  • Author
Posted

Like I said, I refused to reboot unless guided to do so. 
I am sure your team will want more information before I reboot. 
Perhaps even to log on. I am willing to keep my main machine in this degraded state until you had a chance to analyze it. 

> Please check for program update should 1.0.972

This will require a reboot. Are you sure there is not anything more you need before I reboot and lose this degraded state?

Link to post
Share on other sites
ViperMaul

ViperMaul

Posted
  • Author
Posted
1 minute ago, Porthos said:

It shouldn't as long as all programs are closed beforehand. but I will alert @LiquidTension to see if he needs anything else.

I am only chiming in on what I saw in the logs.

Normally it shouldn't but in my report above, albeit a messy one, I stated that I could no longer open MWB GUI. I launch it and nothing happens. So I cannot update or upgrade without a reboot. 

Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
 Share
Go to topic listing

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.