Jump to content

Web Protection is breaking DNS resolution on a specific 10gb adapter


Recommended Posts

I am having trouble with the Web Protection feature. The integrated 1gb NIC works fine and is not affected by Web Protection. However the PCIe 10gb NIC loses all DNS resolution which obviously breaks the internet connectivity. With Web Protection off it works again. This is a clean install of the latest release of Windows 10. I have reinstalled MWB and the NIC drivers. I have also done a clean and reset using the support tool. I also collected the logs with the tool with WP on and off.

Link to post
Share on other sites

  • Staff

***This is an automated reply***

Hi,

Thanks for posting in the Malwarebytes for Windows Help forum.

If you are having technical issues with our Windows product, please do the following:

Malwarebytes Support Tool - Advanced Options

This feature is designed for the following reasons:

  • For use when you are on the forums and need to provide logs for assistance
  • For use when you don't need or want to create a ticket with Malwarebytes
  • For use when you want to perform local troubleshooting on your own

How to use the Advanced Options:

Spoiler
  1. Download Malwarebytes Support Tool
  2. Double-click mb-support-X.X.X.XXXX.exe to run the program
    • You may be prompted by User Account Control (UAC) to allow changes to be made to your computer. Click Yes to consent.
  3. Place a checkmark next to Accept License Agreement and click Next
  4. Navigate to the Advanced tab
  5. The Advanced menu page contains four categories:
    • Gather Logs: Collects troubleshooting information from the computer. As part of this process, Farbar Recovery Scan Tool (FRST) is run to perform a complete diagnosis. The information is saved to a file on the Desktop named mbst-grab-results.zip and can be added as an email attachment or uploaded to a forum post to assist with troubleshooting the issue at hand.
    • Clean: Performs an automated uninstallation of all Malwarebytes products installed to the computer and prompts to install the latest version of Malwarebytes for Windows afterwards. The Premium license key is backed up and reinstated. All user configurations and other data are removed. This process requires a reboot.
    •  Repair System: Includes various system-related repairs in case a Windows service is not functioning correctly that Malwarebytes for Windows is dependent on. It is not recommended to use any Repair System options unless instructed by a Malwarebytes Support agent.
    • Anonymously help the community by providing usage and threat statistics: Unchecking this option will prevent Malwarebytes Support Tool from sending anonymous telemetry data on usage of the program.
  6. To provide logs for review click the Gather Logs button
  7. Upon completion, click OK
  8. A file named mbst-grab-results.zip will be saved to your Desktop
  9. Please attach the file in your next reply.
  10. To uninstall all Malwarebytes Products, click the Clean button.
  11. Click the Yes button to proceed. 
  12. Save all your work and click OK when you are ready to reboot.
  13. After the reboot, you will have the option to re-install the latest version of Malwarebytes for Windows.
  14. Select Yes to install Malwarebytes.
  15. Malwarebytes for Windows will open once the installation completes successfully.

Screenshots:

Spoiler
 
 
 
 
Spoiler

 

 

01.png

02.png

03.png

04.png

05.png

06.png

 

 

If you are having licensing issues, please do the following: 

Spoiler

For any of these issues:

  • Renewals
  • Refunds (including double billing)
  • Cancellations
  • Update Billing Info
  • Multiple Transactions
  • Consumer Purchases
  • Transaction Receipt

Please contact our support team at https://support.malwarebytes.com/hc/en-us/requests/new to get help

If you need help looking up your license details, please head here: Find my premium license key

 

 

Thanks in advance for your patience.

-The Malwarebytes Forum Team

Link to post
Share on other sites

  • Staff

Greetings,

I'm sorry that Web Protection is affecting your NIC's ability to connect, but hopefully we can figure out what the problem is and find a solution.

To begin, please attach the logs you generated from the Support Tool if you still have them.  If you do not, please run the tool again and create a fresh set; I've included instructions below in case they are needed, though you seem familiar with using the tool already:

  1. Run the Malwarebytes Support Tool
  2. Accept the EULA and click Advanced tab on the left (not Start Repair)
  3. Click the Gather Logs button, and once it completes, attach the zip file it creates on your desktop to your next reply

Please keep in mind that if you ran the tool the default way it generated a support ticket and sent the logs to the helpdesk, so we won't have access to them here on the forums.  The method described above will allow you to create an offline set of logs to post here.

Thanks

Link to post
Share on other sites

  • Staff

The newest driver I could locate for your device is from back in 2018 and is located on this page; the direct link to the driver can be found here:

https://sgcdn.startech.com/005329/media/sets/tehuti_tn4010_drivers/[tehuti tn4010] windows pcie 10 gigabit network card.zip

I would recommend trying to update the driver and restarting the system to see if that makes any difference.  Please be sure to actually restart the system rather than shutting it down then booting it up again because Windows 10 doesn't fully unload/reload normally when the shut down option is used (details about this can be found here if you're curious).

I also noted that the logs you sent me via PM show your DNS address as being set to 10.1.1.1 (likely your router's local network address); does it have any effect on the issue if you change your DNS to obtain DNS server address automatically?

Please see if updating the driver helps or not as well as modifying your DNS to auto and let us know how it goes and whether or not either of these changes makes any difference with Web Protection enabled.

Thanks

Edited by exile360
Link to post
Share on other sites

  • 2 weeks later...

I have installed this driver version and DNS is already set to auto. I did use Wireshark and noticed the DNS request is sent but never received on that adapter with web protection enabled. As soon as it is disabled it starts working again. Any other suggestions other than leaving it off?

Link to post
Share on other sites

  • Staff

A new version of Malwarebytes was released recently, hopefully it will help.

Please try updating and restarting your system to see if the new version helps.

  • To do so, open Malwarebytes and navigate to settings by clicking the small gear icon in the upper right, then click the Check for updates button located under the General tab near the top.
  • It should download and install the new version.  Once installed, verify the version info by visiting settings again and selecting the About tab where it should show Component package version 1.0.1236.
  • Next, restart your system to ensure the new version is loaded then test to see if you still have issues with your network connection with Web Protection enabled and post back to let us know how it went.

Thanks

Link to post
Share on other sites

  • Staff

Hello again @curvingedge, just checking to see if you had the chance to install the latest version of Malwarebytes mentioned above yet?

If so, did it fix the issue or are you still unable to connect with Web Protection active?

If the issue still persists with the latest version, please follow the instructions in this topic, skipping any steps you are unable to complete, then create a new topic in our malware removal area by clicking here and a malware removal specialist will guide you in checking your system.  Any logs you submit there will only be available to yourself, authorized helpers and staff in case privacy is a concern.

They have access to more advanced diagnostics and repair tools and may be able to find a solution to the issue.

In the meantime I'll also be reporting your findings to the Product team in case there is something the Developers can do to resolve the issue on their end.

Thanks

Link to post
Share on other sites

  • 4 months later...

So I finally today found the solution to this problem after a little Wireshark and trial and error. I am honestly very disappointed Malwarebytes didn't have a solution. It is a problem after knowing what it was that is referenced by other firewall vendors. The ethernet adapter has IPv4, tcp, udp checksum offload as an option and it was causing the DNS response in the svchost.exe to be filtered or blocked (maybe just an unexpected response). So if anyone has this issue in the future advise them to turn off at least udp checksum offload if their adapter is equipped. There is a compatibility problem with checksum offload and some firewalls.

Link to post
Share on other sites

On 8/20/2021 at 4:05 AM, AdvancedSetup said:

Thank you for the feedback and possible solution @curvingedge . Do you have a link to written documentation concerning this?

Unfortunately having access to 10Gbps adapters is not something too many people would have access to including us. That makes actual testing very difficult.

 

To be fair my 1gb adapter works with offload enabled. So It may in fact just be the drivers or lack of specific compatibility with my 10gb adapter. 

 

Here is the information I found about Dell adapters offload not compatible with firewalls: https://www.dell.com/support/kbdoc/en-us/000138508/how-to-resolve-performance-tuning-and-connectivity-issues

Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
 Share

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.