Windows DNS corrupted by Firefox

I was running firefox and updated to 3.5 version that apparently has
corrupted windows ability to clear DNS. I have manually ran the ipconfig
/flushdns on several occassions and it appears to help for a little while,
but it isn't long until I get a message in my browser "unable to locate
server". This happens with IE8, Firefox 3.5, Google Chrome 2.0 and Safari
4.0. I have read up as much as possible and it appears that the firefox
update was the culprit and has affected the other browsers. Any thoughts on
how to uncorrupt this issue in windows? I am running windows xp. Thanks in
advance.

"SupermanGolfer" <SupermanGolfer@discussions.microsoft.com> wrote in message
news:DE101C96-4BD1-49AD-B168-F12E2638D933@microsoft.com...
>I was running firefox and updated to 3.5 version that apparently has
> corrupted windows ability to clear DNS. I have manually ran the ipconfig
> /flushdns on several occassions and it appears to help for a little while,
> but it isn't long until I get a message in my browser "unable to locate
> server". This happens with IE8, Firefox 3.5, Google Chrome 2.0 and Safari
> 4.0. I have read up as much as possible and it appears that the firefox
> update was the culprit and has affected the other browsers. Any thoughts
> on
> how to uncorrupt this issue in windows? I am running windows xp. Thanks
> in
> advance.


I'm not a Firefox user, but I was curious about your 'corruption' statement.
So I searched on "firefox 3.5 corrupts" and got numerous links on various
issues with Firefox. Tell you the truth, I was surprised about all the
issues I found. Most of them just stated to download the next update, etc. I
think 3.5.2 is the latest? Is that the version you have?

Anyway, regarding the local host cache (and it's not really the "DNS cache,"
which is a misnomer because it also uses HOSTS files as well, such as that
if anything is in the hosts file, it will look at that first, cache it, then
retrieve it. Now if you are flushing it and it works, that may indicate some
sort of corruption in the cache or the DNS addresses being used have been
compromised by the DNS exploit that an attacker can inject their own data
into the DNS Server's cache, which is also referred to as cache poisoning
(nothing to do with the client side).

Prior to flushing the cache, run ipcoinfig /displaydns, and take a look at
what's in it and try to find the last thing you were visiting. I don't know
what DNS servers you are using, but you can confirm that the host entries in
the cache that you are viewing has the correct IP by using nslookup, and
select to use a different server with the 'server' command, such as using
4.2.2.2.

nslookup
> server 4.2.2.2
> www.whatever.com (or whatever you see in the cache)
> response returns

You can also try disabling the DNS Client service in your Services console
on your workstation (or laptop). This disables the local host cache and
forces each URL request (or any network resolver request) to look them up as
a request to the hosts file first, then the DNS server, and not cache the
response.

That will interesting if it works, otherwise, I cannot see how a network
enabled application can corrupt a lookup since all it is doing is merely
asking the operating system's client side resolver service (note - IE,
firefox, etc, do not do the resolution, they ask the OS) to resolve the
query, then the client side service resolves it based on whether it's in the
local host cache, and if not, it sends a query to the first DNS address in
IP properties, and if that doesn't answer, it removes the first entry from
the eligible resolve list for 15 minutes, then goes to the next entry in the
list, and so on until either a Null, NXdomain or it gets a response, whcih
then it will cache the response, and give the response to the client side
resolver, which passes it to the requesting application.

Does that make sense?

Have you also posted to the Firefox forums regarding this issue?
Do you see any event log errors in your machine's Event log viewer? If so,
post the EventID# and source names.
Try a different DNS server in your IP properties instead of the one the ISP
provided, such as 4.2.2.2 and 4.2.2.3. They work nicely.


--
Ace

This posting is provided "AS-IS" with no warranties or guarantees and
confers no rights.

Please reply back to the newsgroup or forum for collaboration benefit among
responding engineers, and to help others benefit from your resolution.

Ace Fekay, MCT, MCTS Exchange, MCSE, MCSA 2003 & 2000, MCSA Messaging
Microsoft Certified Trainer

For urgent issues, please contact Microsoft PSS directly. Please check
http://support.microsoft.com for regional support phone numbers.

"Ace Fekay [MCT]" wrote:

> "SupermanGolfer" <SupermanGolfer@discussions.microsoft.com> wrote in message
> news:DE101C96-4BD1-49AD-B168-F12E2638D933@microsoft.com...
> >I was running firefox and updated to 3.5 version that apparently has
> > corrupted windows ability to clear DNS. I have manually ran the ipconfig
> > /flushdns on several occassions and it appears to help for a little while,
> > but it isn't long until I get a message in my browser "unable to locate
> > server". This happens with IE8, Firefox 3.5, Google Chrome 2.0 and Safari
> > 4.0. I have read up as much as possible and it appears that the firefox
> > update was the culprit and has affected the other browsers. Any thoughts
> > on
> > how to uncorrupt this issue in windows? I am running windows xp. Thanks
> > in
> > advance.
>
>
> I'm not a Firefox user, but I was curious about your 'corruption' statement.
> So I searched on "firefox 3.5 corrupts" and got numerous links on various
> issues with Firefox. Tell you the truth, I was surprised about all the
> issues I found. Most of them just stated to download the next update, etc. I
> think 3.5.2 is the latest? Is that the version you have?
>
> Anyway, regarding the local host cache (and it's not really the "DNS cache,"
> which is a misnomer because it also uses HOSTS files as well, such as that
> if anything is in the hosts file, it will look at that first, cache it, then
> retrieve it. Now if you are flushing it and it works, that may indicate some
> sort of corruption in the cache or the DNS addresses being used have been
> compromised by the DNS exploit that an attacker can inject their own data
> into the DNS Server's cache, which is also referred to as cache poisoning
> (nothing to do with the client side).
>
> Prior to flushing the cache, run ipcoinfig /displaydns, and take a look at
> what's in it and try to find the last thing you were visiting. I don't know
> what DNS servers you are using, but you can confirm that the host entries in
> the cache that you are viewing has the correct IP by using nslookup, and
> select to use a different server with the 'server' command, such as using
> 4.2.2.2.
>
> nslookup
> > server 4.2.2.2
> > www.whatever.com (or whatever you see in the cache)
> > response returns
>
> You can also try disabling the DNS Client service in your Services console
> on your workstation (or laptop). This disables the local host cache and
> forces each URL request (or any network resolver request) to look them up as
> a request to the hosts file first, then the DNS server, and not cache the
> response.
>
> That will interesting if it works, otherwise, I cannot see how a network
> enabled application can corrupt a lookup since all it is doing is merely
> asking the operating system's client side resolver service (note - IE,
> firefox, etc, do not do the resolution, they ask the OS) to resolve the
> query, then the client side service resolves it based on whether it's in the
> local host cache, and if not, it sends a query to the first DNS address in
> IP properties, and if that doesn't answer, it removes the first entry from
> the eligible resolve list for 15 minutes, then goes to the next entry in the
> list, and so on until either a Null, NXdomain or it gets a response, whcih
> then it will cache the response, and give the response to the client side
> resolver, which passes it to the requesting application.
>
> Does that make sense?
>
> Have you also posted to the Firefox forums regarding this issue?
> Do you see any event log errors in your machine's Event log viewer? If so,
> post the EventID# and source names.
> Try a different DNS server in your IP properties instead of the one the ISP
> provided, such as 4.2.2.2 and 4.2.2.3. They work nicely.
>
>
> --
> Ace
>
> This posting is provided "AS-IS" with no warranties or guarantees and
> confers no rights.
>
> Please reply back to the newsgroup or forum for collaboration benefit among
> responding engineers, and to help others benefit from your resolution.
>
> Ace Fekay, MCT, MCTS Exchange, MCSE, MCSA 2003 & 2000, MCSA Messaging
> Microsoft Certified Trainer
>
> For urgent issues, please contact Microsoft PSS directly. Please check
> http://support.microsoft.com for regional support phone numbers.
>
> Ace,

The majority of the above information went well over my head, however, I did
manage to disabled the DNS Client service which fixed the problem. So far so
good :)
>

"SupermanGolfer" <SupermanGolfer@discussions.microsoft.com> wrote in message
news:98E2F5E6-E3D8-4CFB-AA73-9DDE5FA81286@microsoft.com...
>
>
> "Ace Fekay [MCT]" wrote:
>
>> "SupermanGolfer" <SupermanGolfer@discussions.microsoft.com> wrote in
>> message
>> news:DE101C96-4BD1-49AD-B168-F12E2638D933@microsoft.com...
>> >I was running firefox and updated to 3.5 version that apparently has
>> > corrupted windows ability to clear DNS. I have manually ran the
>> > ipconfig
>> > /flushdns on several occassions and it appears to help for a little
>> > while,
>> > but it isn't long until I get a message in my browser "unable to locate
>> > server". This happens with IE8, Firefox 3.5, Google Chrome 2.0 and
>> > Safari
>> > 4.0. I have read up as much as possible and it appears that the
>> > firefox
>> > update was the culprit and has affected the other browsers. Any
>> > thoughts
>> > on
>> > how to uncorrupt this issue in windows? I am running windows xp.
>> > Thanks
>> > in
>> > advance.
>>
>>
>> I'm not a Firefox user, but I was curious about your 'corruption'
>> statement.
>> So I searched on "firefox 3.5 corrupts" and got numerous links on various
>> issues with Firefox. Tell you the truth, I was surprised about all the
>> issues I found. Most of them just stated to download the next update,
>> etc. I
>> think 3.5.2 is the latest? Is that the version you have?
>>
>> Anyway, regarding the local host cache (and it's not really the "DNS
>> cache,"
>> which is a misnomer because it also uses HOSTS files as well, such as
>> that
>> if anything is in the hosts file, it will look at that first, cache it,
>> then
>> retrieve it. Now if you are flushing it and it works, that may indicate
>> some
>> sort of corruption in the cache or the DNS addresses being used have been
>> compromised by the DNS exploit that an attacker can inject their own data
>> into the DNS Server's cache, which is also referred to as cache poisoning
>> (nothing to do with the client side).
>>
>> Prior to flushing the cache, run ipcoinfig /displaydns, and take a look
>> at
>> what's in it and try to find the last thing you were visiting. I don't
>> know
>> what DNS servers you are using, but you can confirm that the host entries
>> in
>> the cache that you are viewing has the correct IP by using nslookup, and
>> select to use a different server with the 'server' command, such as using
>> 4.2.2.2.
>>
>> nslookup
>> > server 4.2.2.2
>> > www.whatever.com (or whatever you see in the cache)
>> > response returns
>>
>> You can also try disabling the DNS Client service in your Services
>> console
>> on your workstation (or laptop). This disables the local host cache and
>> forces each URL request (or any network resolver request) to look them up
>> as
>> a request to the hosts file first, then the DNS server, and not cache the
>> response.
>>
>> That will interesting if it works, otherwise, I cannot see how a network
>> enabled application can corrupt a lookup since all it is doing is merely
>> asking the operating system's client side resolver service (note - IE,
>> firefox, etc, do not do the resolution, they ask the OS) to resolve the
>> query, then the client side service resolves it based on whether it's in
>> the
>> local host cache, and if not, it sends a query to the first DNS address
>> in
>> IP properties, and if that doesn't answer, it removes the first entry
>> from
>> the eligible resolve list for 15 minutes, then goes to the next entry in
>> the
>> list, and so on until either a Null, NXdomain or it gets a response,
>> whcih
>> then it will cache the response, and give the response to the client side
>> resolver, which passes it to the requesting application.
>>
>> Does that make sense?
>>
>> Have you also posted to the Firefox forums regarding this issue?
>> Do you see any event log errors in your machine's Event log viewer? If
>> so,
>> post the EventID# and source names.
>> Try a different DNS server in your IP properties instead of the one the
>> ISP
>> provided, such as 4.2.2.2 and 4.2.2.3. They work nicely.
>>
>>
>> --
>> Ace
>>
>> This posting is provided "AS-IS" with no warranties or guarantees and
>> confers no rights.
>>
>> Please reply back to the newsgroup or forum for collaboration benefit
>> among
>> responding engineers, and to help others benefit from your resolution.
>>
>> Ace Fekay, MCT, MCTS Exchange, MCSE, MCSA 2003 & 2000, MCSA Messaging
>> Microsoft Certified Trainer
>>
>> For urgent issues, please contact Microsoft PSS directly. Please check
>> http://support.microsoft.com for regional support phone numbers.
>>
>> Ace,
>
> The majority of the above information went well over my head, however, I
> did
> manage to disabled the DNS Client service which fixed the problem. So far
> so
> good :)
>>


I'm sorry it was over your head. I was providing the technical info of what
may be going on. If disabling the DNS client service works, then it is
telling me one of the following is going on:

1. The DNS server being used by your machine may not have had the DNS
vulnerability exploit patch applied,
2. You may have malware/spyware installed that is affecting your machine's
resolver and local host cache.

Run an antispyware scan, as well as download and run Malwarebytes utility
(www.malwarebytes.com). It's free. It catches some things that other spyware
scanners may not find, but it is good to run more than one scan from
different companies to get a better idea of what may be installed on your
machine.

Ace

> I'm sorry it was over your head. I was providing the technical info of what
> may be going on. If disabling the DNS client service works, then it is
> telling me one of the following is going on:
>
> 1. The DNS server being used by your machine may not have had the DNS
> vulnerability exploit patch applied,
> 2. You may have malware/spyware installed that is affecting your machine's
> resolver and local host cache.
>
> Run an antispyware scan, as well as download and run Malwarebytes utility
> (www.malwarebytes.com). It's free. It catches some things that other spyware
> scanners may not find, but it is good to run more than one scan from
> different companies to get a better idea of what may be installed on your
> machine.
>
> Ace
>
>

Ace,

I ran antispyware and thge malwarebytes and no issues were found. I do not
know how to determine if this computer has had the DNS vulnerability exploit
patch applied, but it is my understanding that since I am operating XP that
it should have been included already. What I have noticed is that my
computer will run fine and then after I am on the web for awhile, it starts
to have trouble finding the server again. I didn't start having any trouble
like this until I upgraded to Firefox 3.5, prior to that my computer never
had trouble finding the server. It doesn't matter what web browser I use I
have this problem. I am about to go and buy a new computer and forget about
it, the only thing that is stopping me is that it seems like such a daunting
task to get all of my programs and documents switched to the other computer.

"SupermanGolfer" <SupermanGolfer@discussions.microsoft.com> wrote in message
news:50657097-758A-4432-B7E6-AC24823BAEE2@microsoft.com...
>
>
>> I'm sorry it was over your head. I was providing the technical info of
>> what
>> may be going on. If disabling the DNS client service works, then it is
>> telling me one of the following is going on:
>>
>> 1. The DNS server being used by your machine may not have had the DNS
>> vulnerability exploit patch applied,
>> 2. You may have malware/spyware installed that is affecting your
>> machine's
>> resolver and local host cache.
>>
>> Run an antispyware scan, as well as download and run Malwarebytes utility
>> (www.malwarebytes.com). It's free. It catches some things that other
>> spyware
>> scanners may not find, but it is good to run more than one scan from
>> different companies to get a better idea of what may be installed on your
>> machine.
>>
>> Ace
>>
>>
>
> Ace,
>
> I ran antispyware and thge malwarebytes and no issues were found.

Then you may have a RootKit installed, that is if Firefox is truly not the
culprit.

RootkitRevealerRootkitRevealer is an advanced rootkit detection utility. It
runs on Windows NT 4 and higher and its output lists Registry and file
system API discrepancies ...
http://technet.microsoft.com/en-us/s.../bb897445.aspx

Sysinternals Security UtilitiesRootkitRevealer. Scan your system for
rootkit-based malware. SDelete. Securely overwrite your sensitive files and
cleanse your free space of previously ...
http://technet.microsoft.com/en-us/s.../bb795534.aspx

> I do not
> know how to determine if this computer has had the DNS vulnerability
> exploit
> patch applied, but it is my understanding that since I am operating XP
> that
> it should have been included already.

Actually I was referring to the DNS server that your machine isusing. That
is the DNS address in your NIC properties. If set to DHCP (automatically get
an IP), to find out what DNS server(s) your machine is using, you would have
to run an ipconfig /all. To do that, click on Start, then click on RUN, then
type in:

cmd

Then in the black screen, type in:

ipconfig /all

Then look at the DNS addresses listed. This is what I am talking about, and
if they have the exploit patch applied or not, is anyone's guess. That is up
to the administrator administering the DNS server (whether it be an ISP or
your company DNS servers). It has nothing to do with the XP machine itself.

I apologize if this is technically over your head. But that's just part of
technically determining issues, as I've posted in my original post.

> What I have noticed is that my
> computer will run fine and then after I am on the web for awhile, it
> starts
> to have trouble finding the server again. I didn't start having any
> trouble
> like this until I upgraded to Firefox 3.5, prior to that my computer never
> had trouble finding the server. It doesn't matter what web browser I use
> I
> have this problem.

Then I would concentrate on posting to a Firefox forum, or call Firefox
themselves and ask them. It apparently all points to Firefox. I don't use
Firefox and have found that IE does the job nicely all of these years,
especially with ActiveX and connecting to Windows services in a company or
from outside on the internet to company (corporate) resources when specific
type of authentication is required, that Firefox cannot handle.

> I am about to go and buy a new computer and forget about
> it, the only thing that is stopping me is that it seems like such a
> daunting
> task to get all of my programs and documents switched to the other
> computer.

I think if you have an infected tooth root, you would go to the dentist and
get a root canal saving the tooth, instead of pulling and removing the tooth
completely leaving an emtpy spot in your teeth.

So you are discarding your machine because of what Firefox did, or possibly
an infection that can be fixed?

Ace