Windows 7 x64 and Wireless DNS issues
I have a user with Win 7 Enterprise x64 on his D830 laptop. Suddenly, his wireless stopped working. It will connect to the network fine, and DHCP provides IP, DNS, etc. He cannot browse anywhere though. If you connect via IP address it works, but no DNS resolution is occurring. This happens on our company networks and his personal network at home. Wired connection works just fine. Only the wireless has this issue. We have updated all drivers, swapped the mini-PCI wireless card for a known good one, disabled IPv6, deleted all profiles and recreated...nothing. Ping by IP...works...ping by DNS name...cannot resolve. Tried Firefox and IE for browsing, same issue. Nothing in the network adapter properties shows any different to a fully functional D830 with Win7 x64 next to it. Any ideas? Thanks Ross
March 5th, 2010 12:18pm

Two things I would initially check. Is the DNS Client service actually running on the PC? And, are there any errors in the Event Viewer?
Free Windows Admin Tool Kit Click here and download it now
March 5th, 2010 3:46pm

I'll have to look again in the Event Viewer when he gets into the office today, but the DNS client works for the wired connection just fine. You can connect to the wireless system and be unable to browse, plug an ethernet cable in and off you go. I might be mistaken, but I don't believe each connection has its own instance of the DNS client. Ross
March 8th, 2010 10:03am

That is often the symptom of a malware infection.Kerry Brown MS-MVP - Windows Desktop Experience
Free Windows Admin Tool Kit Click here and download it now
March 8th, 2010 10:30am

I suggest you check the wireless adapter settings first. Make sure that DNS server is obtained automatically. If the issue still occurs, temporary disable the antivirus and firewall, then check the result. If the above suggestions do not help, try to download the latest wireless driver from manufacturer’s website and install it.Arthur Xie - MSFT
March 9th, 2010 3:48am

All wireless adapter settings match a fully functional device. DNS server addresses are provided by DHCP as normal, and you can ping them. Firewall is off by default. Anti-virus being disabled made no difference. We have the latest drivers for the Dell 1390 wireless card installed also. The machine exhibits no other behaviors of malware, and scans clean with Malwarebytes Anit-Malware and Sophos AV. This is why we thought it might be hardware failure at first. We checked the antenna connections and they were tight, so we swapped the 1390 card from another D830 that we know was working. Same issue persisted. If DNS was totally hosed, it wouldn't work for the wired connection. It's odd that it only affects the wireless, and only DNS. Again, you can load a webpage by IP address, you just cannot resolve any of the links on that page. Disconnect from the wireless and plug in ethernet, and off you go. Ross
Free Windows Admin Tool Kit Click here and download it now
March 9th, 2010 8:46am

Is the wired connection still connected when you test the wireless connection issue? If so, are they connected to a same network device? You may check the router firewall settings if it exists. Please temporary disable it and see if the issue persists.Arthur Xie - MSFT
March 10th, 2010 1:00am

We disconnect from the wired connection. Not a router issue as this is a corporate network...Cisco ASA 5520 firewalls and Aruba 3000 wireless system. Wired connection is to a Cisco 3560 linked to a Cisco 4948 before the firewalls. It works fine for almost 300 other users in the office, so it is machine specific. The firewall on the laptop is disabled by group policies on the domain also. We have three different wireless networks on the Aruba system each using different VLANs for different layers of access and this unit will not work on any of the three. Also, the security method is different on each wireless network. One uses PEAP and RSA token, one uses WPA2 Enterprise linked to their domain SSO, and the last uses a PSK generated by the Aruba system for time-based guest access. Not sure what his setup at home is, but it does the same. Wired works, wireless doesn't. I've pretty much tried all the suggestions prior and no luck. Just trying to avoid rekicking the system and migrating a lot of data, plus installation of apps that are not part of the standard image. Thanks Ross
Free Windows Admin Tool Kit Click here and download it now
March 10th, 2010 8:33am

I'll point out again that this is a common symptom of a malware infection - DNS hijacking. It's possible that only the network interface in use while the infection occurs is affected.Scanning the computer from Windows can be a waste of time. Neither Sophos nor MalwareBytes will detect some root kits if the root kit is active. The only way to be sure it's not malware related is to scan from a Linux CD or remove the hard drive and scan it with another computer. Some of the current root kits cannot be scanned from Windows even with supposed "root kit" scanners. As the laptop has been used outside of your cororate network malware is a possibility. I'd scan the hard drive from another computer just to be sure then I'd nuke the machine and start again just in case.Kerry Brown MS-MVP - Windows Desktop Experience
March 10th, 2010 1:12pm

I have the exact same setup -- Win7 x64 Enterprise running on a D830 -- and I'm having the exact same problem. Wired connection is fine, but wireless cannot resolve host names. Can ping by IP but not by hostname. One other problem I've had that may be related is the inability to install anything now. Windows Installer service bombs whenever I try to install using MSI. It might be a root-kit as suggested by Kerry -- I will check that when I get back from my current road trip... John H UPDATE: No rootkits found and the problem seems to be the MS virtual adapter as noted below by Thomas Walters...
Free Windows Admin Tool Kit Click here and download it now
March 12th, 2010 6:55pm

The user has been traveling and is supposed to be back int he office this week. I'll get a disc to scan with from one of the lead techs on our Linux teams. I've seen DNS hijacking here before and it never left one interface alone while the other stayed functional. And it exhibits no other behaviors of malware either. It is not doing anything very sneaky on the network because the IDS hasn't reported it...and this thing reports some legit stuff as suspicious if it crosses a certain threshold. I'll scan the disk as soon as an opportunity presents itself and report the findings back. Ross
March 15th, 2010 10:14am

I'll add a third instance of this problem. Dell E4300 working fine until this week. All of a sudden, no DNS on the wireless. To repeat what others have said, just so there are no misunderstandings: DNS lookups fail, can connect via browser to Google using IP address. I can ping my local DNS server and my ISP's DNS server. Manually configuring DNS servers and DHCP assigned servers have same results. Wired ALWAYS works, wireless never works. Tried multiple wireless connections from multiple organizations with different ISPs - same results. Now, this is where things get weird. I have a Windows 2008 R2 vhd on my machine so I boot to it this morning - the wireless works. Go back to my Windows 7 boot, no DNS on wireless. Out to the Dell site to download latest drivers and BIOS updates. Loaded all those (as administrator). Still no DNS over wireless. Now I load up wireshark - when capturing from the wired interface I can see my DNS request going to the dns server and it responding. When capturing the wireless interface, no request leaves on that interface. I can see ping requests and replies, I can see NetBIOS name queries, but no DNS request ever goes out on that interface. NSLookup says it's trying four times, but captures don't lie - it's like the DNS protocol has become unbound from the stack. I verify the DNS client is running. Error logs show warnings when I do NSLookups on wireless interface - 'name resolution for the name www.microsoft.com timed out after none of the configured DNS servers responded.' (Event ID 1014 generated by the DNS Client.) DNS hijacking points you to a rogue DNS server, it doesn't block DNS requests on an interface - however, I will be scanning my drive today per Kerry's advice. I will post results. One other thing - probably just coincidence, but the day this behavior started I awoke to the "Your computer was updated" bubble in the lower right corner. If anyone has other ideas for testing, I'm open to suggestions - I travel a lot and wireless is a must. Tom
Free Windows Admin Tool Kit Click here and download it now
April 2nd, 2010 12:47pm

I found the cause of the problem, at least in my case. The Microsoft Virtual WiFI MiniPort Adapter uses the same MAC address as my hardware wireless adapter. I use the Shrew Soft VPN client (64-bit support for Windows 7) and found, after a couple of hours of testing, that if I turned off the Shrew DNS proxy daemon service, my wireless adapter went back to using DNS. After some searching on the Internet about the miniport adapter, I could see that there are a lot of symptoms associated with this adapter. In my case, disabling the miniport adapter returned my machine to normal operation. The funny thing is I run ipconfig a lot in my job, and I just don't remember seeing that adapter in my list before this week. I hope this post saves others the 8 hours of frustration I experienced today. Tom
April 2nd, 2010 3:32pm

I found the cause of the problem, at least in my case. The Microsoft Virtual WiFI MiniPort Adapter uses the same MAC address as my hardware wireless adapter. I use the Shrew Soft VPN client (64-bit support for Windows 7) and found, after a couple of hours of testing, that if I turned off the Shrew DNS proxy daemon service, my wireless adapter went back to using DNS normally. After some searching on the Internet about the miniport adapter, I could see that there are a lot of symptoms associated with this adapter. In my case, disabling the miniport adapter returned my machine to normal operation. The funny thing is I run ipconfig a lot in my job, and I just don't remember seeing that adapter in my list before this week. BTW - I did run rootkit and malware scan, both reported my machine was clean as a whistle. I hope this post saves others the 8 hours of frustration I experienced today. Tom
Free Windows Admin Tool Kit Click here and download it now
April 2nd, 2010 3:34pm

My co-worker and I experienced this same exact problem within a week of installing the Shew Soft VPN client on our Dell laptops with Dell 1397 wireless adapters. Unfortunately, I can't test your solution because we were able to resolve the problem in our own ways... My co-worker indicates he resolved the problem by uninstalling the adapter's drivers and installing the latest drivers from Dell. His solution didn't work for me, and I ended up wiping my laptop about a week ago. Now I'm wishing I captured an image before reinstalling so I could see if I had the Microsoft Virtual WiFi MiniPort Adapter installed. Very interesting coincidence. I wouldn't be surprised if Ross's road warrior was also using the Shew Soft VPN client.
April 4th, 2010 6:32pm

I have the same problems on three dell notebooks (vostro 1720) running windows 7 64 bit and the all have the shrew soft vpn client. This is definitly not a rootkit they are clean installed machines. The wired connections are working and the wireless don't do dns. I will try your solution tommorow.
Free Windows Admin Tool Kit Click here and download it now
April 6th, 2010 10:33am

This post did indeed save me a lot of time as the Shrewsoft VPN DNS daemon was the culprit. However, it appears that Shrew Soft has corrected the issue in version 2.1.6-beta7 which can be downloaded from http://www.shrew.net/download/vpn as I now have both the DNS daemon started and my wireless functioning correctly.
April 6th, 2010 5:35pm

Looks like the root kit idea was a red herring. Hopefully a moderator will change the answer. Kerry Brown MS-MVP - Windows Desktop Experience
Free Windows Admin Tool Kit Click here and download it now
April 6th, 2010 8:48pm

THANK YOU! THANK YOU! THANK YOU! Disabling the MS virtual adapter appears to have worked. FWIW, installing the beta noted by Northice below did not help...
April 13th, 2010 8:23pm

I downloaded the beta Northice recommended as well. It did not work for me either. Tom
Free Windows Admin Tool Kit Click here and download it now
April 14th, 2010 5:57pm

Disabling the Microsoft Virtual WiFi Miniport adapter worked for me as well. I don't typically like working with BETA software so I'll wait for Shrew VPN to resolve this in their latest release. I'm running 2.1.5 of Shrewsoft VPN client.
April 17th, 2010 2:53pm

Disabling the Microsoft Virtual WiFi Miniport adapter worked for me as well. I don't typically like working with BETA software so I'll wait for Shrew VPN to resolve this in their latest release. I'm running 2.1.5 of Shrewsoft VPN client.
Free Windows Admin Tool Kit Click here and download it now
April 17th, 2010 2:53pm

I tried disabling the Microsoft Virtual WiFi Miniport adapter but this did not fix the problem. I have the Shrewsoft VPN client installed and found that the Shrewsoft Lightweight Filter had been applied to the Wireless Network Connection. Unticking this fixed the problem.
May 5th, 2010 9:30pm

The lightweight filter was my issue as well. Thanks everyone for help with this one. I saw this problem right after running some windows updates. Not sure what triggered it for others.
Free Windows Admin Tool Kit Click here and download it now
May 17th, 2010 8:21am

This problem just cropped up on my Win 7 x64 Dell D630, and I was happy to find this thread. Upgrading to ShrewSoft 2.1.7 solved the problem for me.
February 23rd, 2011 8:21pm

And if i've nuked it; and i still have DNS problems..?
Free Windows Admin Tool Kit Click here and download it now
October 11th, 2011 3:47pm

If by "it", you mean the ShrewSoft client, and by "nuked", you mean you uninstalled the ShrewSoft client from Control Panel, are you saying you are still having problems with only your wireless adapter and that adapter only has problems with DNS name resolution? Does the Shrew DNS Proxy daemon service still exist? Yes? Then disable that service and see if DNS works. If the service no longer exists, then verify the bits have been removed from the drive under the Program Files folder. Clean your registry with a utility like CCleaner, which can be found here: http://www.piriform.com/ccleaner/download There is a free version and it does a good job. Of course, all the caveats apply to modifying the registry. Make sure you backup the registry before running CCleaner, create a system restore point, etc. Good luck
October 13th, 2011 5:59am

Thanks a lot.. I had same issue and tried whole day to resolve. But http://www.shrew.net/download/vpn help. Now wireless working fine.. Thanks
Free Windows Admin Tool Kit Click here and download it now
November 8th, 2011 7:40pm

I have intermittent same issue, but I have no Shrew junk to obfuscate the DNS. In my situation, simply disconnecting the connection and reconnecting resolves the problem, but it is definitely an unnecessary hassle. Oh, and the Dell hardware here too; that is the common denominator here (Dell 1397 on a Studio 15 laptop). Oh, and before I forget: Nice job for a Microsoft representative to suggest using a 'nix disk as part of a resolution, although incorrect assumption that a rootkit would be at the bottom of the issue. In my opinion, Microsoft should be in direct cooperation with Dell, as well as all other major OEMs prior to OS releases, to further mitigate issues like this; now, and in the future. -Dusty
December 6th, 2011 1:25pm

assuming a problem like this is a malware infection when he clearly states that it is working fine on a wired connection shows me that you have no right to be a vp of anything. i bet the win 7 x64 safe mode boot loop is a root kit or malware too huh? malware hits hard and dirty, yet effectively in 99.9% of cases. if it is a network variety it likely will completely disable outgoing and incoming communication on the services level and in the browser itself. never in over 25 years of working on computers have i ever seen malware do anything near even close to disable your dns on wifi only and ignore the other adapters. ross - get a usb wifi adapter and attempt to connect with that to see if your problems go away.... this will remove the malware solution that the micro geniouses are giving for answers.. if the problem still persists then your vpn software is the issue at hand. ok so i read the rest of the comments, and the wifi adapter for vpn was it heh... this reenforces my point - dont just blame malware because you dont want to acknowledge that windows isnt working the way it should. now for a possible fix without removing the wifi adapter.... set the network metric for that adapter and all others on the system manually. ensure that the metric for that is higher than the wifi adapter that you are using to connect to the internet with.
Free Windows Admin Tool Kit Click here and download it now
July 13th, 2012 9:45am

I see this problem on occassion. It is a rootkit virus. I read much of the responses below, and while there is criticsm, it is important to note, if you have a fresh install, and the other fixes work, great, if not, be aware, the root kit will do the same thing as Ross poses. Kerry's suggestion holds alot of merit. William R. Johnson
July 17th, 2012 10:09pm

Hi All Root kits, fragments of uninstalled endpoint services such as McAfee too, but if it works on LAN then - highly likely wrong direction chaps. I've had this with Windows 7 on HP 4530 laptops bought 2012, I've been using Shrewsoft client for about 4 years for 20 users, connection to a Juniper SSG5, with generally excellent reliability. It's usually Windows (quelle surprise) that screws things up. Even if you do get the miniport adaptor to stay away after windows updates it comes back anyway and disabling it causes misreporting by e.g. HP Connection Manager. What worked for me was removing the Shrewsoft Protocol filter driver from the miniport 'adaptor' All the best to you all Adam
Free Windows Admin Tool Kit Click here and download it now
August 22nd, 2012 6:19am

This topic is archived. No further replies will be accepted.

Other recent topics Other recent topics