Please help with DNS problem

Hi

I was surfing ok and all of a sudden I couldn't surf anymore.
When I ping ip address (CMD) it bring back results and I can surf using IE & FF with just ip address so the connection is there but I suspect this may be a DNS problem.
My PC has W2K which is connected to netgear router and I am posting this from my laptop using the same router so the problem is somewhere within my PC. I did manually assign opensource dns address in the LAN connection/properties but still nothing. The firewall I'm using is Outpost and I see that I'm getting some attacks (port scanning and connection requests) so I really don't want to switch it off to test it.

I did virus and malware check and nothing came up.
I switched off router, rebooted PC but nothing.
I also tried the following too:-

netsh
interface reset all
routing reset all
routing
dump
bye
exit

One thing I've noticed is that when I do ipconfig /all, IP routing keeps changing from No to Yes which I'm confused why it does that.

Could someone suggest a solution please?

Edited by resetme (Sat 07-Nov-09 22:57:29)

From the command prompt, try:

ipconfig /flushdns

If that doesn't solve the problem, it might be your ISP's DNS servers.. I'm with Be and recently changed to use the OpenDNS servers as Be's keep going down..

I am a bit puzzled - you are behind a router, yet getting messages from the firewall that there is port scanning going on - this would mean either your router wasn't using NAT (network address translation - usually ip adresses are something like 192.168.1.xxx ) and thus PCs appear directly connected to the net (can happen if using IPv6, but don't think Win2K can us v6), the router has been compromised either from internet or via wireless, another PC on network has been compromised or the firewall is confused and treating entries as

My first thoughts would be firewall - Do any of the port scan messages appear to be coming from port 53 at remote host?

Hi,

Thanks for your reply.
I have done ipconfig /flushdns a number of times and it made no difference.

My ip address is set to 192.168.xxx.xxx and this has been checked by my isp support so it is correct. I am also using opensource dns.

Ports that have been scanned were 455, 8080, 80,161,139 etc and I read somewhere that 455 is favourite of hackers apparently. Connection request to 192.168.0.2 UDP(137) (80) (161) (8080) (139). 192.168.0.1 and 192.168.0.70 is set on my system.

So do you think it's my Outpost firewall rather than my router firewall?
But when I use CMD and do "ping google.com" the result comes back as "unknown host" so is that still firewall?

Edited by resetme (Sun 08-Nov-09 12:56:37)

Thanks guys.

I checked Outpost firewall setting and services.exe activity was somehow blocked so I enabled it and I can surf using URL now

I am hoping it's safe.

ports 137 - 139 & 445 are to do with Windows talking to other Windows instances (SMB), port 80 is webserver, port 8080 is often used as a web server, 161 is a management port on remotely managed equipment - viruses/hack attempts often tries these ports for known vulnerabilities or weak passwords

Because the IP address in 192.168,x.x it sounds like the router is configured for NAT - which makes it harder (if not impossible) to port scan an internal computer - and if it has the proper firewall rules, it shouldn't allow any incoming on WAN port (internet) that appear to be internal addresses. There should be two addresses for the log entries - one for your machine and one for the remote machine - sometimes it is confusing which is which (some of the Windows port entries might even be your laptop trying to talk to it) - and others may be triggered by router as it restarts

does your laptop use opendns as well? if so then it is most likely the software firewall on the win2k box is blocking the dns requests packets - which will give the error message unknown host

From a quick google there seems to be some Outpost DNS plugin/options - might be worth looking on their support site