OK, maybe “evil feature” is a little too strong, but this one sent me down a rabbit hole that was far deeper and far darker than I like. In fact, I can provide a useful title like “Netgear WG511v2 Driver…” only because I have finally emerged from the darkness. Come with me on a little journey, though, and you can see how I arrived at the “evil feature” conclusion.
First off, let me set the stage for you: I use a wonderful (free!) service called OpenDNS (and you should, too). It’s a public DNS server that handles the process of converting friendly names like http://eal.us into the IP addresses that computers actually use when they want to transfer data back and forth. OpenDNS is wonderful because it’s very stable, it’s very fast, and it provides some cool features like fixing typos and protecting against phishing websites. I could go on and on about why OpenDNS is cool (which is surprising because DNS is decidedly UN-sexy and utilitarian), but that’s not really the point.
One of the neat features that OpenDNS has is a way to view statistics and see how many DNS queries are being generated from your network. In this case, my home network, which consists of three computers most of the time: my wife’s desktop, my desktop, and my laptop.
About three weeks ago, I got a wild hair and decided to poke around in the OpenDNS stats, and what I saw alarmed me. There was a HUGE volume of MX-record queries coming from our network. Now, MX records are “Mail eXchanger” records — it’s a way of determining which mail server is responsible for handling mail for a given domain name. Since none of the computers on my little home network runs a mail server, there should be virtually ZERO requests to resolve MX records through DNS, and yet there it was plain as day: THOUSANDS of MX record queries every day. I started to get worried that one of our computers had a virus or worm installed and was trying to send out email.
I spent days switching settings on first one, then another computer. Because my wife had been complaining that her computer was running really slowly, and it certainly was consuming a lot of memory, hers was the natural suspect. I disabled services. I ran scans. I ran more scans. Everything came back clean. And no matter what I did, OpenDNS’s stats told the same story: thousands of queries a day.
Then I shut down my laptop overnight one night.
Miraculously, the queries dropped to almost nothing. AHA! My laptop must be infected somehow. So I changed settings. I disabled services. I ran scans. I downloaded new scanners and ran more scans. Everything came back clean. So I got serious and did a HijackThis scan. Clean. What was I missing?! I consider myself an expert in this stuff. Why couldn’t I locate a single rouge virus??
Finally, I made a very difficult decision to wipe out my laptop and start over from scratch. I carefully backed up everything on the hard drive and formatted the drive…with extreme prejudice. Nothing survived. I installed the operating system cleanly (and, in the process, discovered that a fresh install of Windows Vista Business consumes 384MB of RAM immediately after installation, whereas a clean install of Windows XP Pro with nothing more than XP Service Pack 2 uses all of 102MB of RAM…but that’s another gripe entirely). I installed all service packs and security patches. I carefully installed only the newest and most up to date versions of every program I use. I carefully monitored memory utilization and what processes were running.
And then I checked OpenDNS’s stats page. There was a period of downtime while my laptop was at the office where I was doing the install, but beginning the night I fired it up at home to install all of my work-related programs (Visual Studio, Office, Expression, BlogJet, UltraEdit, and so on) OpenDNS told the story. Thousands of DNS queries again.
Impossible! I was certain that I had a virus or trojan that had actually survived a complete reformat and reinstall of the operating system. I’d never heard of such a thing!
And so tonight I got serious about tracking it down. I did Google queries to see what viruses produce large volumes of MX record queries in DNS. I hunted for any posting about viruses or trojans that survive a reinstall of the OS. I was willing to read any conspiratorial post on any whacked out message board I could find. And I found almost nothing that explained my situation.
In desperation, I downloaded a small DNS server called Posadis that will run on Windows XP. All I wanted to do was to try and log how often the queries were coming in, and perhaps what port they originated on so that I could track down the responsible process.
It took about 2 minutes to track it down. Every 5 seconds or so three queries for MX records (for www.google.com, www.intel.com, and www.microsoft.com) would pop up. Curiously, these were completely useless queries…there likely isn’t an MX record for any of those fully-qualified domain names. Hmm. Curiouser and curiouser.
Fortunately, Posadis revealed the port number where the queries were originating. A quick “netstat -ano” revealed the process ID (or PID) that was binding to that port number. Fire up Task Manager and – BANG! – I’ve got the culprit: WG511v2.exe!
It took another 30 seconds to figure out what was going on. Netgear’s drivers for my wireless card (a Netgear WG511v2, by the way) have a retarded feature called “Internet Connected Notification”. It’s nothing more than a little bell that rings when the driver detects that you’re connected to the Internet (and, presumably, something else that whines if you’re not). Wanna guess how it knows you’re connected to the internet? You guessed it! Thousands of DNS queries every day.
But here’s the kicker: Even if you disable the stupid “Internet Connected Notification,” it appears that the driver will continue to do the DNS queries.
So that’s where it stands right now. I know the queries are (relatively) innocuous and not the rabid virus that I thought they were, but honestly, why is it necessary to fire off DNS queries every few seconds, and why the heck can’t I disable it? I’m really not so stupid that I can’t figure out when my internet connection is down, and I’d prefer not to be an abuser of the resources that OpenDNS has so benificently made available to me.
I’ll keep digging to see if I can figure out how to neuter this annoying feature, and will post here if I figure it out. I suspect many others have stumbled AROUND this problem without pinpointing it…at least based on some of the posts I’ve found in various troubleshooting forums.
Do you see now why people think I’m such a geek??