Windows 10: Identify app/program causing 1014 DNS Warnings

Hi...I need some guidance on how to track down the app/program throwing 1014 DNS warnings. Every day or two, I get a 1014 for "instagram[dot]com". I do not have the app, I do not visit the site (that I know of, but it is possible when seeing a newsfeed video, etc.) I want to know what app/program is incessantly querying www[dot]instagram[dot]com and getting timed out; this have been occurring since March 2020. I do not want to resolve the DNS query, which all the posts I've been able to find so far only talk about; I want to find the caller.

I tried using Process Monitor, but just this morning as I was actively & solely monitoring ProcMon, and the 1014 hit however I never saw it hit on the ProcMon list. Maybe I'm using ProcMon wrong, but instructions on its use vary widely and mostly vaguely.

Would SysMon be better? As for Wireshark, its hard to use but I will if I have to.

I have tried to be exhaustive in running down extensions, etc., but I have very few -- I run a very minimalist machine. I use the Vivaldi Browser, which I strongly suspect, but I just can't seem to catch it making the query. The only Vivaldi extension I use is Ghostery. And in a two week long experiment, I did not use Vivaldi, and had no 1014s. But within 30 minutes of firing it back up, bang, a 1014 hit. Every instagram 1014 occurs when Vivaldi is running. I asked Vivaldi and they denied querying instagram and told me flush the DNS, etc. I hope Vivaldi isn't covertly doing this, but...

I will find the app/program calling instagram and will spend the rest of my life searching for it -- I'm on a holy mission now.

Many thanks...
PC Desktop Windows 10 Pro 1909 ver. 18363.1016

:)

 

Event ID 1014

Event ID 1014 does not interrupt your Wi-Fi connection. It is telling you your internet connection has timed out!

Typical abridged Event Viewer report follows:

Log Name: System

Source: Microsoft-Windows-DNS-Client

Date: 20/08/2015 17:34:22

Event ID: 1014

Level: Warning

Description:

Name resolution for the name ssw.live.com timed out after none of the configured DNS servers responded.

The red text varies according to the web site you have tried to connect to.

Fix network connection issues:

http://windows.microsoft.com/en-gb/windows-10/fix-network-connection-issues

 

DNS server causing problem

Hi Andrea,

DNS is a server that translates websites' addresses so that browsers can connect to them. If the addresses become outdated or the server has issues, problems and DNS errors occur. For us to provide an accurate solution, we would need you to answer the following
questions:

• Which build, version and edition of Windows is installed on your computer?
• What changes have you made to your device before this issue occurred?
• Are you experiencing the same issue regardless if you are trying to be connected to a wired or wireless connection?

For initial troubleshooting, we suggest deleting the DNS cache. This can refresh the DNS files and settings on your PC. Follow these steps to delete the DNS cache:

• Using Search type Command Prompt.
• Form the search results, right click on Command Prompt (Desktop app) and then choose Run as administrator.
• In the Command Prompt window, type ipconfig /flushdns and then hit the Enter key.
• Once done, restart your computer and then check if the same issue persists.

We are looking forward to your response.

 

Event ID 1014 continual warning messages

Log Name: System

Source: Microsoft-Windows-DNS-Client

Date: 19-Jul-20 3:26:35 PM

Event ID: 1014

Task Category: (1014)

Level: Warning

Keywords: (268435456)

User: NETWORK SERVICE

Computer: TECLAST

Description:

Name resolution for the name BRW94533072E66A timed out after none of the configured DNS servers responded.

Event Xml:

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">

<System>

<Provider Name="Microsoft-Windows-DNS-Client" Guid="{1c95126e-7eea-49a9-a3fe-a378b03ddb4d}" />

<EventID>1014</EventID>

<Version>0</Version>

<Level>3</Level>

<Task>1014</Task>

<Opcode>0</Opcode>

<Keywords>0x4000000010000000</Keywords>

<TimeCreated SystemTime="2020-07-19T05:26:35.3599387Z" />

<EventRecordID>6765</EventRecordID>

<Correlation />

<Execution ProcessID="4472" ThreadID="5232" />

<Channel>System</Channel>

<Computer>TECLAST</Computer>

<Security UserID="S-1-5-20" />

</System>

<EventData>

<Data Name="QueryName">BRW94533072E66A</Data>

<Data Name="AddressLength">128</Data>

<Data Name="Address">02000000D1DE12DE000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000</Data>

</EventData>

</Event>