[Solved] Strange internet problem

[mattpi]

Hi all Recently I have been afflicted by a rather strange and incredibly annoying problem with my internet connection. I am unable to connect to certain websites, with any browser, on any computer on my home network. I am able to access them only via a proxy. However, when I have tried to remedy the problem by resetting the router, I can usually access the problem sites, only for other sites to become unavailable. I have tried two different routers, with no change in this behaviour between the two. I have repeatedly flushed the DNS cache - indeed I do not think that this is a problem with DNS resolution, as I have tried both the automatic DNS servers from my ISP, and OpenDNS, and DNS lookups appear to be working normally with both; when I do a DNS lookup for a problem site and plug the IP address itself into the address bar, I can access the site on the proxy, but not without. Does anyone have any ideas as to what is going wrong?

[KenB]

Hi and welcome to ExTS

 

Check the Hosts file.

C:\ > Windows > System32 > Drivers > etc

Right click on the Hosts file > Open

Open with Notebook.

 

Are any of the sites affected listed here?

 

Download MBAM from here:

http://www.malwarebytes.org/

Click on Products .....you want the free version.

 

Install - Update - Run

It will produce a log.

Post this here please.

[mattpi]

Nothing in hosts seems relevant.

 

Here is the log from a quick scan using MBAM:

 

Malwarebytes' Anti-Malware 1.51.2.1300
www.malwarebytes.org

Database version: 8065

Windows 6.1.7601 Service Pack 1
Internet Explorer 8.0.7601.17514

02/11/2011 01:05:15
mbam-log-2011-11-02 (01-05-15).txt

Scan type: Quick scan
Objects scanned: 178053
Time elapsed: 3 minute(s), 51 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 1

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
c:\Users\Matt\AppData\Local\Temp\CSMECA0.tmp (Adware.RelevantKnowledge) -> Quarantined and deleted successfully.

[KenB]

Hi,

 

The MBAM log only showed up 1 infection - which has been dealt with.

 

When you cannot connect to a site - are the other computers on the network affected in the same way?

In other words - one cannot connect - so all cannot connect.

 

Try this for me:

When you have a site that you cannot connect to ......

 

Start > type in .....cmd ......(do not hit ENTER yet )

right click on the cmd that shows top left of screen. > Run as Administrator

 

At the prompt type:

tracert http://www.google.co.uk ( substitute your problem site for google shown here )

(there is a space after tracert)

 

The first hop should be something like

1 3 ms 3 ms 3 ms 192.168.1.1

 

If you want to copy the tracert results:

There is a small black icon top left ......right click > Edit > Select All

Then right click on the icon again > Edit > Copy

CTRL + V will paste it here.

[mattpi]

Here you go:

Tracing route to mymathforum.com [50.22.14.115]
over a maximum of 30 hops:

 1     2 ms     2 ms     4 ms  192.168.0.1
 2    31 ms    31 ms    33 ms  217.32.96.250
 3    31 ms    30 ms    33 ms  213.123.110.193
 4    30 ms    30 ms    30 ms  217.41.167.10
 5    31 ms    29 ms    30 ms  217.47.19.50
 6    31 ms    30 ms    30 ms  core1-pos4-1.sheffield.ukcore.bt.net [217.32.171
.181]
 7    38 ms    39 ms    40 ms  core1-pos0-14-5-0.ealing.ukcore.bt.net [62.172.1
03.109]
 8    35 ms    34 ms    34 ms  transit1-xe11-0-0.ealing.ukcore.bt.net [62.6.200
.110]
 9    37 ms    37 ms    38 ms  t2c3-xe-10-1-0.uk-eal.eu.bt.net [166.49.168.5]
10    38 ms    37 ms    37 ms  t2c1-ge13-0-0.uk-eal.eu.bt.net [166.49.237.25]
11   112 ms   111 ms   111 ms  t2c1-p4-0-0.us-ash.eu.bt.net [166.49.164.225]
12     *        *        *     Request timed out.
13     *        *        *     Request timed out.
14   146 ms   163 ms   146 ms  ae13.bbr02.eq01.dal03.networklayer.com [173.192.
18.134]
15   144 ms   145 ms   152 ms  ae5.dar02.sr01.dal05.networklayer.com [173.192.1
8.217]
16   156 ms   162 ms   184 ms  po2.fcr01.sr01.dal05.networklayer.com [173.192.1
18.133]
17     *        *        *     Request timed out.
18     *        *        *     Request timed out.
19     *        *        *     Request timed out.
20     *        *        *     Request timed out.
21     *        *        *     Request timed out.
22     *        *        *     Request timed out.
23     *        *        *     Request timed out.
24     *        *        *     Request timed out.
25     *        *        *     Request timed out.
26     *        *        *     Request timed out.
27     *        *        *     Request timed out.
28     *        *        *     Request timed out.
29     *        *        *     Request timed out.
30     *        *        *     Request timed out.

Trace complete.

[KenB]

Hi,

 

The problem does not seem to lie with your system or your router.

 

I have just run a tracert to the mymathforum and mine completed.

 

14 177 ms 162 ms 175 ms po1.fcr01.sr01.dal05.networklayer.com [173.192.1

18.131]

15 159 ms 158 ms 160 ms jincheng.asmallorange.com [50.22.14.115]

 

 

Trace complete.

Your trace is failing at the last hop.

my #14 IP Address 173.192.18.131 is the same as your #16 ( ignoring the last number [133 in your case] )

 

Try tracert 50.22.14.115 ( this is the IP address of the problem site )

 

===================

 

Go back to the DOS prompt ( cmd ) and type:

ping http://www.mymathforum.com ( space after ping )

 

Do you get 4 packets sent and received ?

[mattpi]

Thanks for the reply - here is the output.

Tracing route to jincheng.asmallorange.com [50.22.14.115]
over a maximum of 30 hops:

 1     2 ms     2 ms     2 ms  192.168.0.1
 2    42 ms    31 ms    30 ms  217.32.96.250
 3    30 ms    31 ms    30 ms  213.123.110.193
 4    30 ms    31 ms    30 ms  217.41.167.10
 5   100 ms    31 ms    30 ms  217.47.19.50
 6    31 ms    30 ms    30 ms  core1-pos4-1.sheffield.ukcore.bt.net [217.32.171
.181]
 7    39 ms    38 ms    39 ms  core1-pos0-14-5-0.ealing.ukcore.bt.net [62.172.1
03.109]
 8    35 ms    34 ms    34 ms  transit1-xe11-0-0.ealing.ukcore.bt.net [62.6.200
.110]
 9    36 ms    37 ms    37 ms  t2c3-xe-10-1-0.uk-eal.eu.bt.net [166.49.168.5]
10    37 ms    38 ms    37 ms  t2c1-ge13-0-0.uk-eal.eu.bt.net [166.49.237.25]
11   113 ms   111 ms   112 ms  t2c1-p4-0-0.us-ash.eu.bt.net [166.49.164.225]
12     *        *        *     Request timed out.
13     *        *        *     Request timed out.
14   147 ms   146 ms     *     ae13.bbr02.eq01.dal03.networklayer.com [173.192.
18.134]
15   145 ms   145 ms   145 ms  ae5.dar02.sr01.dal05.networklayer.com [173.192.1
8.217]
16   156 ms   157 ms   156 ms  po2.fcr01.sr01.dal05.networklayer.com [173.192.1
18.133]
17     *        *        *     Request timed out.
18     *        *        *     Request timed out.
19     *        *        *     Request timed out.
20     *        *        *     Request timed out.
21     *        *        *     Request timed out.
22     *        *        *     Request timed out.
23     *        *        *     Request timed out.
24     *        *        *     Request timed out.
25     *        *        *     Request timed out.
26     *        *        *     Request timed out.
27     *        *        *     Request timed out.
28     *        *        *     Request timed out.
29     *        *        *     Request timed out.
30     *        *        *     Request timed out.

Trace complete.

C:\Windows\system32>ping www.mymathforum.com

Pinging mymathforum.com [50.22.14.115] with 32 bytes of data:
Request timed out.
Request timed out.
Request timed out.
Request timed out.

Ping statistics for 50.22.14.115:
   Packets: Sent = 4, Received = 0, Lost = 4 (100% loss),

I have tried pinging a different problem site before, and got 50% loss, if that helps.

[KenB]

Try adding this to your Hosts file:

 

50.22.14.115 www.mymathforum.com ( note .....there is a space after 115 )

This will be added underneath what is already there.

You will need to open in Notepad by right clicking on Hosts ( not the .txt version if that is there )

 

Try connecting now.

 

===============

 

If this doesn't do it try disabling the Firewall ( temporarily of course ) and the AV to see if they are blocking the site.

[mattpi]

No luck, I'm afraid - neither seems to help.

[KenB]

Hi,

 

This has got me scratching my head :)

 

You say you can connect from a proxy server.

 

Lets try something to see if it is connected to your IP Address.

 

Try tracert and ping on the following site:

http://www.kenspchelp.co.uk

 

No need to post results - just let me know if you were successful.

 

If you can succeed - I will then block your IP Address from the site ( temporarily :) )

And we can try again to see if we get the same result.

[mattpi]

OK, that worked fine.

[KenB]

OK

I have banned your IP Address from my website.

See if you can successfully tracert and ping it now.

[mattpi]

The tracert went through exactly the same as before. I pinged it twice - the first time I got 25% packet loss, the second time I got 0% loss.

[KenB]

Hi,

 

It doesn't look IP Address based either.

(I have un-blocked the IP Address)

 

I tried changing my settings to OpenDNS ( not my ISP settings )

This by-passes my ISP DNS.

 

I have normal internet usage - however, I could NOT tracert or ping mymathforum.com

I could tracert and ping other sites.

So....

I tried using GoogleDNS - and this allowed me to ping and tracert the site.

 

Lets give it a try on your system:

 

Assuming Win7

 

Control Panel > Network & Internet > Network & Sharing Center > Change Adapter Settings ( left side ) > Click on the Connection > Properties

Highlight Internet protocol V4 (TCP/IPv4) > Properties

 

Here if you have a set value for DNS servers make a note of it.

If it is set to Automatic - check the box below "Use the following ..."

 

Make the Preferred DNS Server 8.8.8.8

Make the Alternate DNS Server 8.8.4.4

 

This forces your system to use GoogleDNS.

 

Try connecting to the site again.

 

If this doesn't do it at least we know it is not a DNS problem either.

[mattpi]

OK - I switched DNS servers and flushed the DNS cache. I can access mymathforum.com now, but I still can't access some other sites (except via proxy, as always) so unfortunately the problem doesn't seem to be fixed.

[KenB]

Hi,

 

Just read your first post again.

You said that you tried OpenDNS and it worked. Did you use the

• 208.67.222.222
  
• 208.67.220.220 settings as described in post 14 ?
  

[mattpi]

Yes, although I set the DNS server directly through the router settings rather than through the network properties settings, which were on default.

[KenB]

If that worked for you - why not reset the router to OpenDNS settings.

There is no disadvantage.

 

You could, if those settings work for you, contact your ISP and ask them if they can explain why their DNS settings are causing you problems.

[mattpi]

Sorry, I wasn't clear: the problem happens no matter which DNS servers I use. DNS lookups appear to be working; when I type the IP address given from the DNS lookup I can access the site in question via proxy but not access it otherwise.

[KenB]

Hi,

I suggest that you contact your ISP and ask if they can throw any light onto this.

I am out of suggestions as to what could possibly be causing this.

 

Significantly you can connect via a proxy.

Traceroute (tracert) fails at the last hop.

You cannot ping the site(s)

Alternative DNS settings don't allow you to connect.

It doesn't appear to be IP Address related

Adding the IP Address and the site to the Hosts file makes no difference.

There is nothing in the Hosts file blocking access to the sites.

Disabling AV and Firewall has no effect.

 

Let me know what they say :)

[mattpi]

I was going to ring the ISP, but it seems that the problem has fixed itself anyway. Thanks for all your help, sorry it turned out to be a waste of time!

[KenB]

sorry it turned out to be a waste of time!

Not a waste of time at all.

Good to hear that things are back to normal :)