Impossible To Fix ?

[Ex-MGSTech]

OK how about these:-

 

Check default gateway

 

Hosts file?, sometimes used to redirect HTTP stuff

 

find it here:-C:\WINDOWS\system32\drivers\etc edit with notepad

 

Steve

 

A default hosts file should look like this:-

 

# Copyright © 1993-1999 Microsoft Corp.

#

# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.

#

# This file contains the mappings of IP addresses to host names. Each

# entry should be kept on an individual line. The IP address should

# be placed in the first column followed by the corresponding host name.

# The IP address and the host name should be separated by at least one

# space.

#

# Additionally, comments (such as these) may be inserted on individual

# lines or following the machine name denoted by a '#' symbol.

#

# For example:

#

# 102.54.94.97 rhino.acme.com # source server

# 38.25.63.10 x.acme.com # x client host

 

127.0.0.1 localhost

[Guest blacksheep]

Might hit the staff room for a coffee, will bump into staff though and I will only get more problems.. Yeh tell me monday and I will log it

Most SLT communication about the real world I work in happens when they bump into me down the staff room.. seriously!

 

He said it works though through a proxy, in other words sounds like blocked ports.

Gateway problem and/or subnet mask would do it if proxy is on same network

Also check dns, as proxy can handle dns for you. Can you do nslookups? (not just bbc)

Edited November 7, 2008 by blacksheep

[RabbieBurns]

Id hazard a guess that there's some 3rd party 'security' software such as Norton or something which is disabling access to the internet

[elsiegee40]

Id hazard a guess that there's some 3rd party 'security' software such as Norton or something which is disabling access to the internet

 

If it was third party software, Safe Mode with Networking would be OK, but it isn't.

[AyatollahPies]

Bin it and start again.

 

You know you want to.

You know it makes sense.

[Guest blacksheep]

@RabbieBurns

Thats why I mentioned about disabling non windows services earlier

 

Thinking about it more now though it could be a gateway or subnet prob as his proxy would probably be on the same subnet. Then when not using proxy you are going outside your subnet. I would check this!

[tmcd35]

Have you set up another PC in the DMZ and bypass the proxy. Just to check it is a problem with the PC your looking for a not some other network problem?

 

Then I'd definatly go for a repair install at this point!

[RabbieBurns]

yep my bad

 

I think the last 2 posts are the most likely now thinking about it

[mattx]

Thanks for the pointers so far - done the sfc.exe /scannow - No Joy

Made a new HOSTS file - No Joy [ also by passed that in the IP settings ] but again no Joy

There is no third party software on it...

Other PCs by-passing the proxy work ok - [ I am typing this post on it ]

 

Also tried re-installing the nic - no joy

 

What I MAY try is sticking in another nic in it though......

Edited November 7, 2008 by mattx

[plexer]

Definately doesn't have zonealarm installed?

 

If you install something like privoxy on it so there is a local proxy that goes straight out to the internet can it surf then?

 

Ben

[gshaw]

Not sure if you've tried the WinSock fix already but this has done the trick for me when having similar problems...

 

http://majorgeeks.com/download4372.html

 

Also for HOSTS file I add this to systems that have spyware troubles...

 

Blocking Unwanted Parasites with a Hosts File

[mattx]

This has to be a port 80 issue, our proxy uses 8080 and it works fine on that - I can ping addresses [ even my home dynamic address ] so it has no problem dealing with echo requests......

[plexer]

netstat -ano

 

See what is on port 80?

 

Then find it in task manager and kill it?

 

Ben

[mattx]

netstat -ano

 

See what is on port 80?

 

Then find it in task manager and kill it?

 

Ben

 

Been using TCP View but nothing sticks out......

[plexer]

Something must be there as listening on port 80 if that is where the issue lies.

 

Ben

[elsiegee40]

Been using TCP View but nothing sticks out......

 

 

Shouldn't this problem be on Aunty Angela's thread?

[ZeroHour]

Something must be there as listening on port 80 if that is where the issue lies.

 

Ben

Not nessarily. Outgoing request wont be affected by your pc using port 80 as your not connecting to it.

 

First lets see what parts are not working.

Run CMD then try a ping to google.com

Does it resolve a ip?

If not then dns is stitched too which is the first problem. If it can resolve but not route then it smells of a firewall possibly or malware using a rootkit. Try the sophos rootkit scanner to see if it discovers anything.

I am guessing their router works at home for every other device as well.

[mattx]

Something must be there as listening on port 80 if that is where the issue lies.

 

Ben

 

You would think wouldn't you ?

Proxy on 8080 working fine,

 

Just spotted something on 74.125.79.147 & 74.125.79.99

 

scrap that - its bleeding google

[ZeroHour]

Also can you telnet to a known ip on port 80?

[mattx]

Not nessarily. Outgoing request wont be affected by your pc using port 80 as your not connecting to it.

 

First lets see what parts are not working.

Run CMD then try a ping to google.com

Does it resolve a ip?

If not then dns is stitched too which is the first problem. If it can resolve but not route then it smells of a firewall possibly or malware using a rootkit. Try the sophos rootkit scanner to see if it discovers anything.

I am guessing their router works at home for every other device as well.

 

Pings domain names fine - DNS is fine - will try the rootkit scanner - I'll use systernals first, then sophos's - it will have to wait till next week now - I'm buggering off home once i have changed the backup tapes..........

 

Thanks for all the help so far people.

[ZeroHour]

Try using the very basic Lynx Browser for Windows 9x/NT/2000/XP

It will test to ensure the browsers are not being auto compromised.

You could also try a open proxy on the internet and route through it for a test.

[Jay]

As well as telnetting out on port 80, you could try 443 to see if the ssl port is also blocked. Sounds very much like something sniffing the outbound traffic, left over AV hooks perhaps after an uninstall, Norton used to do that all the time.

[mattx]

This PC is going out the window - I can't even use the Sophos rootKit Scanner as there is a EISA partition on it and falls over as soon as it starts scanning.

It won't even do a bog standard Chkdsk because of this partition - [ I can't access it either through any third party software - unless I >TRY< and recover the PC which I don't want to do.] Maybe one of the earlier viruses / trojans has done something to this which is causing a problem. I dunno, to tell you the truth these sort of PCs [ its from Tescos - Qion or something ] just pi55 me right off as they have drivers or chipsets I have never even heard of.

[mac_shinobi]

the hijackthis log file that you saved if you go to HijackThis Logfileauswertung you can either copy and paste the whole log file into the text field or upload the hijackthis log file and it will analyse it for you.

 

hijackthis tutorial :

 

CastleCops® - HijackThis Log Tutorial

 

There are other tutorials if you google it.

 

I know you said you used the command line to fix winsock etc but may be worth while using winsock fix and rebooting as per

 

Repair/Reset Winsock settings

 

Also are you getting any errors in event viewer relating to the issue you are having ( control panel --> admin tools -> event viewer )

 

What about when you try to ping an ip address instead of say BBC - Homepage or even an nslookup ?

 

Just as a thought - what happens if you use a linux live disc - are you still able to go onto the internet using a linux live disc ?

 

Also on Internet explorer - if you right click on it and start with no add ons I take it that makes no difference as I am guessing its as you pointed out something to do with the NIC or software ie the TCP/IP stack or winsock or something along those lines.

Edited November 9, 2008 by mac_shinobi

[mattx]

I've run the winsock repair - no joy.

The PC is able to ping DNS, & IP address without any problems. Also NSlookup works fine.

Thanks for the link to the Hijack this site, I can normally tell just whats going on with that but I may have missed something so I'll upload the log on Monday.