Troubleshooting Dad's Computer Issues

[cscott]

My father's computer is exhibiting weird behavior. It seems not to like certain websites (for example apple.com, mcafee.com). When one tries to load one, it times out and IE displays it's page for a DNS error. What makes it worse, is a few days ago it suddenly fixed itself only to go back to it's 'broken' state. I really don't know what's wrong here... the rest of the computers in our house work fine, and they're all behind the same router.

*runs back to OS X*

 

[Anttech]

Do you have a LAN? What have you configured as your DNS server?

what happens when you ping mcafee.com ? does it resolve the IP address?

do this at cmd:
>nslookup

then type

> mcafee.com

 

[cscott]

Do you have a LAN? What have you configured as your DNS server?

what happens when you ping mcafee.com ? does it resolve the IP address?

do this at cmd:
>nslookup

then type

> mcafee.com

I cannot ping mcafee because my ISP filters it.

I have tried nslookup and it finds the IPs fine, but putting them into IE still poses problems (I'm not sure what error aries after it times out though.) This also happens in Firefox btw, so it's not just IE. Another weird aspect is apple.com has partially loaded (one image box), but then it just sits there... I really don't know what to think anymore.

 

[Anttech]

what happens if you put the IP address of Mcafee.com in your browser?

Your ISP filters ICMP? strange...

 

[-Job-]

Try the following at the command prompt:
> telnet www.mcafee.com 80
> GET /us/ HTTP/1.0
Press enter twice. (it's best if you copy/paste the second line because characters might now show as you type them).
This should print the text comprising the html page of the mcafee site.

You can also try it for apple:
> telnet www.apple.com 80
> GET / HTTP/1.0

Let us know what you get.
Have you had problems with spyware recently?

 

[cscott]

Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.

C:\Documents and Settings\Ian>telnet www.mcafee.com 80
Connecting To www.mcafee.com...Could not open connection to the host, on port 80
: Connect failed

C:\Documents and Settings\Ian>nslookup www.mcafee.com
Server:  bdns2.nbtel.net
Address:  192.168.253.2

Non-authoritative answer:
Name:    www.mcafee.com
Address:  216.49.88.12


C:\Documents and Settings\Ian> telnet 216.49.88.12 80
Connecting To 216.49.88.12...Could not open connection to the host, on port 80:
Connect failed

Apple has now magically [slightly] fixed itself. The page loads verrrrry slowly in Firefox. It's been almost 10 minutes now and it's still missing half the page. As I type this it seems to be stuck on "Connnecting to images.apple.com." In IE the page doesn't really load at all--blank image box or two, then just idles "Opening 17.254.0.91..."

[...]

           <p class="sosumi">Copyright &copy; 2005 Apple Computer, Inc. All righ
ts reserved.</p>
                <!-- END INCLUDED FOOTER -->


                                            </body>
                                                   </html>


Connection to host lost.

Using IP's in either browser yeilds the same result.

 

[cscott]

Also, if you were interested:

C:\Documents and Settings\Ian>ping www.mcafee.com

Pinging www.mcafee.com [216.49.88.12] with 32 bytes of data:

Destination host unreachable.
Destination host unreachable.
Destination host unreachable.
Destination host unreachable.

Ping statistics for 216.49.88.12:
    Packets: Sent = 4, Received = 0, Lost = 4 (100% loss),

C:\Documents and Settings\Ian>ping www.google.com

Pinging www.l.google.com [72.14.203.99] with 32 bytes of data:

Reply from 10.169.90.161: Destination net unreachable.
Reply from 10.169.90.161: Destination net unreachable.
Reply from 10.169.90.161: Destination net unreachable.
Reply from 10.169.90.161: Destination net unreachable.

Ping statistics for 72.14.203.99:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 0ms, Maximum = 0ms, Average = 0ms

 

[Moonbear]

Apple has now magically [slightly] fixed itself. The page loads verrrrry slowly in Firefox. It's been almost 10 minutes now and it's still missing half the page. As I type this it seems to be stuck on "Connnecting to images.apple.com." In IE the page doesn't really load at all--blank image box or two, then just idles "Opening 17.254.0.91..."

I don't know about McAfee, but the problem with Apple might be their site. I had trouble loading pages a few days ago and some didn't load completely (I've noticed this happens when they're doing major updating of their site, like when they introduce new products and need to redo a lot of what's displayed on their site). I just tried it now, and it loaded, but there was a long delay before it opened (not anywhere near 10 min, but longer than usual).

 

[-Job-]

Ok, it's not a DNS problem. The fact that you can't ping www.mcafee.com isn't relevant because i can't either, so the guys at mcafee probably disabled reply on ping for security reasons (ping-of-death). It doesn't seem to be a hardware problem because it works fine for other sites. It can't be your ISP because other PCs can see the site, so it's something between that PC and the router, and i don't think it's the router. Make sure every machine has a different IP address and that there isn't any spyware around that might be taking up resources or hijacking the browser.

 

[Anttech]

Apple has now magically [slightly] fixed itself. The page loads verrrrry slowly in Firefox. It's been almost 10 minutes now and it's still missing half the page.

its probably because the apple site is rendering its pictures from somewhere else:

yup,

Z:\>ping www.apple.com

Pinging www.apple.com.akadns.net [17.112.152.32] with 32 bytes of data:

Reply from 17.112.152.32: bytes=32 time=184ms TTL=50
Reply from 17.112.152.32: bytes=32 time=183ms TTL=50
Reply from 17.112.152.32: bytes=32 time=223ms TTL=50
Reply from 17.112.152.32: bytes=32 time=183ms TTL=50

Ping statistics for 17.112.152.32:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 183ms, Maximum = 223ms, Average = 193ms

Z:\>ping images.apple.com

Pinging a932.g.akamai.net [63.208.33.6] with 32 bytes of data:

Reply from 63.208.33.6: bytes=32 time=205ms TTL=52
Reply from 63.208.33.6: bytes=32 time=205ms TTL=52
Reply from 63.208.33.6: bytes=32 time=206ms TTL=52
Reply from 63.208.33.6: bytes=32 time=205ms TTL=52

Ping statistics for 63.208.33.6:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 205ms, Maximum = 206ms, Average = 205ms

Z:\>

 5   160 ms   155 ms   154 ms  12.119.180.165
 6   190 ms   190 ms   190 ms  gbr1-p55.dvmco.ip.att.net [12.123.207.10]
 7   189 ms   189 ms   189 ms  tbr1-p013501.dvmco.ip.att.net [12.122.1.29
 8   190 ms   191 ms   207 ms  12.122.12.133
 9   195 ms   188 ms   192 ms  gbr5-p20.sffca.ip.att.net [12.122.11.90]
10   189 ms   190 ms   189 ms  gar1-p360.sj2ca.ip.att.net [12.122.2.253]
11     *     12.118.124.78  reports: Destination net unreachable.

looks like Mcafee have stricted edge of enterprise policies...

what happens when your tracert this:

192.168.253.2

is this on your network or ISP's? It is strange for an ISP to have a 192.168... address as it can get a bit funny when you have NAT implimented

 

[-Job-]

I think 192.168.253.2 is probably his router's IP. Keep in mind that other computers in his LAN can get to Mcafee so it doesn't seem to be something external to his LAN.

 

[cscott]

I think 192.168.253.2 is probably his router's IP. Keep in mind that other computers in his LAN can get to Mcafee so it doesn't seem to be something external to his LAN.

That IP isn't my router, it was given to me by my ISP a while ago.

aurora:~ chris$ traceroute 192.168.253.2
traceroute to 192.168.253.2 (192.168.253.2), 64 hops max, 40 byte packets
 1  192.168.0.1 (192.168.0.1)  10.753 ms  0.943 ms  0.694 ms
 2  10.169.90.161 (10.169.90.161)  13.035 ms  12.580 ms  12.515 ms
 3  10.171.253.1 (10.171.253.1)  12.713 ms  12.736 ms  13.020 ms
 4  10.191.253.5 (10.191.253.5)  15.599 ms  15.510 ms  15.586 ms
 5  bdns2.nbtel.net (192.168.253.2)  15.118 ms  *  15.376 ms
aurora:~ chris$

It seems that the Norton Antivirus site is blocked too. This points more towards spyware/virus. There is a antispyware tool install on there which my father periodically uses so it's most likely a virus. The problem is McAfee isn't up to date because it's update requires access to the website itself. I'm not sure what I can do to get new virus definitions...

By the way, I brought a laptop down and attached it up to the ethernet cable of his computer and even changed the IP's, yet it works fine...

 

[Anttech]

Hmm must be a small ISP there are playing with fire using that as a DNS server...

Yeh your are probably right spyware or something, have you checked your host file?

 

[cscott]

Hmm must be a small ISP there are playing with fire using that as a DNS server...

Yeh your are probably right spyware or something, have you checked your host file?

No, that is something I hadn't checked. The problem is my dad gave up and formatted while I was at school

Thanks for the info guys.

 

[turbo]

No, that is something I hadn't checked. The problem is my dad gave up and formatted while I was at school
Thanks for the info guys.

There is some pretty clever spyware out there that hijacks browser settings, redirects URLS, initiates popups saying things like "your computer is infected. Click here for help." or "Windows suggests that you to click here to fix this problem." and other slimey stuff. Some spyware hides itself very well, some allows parts of itself to be detected and removed by Ad-Aware, SpyBot, etc, only to reload itself on the next boot. You might want to try Ewido Security Suite. I tried about a half-dozen anti-spyware packages and it was the only one that could successfully track down and remove all vestiges of "WWWcoolsearch" and its variants.

Once the PC is nice and clean, make sure that you use "active protection" screener and update the spyware definitions frequently.