# WWW Problem

1. Dec 14, 2005

### cscott

My father's computer is exhibiting weird behavior. It seems not to like certain websites (for example apple.com, mcafee.com). When one tries to load one, it times out and IE displays it's page for a DNS error. What makes it worse, is a few days ago it suddenly fixed itself only to go back to it's 'broken' state. I really don't know what's wrong here... the rest of the computers in our house work fine, and they're all behind the same router.

*runs back to OS X*

2. Dec 14, 2005

### Anttech

Do you have a LAN? What have you configured as your DNS server?

what happens when you ping mcafee.com ? does it resolve the IP address?

do this at cmd:
>nslookup

then type

> mcafee.com

3. Dec 14, 2005

### cscott

I cannot ping mcafee because my ISP filters it.

I have tried nslookup and it finds the IPs fine, but putting them into IE still poses problems (I'm not sure what error aries after it times out though.) This also happens in Firefox btw, so it's not just IE. Another weird aspect is apple.com has partially loaded (one image box), but then it just sits there... I really don't know what to think anymore.

4. Dec 14, 2005

### Anttech

what happens if you put the IP address of Mcafee.com in your browser?

5. Dec 14, 2005

### -Job-

Try the following at the command prompt:
> telnet www.mcafee.com 80
> GET /us/ HTTP/1.0
Press enter twice. (it's best if you copy/paste the second line because characters might now show as you type them).
This should print the text comprising the html page of the mcafee site.

You can also try it for apple:
> telnet www.apple.com 80
> GET / HTTP/1.0

Let us know what you get.
Have you had problems with spyware recently?

Last edited: Dec 14, 2005
6. Dec 14, 2005

### cscott

Code (Text):
Microsoft Windows XP [Version 5.1.2600]

C:\Documents and Settings\Ian>telnet www.mcafee.com 80
Connecting To www.mcafee.com...Could not open connection to the host, on port 80
: Connect failed

C:\Documents and Settings\Ian>nslookup www.mcafee.com
Server:  bdns2.nbtel.net

Name:    www.mcafee.com

C:\Documents and Settings\Ian> telnet 216.49.88.12 80
Connecting To 216.49.88.12...Could not open connection to the host, on port 80:
Connect failed

Apple has now magically [slightly] fixed itself. The page loads verrrrry slowly in Firefox. It's been almost 10 minutes now and it's still missing half the page. As I type this it seems to be stuck on "Connnecting to images.apple.com." In IE the page doesn't really load at all--blank image box or two, then just idles "Opening 17.254.0.91..."

Code (Text):

[...]

<p class="sosumi">Copyright &copy; 2005 Apple Computer, Inc. All righ
ts reserved.</p>
<!-- END INCLUDED FOOTER -->

</body>
</html>

Connection to host lost.

Using IP's in either browser yeilds the same result.

7. Dec 14, 2005

### cscott

Also, if you were interested:

Code (Text):

C:\Documents and Settings\Ian>ping www.mcafee.com

Pinging www.mcafee.com [216.49.88.12] with 32 bytes of data:

Destination host unreachable.
Destination host unreachable.
Destination host unreachable.
Destination host unreachable.

Ping statistics for 216.49.88.12:
Packets: Sent = 4, Received = 0, Lost = 4 (100% loss),

Pinging www.l.google.com [72.14.203.99] with 32 bytes of data:

Reply from 10.169.90.161: Destination net unreachable.
Reply from 10.169.90.161: Destination net unreachable.
Reply from 10.169.90.161: Destination net unreachable.
Reply from 10.169.90.161: Destination net unreachable.

Ping statistics for 72.14.203.99:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 0ms, Maximum = 0ms, Average = 0ms

8. Dec 14, 2005

### Moonbear

Staff Emeritus
I don't know about McAfee, but the problem with Apple might be their site. I had trouble loading pages a few days ago and some didn't load completely (I've noticed this happens when they're doing major updating of their site, like when they introduce new products and need to redo a lot of what's displayed on their site). I just tried it now, and it loaded, but there was a long delay before it opened (not anywhere near 10 min, but longer than usual).

9. Dec 14, 2005

### -Job-

Ok, it's not a DNS problem. The fact that you can't ping www.mcafee.com isn't relevant because i can't either, so the guys at mcafee probably disabled reply on ping for security reasons (ping-of-death). It doesn't seem to be a hardware problem because it works fine for other sites. It can't be your ISP because other PCs can see the site, so it's something between that PC and the router, and i don't think it's the router. Make sure every machine has a different IP address and that there isn't any spyware around that might be taking up resources or hijacking the browser.

Last edited: Dec 14, 2005
10. Dec 15, 2005

### Anttech

its probably because the apple site is rendering its pictures from somewhere else:

yup,

Code (Text):
Z:\>ping www.apple.com

Pinging www.apple.com.akadns.net [17.112.152.32] with 32 bytes of data:

Reply from 17.112.152.32: bytes=32 time=184ms TTL=50
Reply from 17.112.152.32: bytes=32 time=183ms TTL=50
Reply from 17.112.152.32: bytes=32 time=223ms TTL=50
Reply from 17.112.152.32: bytes=32 time=183ms TTL=50

Ping statistics for 17.112.152.32:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 183ms, Maximum = 223ms, Average = 193ms

Z:\>ping images.apple.com

Pinging a932.g.akamai.net [63.208.33.6] with 32 bytes of data:

Reply from 63.208.33.6: bytes=32 time=205ms TTL=52
Reply from 63.208.33.6: bytes=32 time=205ms TTL=52
Reply from 63.208.33.6: bytes=32 time=206ms TTL=52
Reply from 63.208.33.6: bytes=32 time=205ms TTL=52

Ping statistics for 63.208.33.6:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 205ms, Maximum = 206ms, Average = 205ms

Z:\>
Code (Text):
5   160 ms   155 ms   154 ms  12.119.180.165
6   190 ms   190 ms   190 ms  gbr1-p55.dvmco.ip.att.net [12.123.207.10]
7   189 ms   189 ms   189 ms  tbr1-p013501.dvmco.ip.att.net [12.122.1.29
8   190 ms   191 ms   207 ms  12.122.12.133
9   195 ms   188 ms   192 ms  gbr5-p20.sffca.ip.att.net [12.122.11.90]
10   189 ms   190 ms   189 ms  gar1-p360.sj2ca.ip.att.net [12.122.2.253]
11     *     12.118.124.78  reports: Destination net unreachable.
looks like Mcafee have stricted edge of enterprise policies...

what happens when your tracert this:

192.168.253.2

is this on your network or ISP's? It is strange for an ISP to have a 192.168... address as it can get a bit funny when you have NAT implimented

11. Dec 15, 2005

### -Job-

I think 192.168.253.2 is probably his router's IP. Keep in mind that other computers in his LAN can get to Mcafee so it doesn't seem to be something external to his LAN.

12. Dec 16, 2005

### cscott

That IP isn't my router, it was given to me by my ISP a while ago.

Code (Text):

aurora:~ chris$traceroute 192.168.253.2 traceroute to 192.168.253.2 (192.168.253.2), 64 hops max, 40 byte packets 1 192.168.0.1 (192.168.0.1) 10.753 ms 0.943 ms 0.694 ms 2 10.169.90.161 (10.169.90.161) 13.035 ms 12.580 ms 12.515 ms 3 10.171.253.1 (10.171.253.1) 12.713 ms 12.736 ms 13.020 ms 4 10.191.253.5 (10.191.253.5) 15.599 ms 15.510 ms 15.586 ms 5 bdns2.nbtel.net (192.168.253.2) 15.118 ms * 15.376 ms aurora:~ chris$

It seems that the Norton Antivirus site is blocked too. This points more towards spyware/virus. There is a antispyware tool install on there which my father periodically uses so it's most likely a virus. The problem is McAfee isn't up to date because it's update requires access to the website itself. I'm not sure what I can do to get new virus definitions...

By the way, I brought a laptop down and attached it up to the ethernet cable of his computer and even changed the IP's, yet it works fine...

13. Dec 17, 2005

### Anttech

Hmm must be a small ISP there are playing with fire using that as a DNS server...

Yeh your are probably right spyware or something, have you checked your host file?

14. Dec 17, 2005

### cscott

No, that is something I hadn't checked. The problem is my dad gave up and formatted while I was at school

Thanks for the info guys.

15. Dec 17, 2005

### turbo

There is some pretty clever spyware out there that hijacks browser settings, redirects URLS, initiates popups saying things like "your computer is infected. Click here for help." or "Windows suggests that you to click here to fix this problem." and other slimey stuff. Some spyware hides itself very well, some allows parts of itself to be detected and removed by Ad-Aware, SpyBot, etc, only to reload itself on the next boot. You might want to try Ewido Security Suite. I tried about a half-dozen anti-spyware packages and it was the only one that could successfully track down and remove all vestiges of "WWWcoolsearch" and its variants.

Once the PC is nice and clean, make sure that you use "active protection" screener and update the spyware definitions frequently.