Can't connect to NASA sites.

[paulmd]

For a while now, I've been unable to connect to many space related
sites. In particular:

www.hubblesite.org, *.nasa.gov

Here's what I know. Neither IE6, nor firefox, nor Opera can connect.
But browsing to the whole rest of the web is normal. Including
antivirus sites. HOSTS file normal. But cannot ping, nor tracert.

I CAN boot to a SUSE live DVD and browse said sites normally. So
problem is not hardware, or ISP related. It's definitely windows.

Virus/spyware scan turns up nothing (Nortan, AVG, Ad-aware)

It's not a firewall issue. Disabling firewall does not resolve issue.

IDEAS? I'm going to nuke it next week if i can't turn up anything.


XP pro, sp2.

Comcast cable.

 

[GHalleck]

For a while now, I've been unable to connect to many space related
sites. In particular:

www.hubblesite.org, *.nasa.gov

Here's what I know. Neither IE6, nor firefox, nor Opera can connect.
But browsing to the whole rest of the web is normal. Including
antivirus sites. HOSTS file normal. But cannot ping, nor tracert.

I CAN boot to a SUSE live DVD and browse said sites normally. So
problem is not hardware, or ISP related. It's definitely windows.

Virus/spyware scan turns up nothing (Nortan, AVG, Ad-aware)

It's not a firewall issue. Disabling firewall does not resolve issue.

IDEAS? I'm going to nuke it next week if i can't turn up anything.


XP pro, sp2.

Comcast cable.

FYI...no problem getting into either http://hubblesite.org/
or http://www.nasa.gov/. Currently running an XP-SP2 behind
anti-virus and firewall.

 

[Daave]

For a while now, I've been unable to connect to many space related
sites. In particular:

www.hubblesite.org, *.nasa.gov

Here's what I know. Neither IE6, nor firefox, nor Opera can connect.
But browsing to the whole rest of the web is normal. Including
antivirus sites. HOSTS file normal. But cannot ping, nor tracert.

I CAN boot to a SUSE live DVD and browse said sites normally. So
problem is not hardware, or ISP related. It's definitely windows.

Virus/spyware scan turns up nothing (Nortan, AVG, Ad-aware)

It's not a firewall issue. Disabling firewall does not resolve issue.

IDEAS? I'm going to nuke it next week if i can't turn up anything.

What happens when you use the IP addresses?

http://130.167.1.203

http://64.132.34.86

Interestingly, the first one (hubblesite.org) works for me, but not the
other (nasa.gov)!

 

[Elmo]

What happens when you use the IP addresses?

http://130.167.1.203

http://64.132.34.86

Interestingly, the first one (hubblesite.org) works for me, but not the
other (nasa.gov)!

With the second, I had to add "www." before it would work. I believe
that's a simple setting within their server, whether they require the
"www.". I edit a web page and that was an option when I went to the
setup page on the commercial server.

http://www.nasa.gov/

The OP probably has some software or a router blocking the site. I
suspect the Norton firewall, whether it's "disabled" or not.

 

[Daave]

With the second, I had to add "www." before it would work. I believe
that's a simple setting within their server, whether they require the
"www.". I edit a web page and that was an option when I went to the
setup page on the commercial server.

http://www.nasa.gov/

Actually, I was referring to the supposed IP address of www.nasa.gov:

http://64.132.34.86

I got the above from http://network-tools.com/ . Something tells me it
isn't current, though...

To the OP, what happens when you enter http://130.167.1.203 ?

 

[paulmd]

for me it's ALL nasa's pages

saturn.jpl.nasa.gov WAS a favorite.
marsrovers.jpl.nasa.gov, is another

pretty much anything with nasa.gov in it, i can't get to.

Actually, I was referring to the supposed IP address of www.nasa.gov:

http://64.132.34.86

Firefox:
"
Invalid URL
The requested URL "/", is invalid.

Reference #9.52228440.1165189495.0
"

I got the above from http://network-tools.com/ . Something tells me it
isn't current, though...

To the OP, what happens when you enter http://130.167.1.203 ?

Enter into address bar: http://130.167.1.203

Server not found
"
Firefox can't find the server at hubblesite.org.
* Check the address for typing errors such as
ww.example.com instead of
www.example.com

* If you are unable to load any pages, check your computer's
network
connection.

* If your computer or network is protected by a firewall or
proxy, make sure
that Firefox is permitted to access the Web.

"

Interesting: it resolved the hostname from the IP address, but I still
was unable to connect.
Now the ping:

"C:\Documents and Settings\Paul>ping 130.167.1.203

Pinging 130.167.1.203 with 32 bytes of data:

Request timed out.
Request timed out.
Request timed out.
Request timed out.

Ping statistics for 130.167.1.203:
Packets: Sent = 4, Received = 0, Lost = 4 (100% loss),

"


Ipconfig /release , and /renew are no help.

No problem with routers and my ISP, as I can connect when booted from a
linux live CD.

My hard disk does NOT have bad sectors (i checked), and RAM is fine
(memtest86+ says so)

I may try sfc /scannow, and see if THAT helps. But something tells me
it won't. I'll let you know.

 

[Daave]

Daave wrote:

To the OP, what happens when you enter http://130.167.1.203 ?

Enter into address bar: http://130.167.1.203

Server not found
"
Firefox can't find the server at hubblesite.org.
* Check the address for typing errors such as
ww.example.com instead of
www.example.com
[snip]

Interesting: it resolved the hostname from the IP address, but I still
was unable to connect.
[snip]

Ipconfig /release , and /renew are no help.

No problem with routers and my ISP, as I can connect when booted from
a linux live CD.

My hard disk does NOT have bad sectors (i checked), and RAM is fine
(memtest86+ says so)

I may try sfc /scannow, and see if THAT helps. But something tells me
it won't. I'll let you know.

This is mondo bizarro.

I'd be curious to know if a laptop running XP plugged into your online
connection would yield similar results.

If the Linux live CD method works, then I'm guessing it's something on
your hard drive. But you said your HOSTS file is alright and the problem
repeats even if you disable the firewall. Elmo mentioned your router.
However, if it were the router, why would the live Linux CD method work?

Logic tells me it's either the HOSTS file or the firewall.

Just humor me: put an .old extension on the HOSTS file and see what
happens.

*Uninstall* Norton (you can always reinstall it <shudder>) and see what
happens.

The only other thing I've got is for you to empty browser cache(s).

Keep us posted!

 

[Daave]

For a while now, I've been unable to connect to many space related
sites. In particular:

www.hubblesite.org, *.nasa.gov

[snip]

You know, it *might* just be an intermittent server problem. I just
tried pinging both hubblesite.org and 130.167.1.203 and got "Request
timed out" on each.

I just performed a traceroute on 130.167.1.203 and on the 11th hop:

stsci-ma-903.hst.nasa.gov [198.118.126.19] started the whole "Request
timed out" dance.

 

[paulmd]

Daave wrote:

To the OP, what happens when you enter http://130.167.1.203 ?

Enter into address bar: http://130.167.1.203

Server not found
"
Firefox can't find the server at hubblesite.org.
* Check the address for typing errors such as
ww.example.com instead of
www.example.com
[snip]

Interesting: it resolved the hostname from the IP address, but I still
was unable to connect.
[snip]

Ipconfig /release , and /renew are no help.

No problem with routers and my ISP, as I can connect when booted from
a linux live CD.

My hard disk does NOT have bad sectors (i checked), and RAM is fine
(memtest86+ says so)

I may try sfc /scannow, and see if THAT helps. But something tells me
it won't. I'll let you know.

No dice on sfc

This is mondo bizarro.

I know THAT. I am a full time computer technician. I've never seen
anything so annoying that wasn't a virus. If this was a customer's
computer, I'd have reinstalled the OS by now.

I'd be curious to know if a laptop running XP plugged into your online
connection would yield similar results.

If the Linux live CD method works, then I'm guessing it's something on
your hard drive. But you said your HOSTS file is alright and the problem
repeats even if you disable the firewall. Elmo mentioned your router.
However, if it were the router, why would the live Linux CD method work?

Logic tells me it's either the HOSTS file or the firewall.

Hosts file is the one posted here:

http://www.mvps.org/winhelp2002/hosts.htm
http://www.mvps.org/winhelp2002/hosts.zip

Problem predates the installation of this file, however.
Previous HOSTS was blank.

Just humor me: put an .old extension on the HOSTS file and see what
happens.

I'll do this tomorrow and report back. (I'm not at home now)

*Uninstall* Norton (you can always reinstall it <shudder>) and see what
happens.

Problem predates most recent installation of Norton.

The history goes like this:

90-day norton installation came free with new Gigabyte motherboard.
It expired. So I uninstalled it. Went Avg 7.1, and then 7.5 for a
while. Until a few days ago, when I installed a 6 month free Norton AV
(which unlike the first, did not include a firewall) from GooglePack
(this is the only item I installed form google pack).

http://pack.google.com/intl/en/product_info.html?symantec


Sometime during the use of AVG 7.1 I noticed i couldn't get to
marsrovers.jpl.nasa.gov. I'd thought it was a transient glitch, but it
persisted. And then I noticed I had the same problem with OTHER nasa
sites.

I've only had one virus infection, and it was VERY short lived. The
firewall stopped it instantly from communicating with the outside
world, and after that, it was completely cleaned within minutes. Before
the virus had time to invite all it's friends in.

The only other thing I've got is for you to empty browser cache(s).

I've tried this before, with no luck. I will do so again tomorrow.

And anyway, I can't ping. So I don't think it's the issue.

Keep us posted!

Will do.

 

[user]

FYI only.. as of 7:35am Eastern, I was able to connect to both sites
without any problems.

WinXp Home
FF 2.0
Comodo FW
CC
SpyBot S&D Hosts file

 

[Daave]

The history goes like this:

90-day norton installation came free with new Gigabyte motherboard.
It expired. So I uninstalled it. Went Avg 7.1, and then 7.5 for a
while. Until a few days ago, when I installed a 6 month free Norton AV
(which unlike the first, did not include a firewall) from GooglePack
(this is the only item I installed form google pack).

http://pack.google.com/intl/en/product_info.html?symantec

Perhaps the first Norton installation left behind some stray fragments
in the registry?

Check out http://basconotw.mvps.org/SymRem2.htm if you haven't done so
already.

Sometime during the use of AVG 7.1 I noticed i couldn't get to
marsrovers.jpl.nasa.gov. I'd thought it was a transient glitch, but it
persisted. And then I noticed I had the same problem with OTHER nasa
sites.

Maybe a conflict between AVG and leftover Norton fragments?

I've only had one virus infection, and it was VERY short lived. The
firewall stopped it instantly from communicating with the outside
world, and after that, it was completely cleaned within minutes.
Before the virus had time to invite all it's friends in.

Which virus did you have?

What do you currently use for a firewall?

Have you tried running Hijack This?

Finally, Google toolbar has been know to cause weird problems.

 

[Daave]

Will do.

One other idea. See
http://forum.spamcop.net/forums/index.php?showtopic=3288&st=40&p=26799&

Or http://tinyurl.com/yj6akx

When I run tracert, I notice a reference to an Akamai server. The one
poster here was experiencing something similar.

FWIW, at 6:17 PM EST, pinging hubblesite.org results in "Request time
out" messages.

 

[Daave]

I CAN boot to a SUSE live DVD and browse said sites normally. So
problem is not hardware, or ISP related. It's definitely windows.

This is the weirdest part! Is it possible you're using a different name
server whenever you're booting from the live SUSE DVD?

 

[paulmd]

Perhaps the first Norton installation left behind some stray fragments
in the registry?

I've considered that possibility, but I never did anything toward it.

Check out http://basconotw.mvps.org/SymRem2.htm if you haven't done so
already.

I will try this, soon.

Maybe a conflict between AVG and leftover Norton fragments?


Which virus did you have?

I don't remember the name, it was definately a trojan, embedded in a so
called media player codec.

I want to say zcodec, but don't quote me, my nemory isn't that good on
the incident.

What do you currently use for a firewall?

Currently XP built in. At least til this issue is solved. Maybe zone
alarm after this. At the time it was Norton's.

Have you tried running Hijack This?

Not yet, but I will.

Finally, Google toolbar has been know to cause weird problems.

It was never installed at any time. I made sure.

 

[paulmd]

This is the weirdest part! Is it possible you're using a different name
server whenever you're booting from the live SUSE DVD?

If so, it's not my doing. It's not like comcast gives you any choice in
the matter. It would be very irritating if that turned out to be the
case.

 

[paulmd]

One other idea. See
http://forum.spamcop.net/forums/index.php?showtopic=3288&st=40&p=26799&

Or http://tinyurl.com/yj6akx

When I run tracert, I notice a reference to an Akamai server. The one
poster here was experiencing something similar.

FWIW, at 6:17 PM EST, pinging hubblesite.org results in "Request time
out" messages.

THANK you. Thank you for pointing out hijack this It gave me the first
clue. You were also right about me using a different DNS server under
windows. (Though it was NOT my doing)

The relivant portions of the log (forgive word wrap):

O17 -
HKLM\System\CCS\Services\Tcpip\..\{2D63C7BA-1770-45F5-A75C-5935C18C0336}:
NameServer = 85.255.115.5,85.255.112.25
O17 -
HKLM\System\CCS\Services\Tcpip\..\{C5D05E73-47C5-49BF-AA0D-39D711D8CB72}:
NameServer = 85.255.115.5,85.255.112.25
O17 -
HKLM\System\CCS\Services\Tcpip\..\{DE655987-C4B9-42D6-B09D-8F9DF24A1879}:
NameServer = 85.255.115.5,85.255.112.25
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer =
85.255.115.5 85.255.112.25
O17 -
HKLM\System\CS1\Services\Tcpip\..\{2D63C7BA-1770-45F5-A75C-5935C18C0336}:
NameServer = 85.255.115.5,85.255.112.25
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer =
85.255.115.5 85.255.112.25
O17 -
HKLM\System\CS2\Services\Tcpip\..\{2D63C7BA-1770-45F5-A75C-5935C18C0336}:
NameServer = 85.255.115.5,85.255.112.25
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer =
85.255.115.5 85.255.112.25



So, Norton was innocent of this. What happened was a VERY subtle
possible spyware. A DNS hijacker. Must have came in visiting one of the
dead zones of the internet (where you get porn instead of a 404 when
you mistype a name). Once the cause was identified, the cure was super
simple.

Control panel->network connections->properties>local Area
Connection->properties.

Then navigate to the tcp/ip properties. In the general tab select:

Obtain DNS server address automatically

Reboot.

Problem solved.

THank you. You saved me from nuking of the OS.