Routing Problem

[Josh Whitney]

I have a routing problem with my Win2K system. It manifests itsself by
being able to access some web sites and not able to access others.

Good sites: Yahoo.com, Google.com, IBM.Com
NG Sites: Yahoo.com-Email, Excite.com, Cisco.com, any MICROSOFT site

I thought it was a DNS issue, but using NSLOOKUP, all the NG sites return IP
addresses that are functional on another system plugged into the same switch
as the failing system.

When the DNS reports the IP address, it fails to ping.

I cleared all the route information, renewed all the dhcp leases but still
the same results.

Any ideas of where to look?
TIA

 

[Phillip Windell]

When the DNS reports the IP address, it fails to ping.

Forget DNS and just ping the IP#. Does it respond?

I cleared all the route information, renewed all the dhcp leases but still
the same results.

Any ideas of where to look?

.......a HOST file that has been hijacked and altered by spyware....?

 

[Doug Sherman [MVP]]

Many Internet sites such as microsoft.com block ping requests, so ping
timeouts don't necessarily tell you anything. One possibility is that a
trojan/worm has written phony entries to your hosts file. Try renaming the
file (WINNT\System32\Drivers\etc\hosts) and running ipconfig/flushdns.

Doug Sherman
MCSE Win2k/NT4.0, MCSA, MCP+I, MVP

 

[Josh Whitney]

No, the NG addresses do NOT respond to either domain names or IP addresses ,
while the GOOD addresses respond to both IP and Domain names.

 

[Mindy]

Deleted HOSTS & LMHOSTS
ran ipconfig /flushdns
no difference, still not working.

Any other help would be appreciated.

TIA

 

[Doug Sherman [MVP]]

You need to rule out name resolution as a potential problem:

1. Check and see if a hosts file has reappeared. Some worms will simply
create a new one after you delete it.

2. If you ping one of the sites you cannot access and the request timesout,
do you at least get an IP address? Test this address on another machine -
http://<IPaddress>. If it works, you know that name resolution is not the
problem for that site.

3. If name resolution is accurate, go to Tools/Internet Options/Security -
make sure the site or IP address is not listed in Restricted sites - try
adding it to Trusted Sites.

Doug Sherman
MCSE Win2k/NT4.0, MCSA, MCP+I, MVP

 

[Mindy]

1.) OK, I checked the security settings, no restricted sites, no trusted
sites, internet security medium (changed to minimum-no difference)

2.) C:\>nslookup microsoft.com
Server: dns1.rcsntx.sbcglobal.net
Address: 151.164.1.8

Non-authoritative answer:
Name: microsoft.com
Addresses: 207.46.250.119, 207.46.130.108

3.) tracert microsoft.com gives:

C:\WINDOWS\SYSTEM32\DRIVERS\etc>tracert microsoft.com

Tracing route to microsoft.com [207.46.250.119]
over a maximum of 30 hops:

1 10 ms <10 ms <10 ms 192.168.1.1
2 10 ms 10 ms 20 ms adsl-63-204-251-254.dsl.lsan03.pacbell.net
[63.204.251.254]
3 10 ms 10 ms 20 ms dist1-vlan50.lsan03.pbi.net [64.161.163.214]
4 10 ms 10 ms 10 ms bb1-g9-0-0.lsan03.pbi.net [67.116.100.99]
5 10 ms 20 ms 10 ms core1-p6-3.cranca.sbcglobal.net
[151.164.241.218]
6 20 ms 31 ms 30 ms core2-p11-0.crscca.sbcglobal.net
[151.164.242.81]
7 20 ms 30 ms 30 ms bb2-p10-1.sntc01.sbcglobal.net
[151.164.241.202]
8 20 ms 30 ms 30 ms ex1-p11-0.eqsjca.sbcglobal.net [64.161.1.22]
9 20 ms 30 ms 30 ms 151.164.248.126
10 30 ms 21 ms 30 ms ten8-1.core2.sjc1.ntwk.msn.net
[207.46.33.89]
11 20 ms 30 ms 30 ms 207.46.34.177
12 40 ms 50 ms 40 ms pos2-0.core2.sea1.ntwk.msn.net
[207.46.34.110]
13 40 ms 50 ms 40 ms pos1-0.iusnixcpxc1202.ntwk.msn.net
[207.46.36.214]
14 40 ms 51 ms 40 ms pos1-0.iustixcpdc1202.ntwk.msn.net
[207.46.155.13]
15 * * * Request timed out.
16 * * * Request timed out.


29 * * * Request timed out.
30 * * * Request timed out.
Trace Complete.


4.) If I go to next computer over (desktop) and put 207.46.250.119 in the
address line, it goes immediately to Microsoft

5.) I wrote off win2k svc pack 4 to CD and installed it. No Difference.
Still cannot see Microsoft.com or Excite.com.

6.) Same effect with Opera browser.

HELP!