Strange website failure

[DaLincerGuy]

Lounge Denizens;

I have one computer out of 5 that has some trouble connecting to certain websites.

Three different browsers (IE9, Chrome, Firefox) all have trouble completing web pages from
www.craigslist.org and some others.

System in trouble:
Win 7, up from Win XP over a year ago
2GB ram, 400Gb HD open space
AMD Sempron 2600+

connected to internet via
Netgear WNR2000 and Comcast High Speed
DNS set to
Use OpenDNS
Googles DNS servers
Plain comcast defaults with no change

I have no trouble noted with connectivity on any other system. One XP and Netbook on Win7

All known updates applied.

Just reinstalled using the "In Place Upgrade" from Win7 to Win7 with no change of behavior.

Running ESET NOD32 paid and clear.
Ran scan from IOBites -- clean
MBAM MalwareBytes -- clean

IE9 just says "unable to connect to website"
FireFox says [sometimes] connection reset
Chrome just hangs

Had ZoneAlarm Pro v 9.3? running and it got some better when removed ZoneAlarm

TrendMicro Housecall Fails to complete installation, and will not run.

Requesting assistance with troubleshooting.

David

[Tinto Tech]

Hello David and welcome.

The issue could be many things.

Are you sure there are no left-overs from ZoneAlarm on the affected machine? Is ZA installed on any other machines there? What are the errors when you try to run the TrendMicro tool?

Have there been any changes to the hosts file (located at C:\Windows\System32\Drivers\etc)?

Can you open a command prompt on the affected PC and a clean PC and execute nslookup www.craigslist.org. I get an IP address of 208.82.238.130 for that, and it should be the same for you.

Can you run ping www.craigslist.org in the command window and do you get the same if you ping the IP address received in the nslookup on both good and bad machines?

Assuming you can ping and you get consistent nslookup results, run a tracert www.craigslist.org in the command prompt windows on both machines. Compare the output: they should be the same.

[DaLincerGuy]

Tinto, thanks for the questions, my answers in BOLD between your questions below.

David

Hello David and welcome.

The issue could be many things.

Are you sure there are no left-overs from ZoneAlarm on the affected machine? Is ZA installed on any other machines there? What are the errors when you try to run the TrendMicro tool?

I uninstalled ZoneAlarm and ran ZoneAlarms cleanup tool. No Program files entry is visible, and Looking for anything zonelabs, checkpoint or other keywords shows in the registry.

I use ZoneAlarm v9.3 on all my PCs.

TrendMicro's House call gets an error during the unpack / update of the HouseCall installer, and stops at 65%


Have there been any changes to the hosts file (located at C:\Windows\System32\Drivers\etc)?

I looked and it had the one common entry of 127.0.0.1 [same as I saw in XP]
Can you open a command prompt on the affected PC and a clean PC and execute nslookup www.craigslist.org. I get an IP address of 208.82.238.130 for that, and it should be the same for you.

I get the same IP address and a message DNS request timed out
timeout was 2 seconds.

*** Request to www.craigslist.org timed-out.
This is on the XP machine across the room from the failing one.

On the target machine:
Same numbers and same message about DNS timeout and the request to timeout.

[[[[[ Could this be the source of this error? I see timeout messages on both the XP and the Win7 (target) machines? ]]]]]


Can you run ping www.craigslist.org in the command window and do you get the same if you ping the IP address received in the nslookup on both good and bad machines?

Results look identical on both machines, no lost packets and about 16-18ms time .


Assuming you can ping and you get consistent nslookup results, run a tracert www.craigslist.org in the command prompt windows on both machines. Compare the output: they should be the same.

To a casual look the results on both machines look the same, 12 hops and a delay of 9-16 ms /hop.

[Tinto Tech]

Sorry for the slow reply, other priorities caught up with me.

I'm a bit confused by this result:

Can you open a command prompt on the affected PC and a clean PC and execute nslookup www.craigslist.org. I get an IP address of 208.82.238.130 for that, and it should be the same for you.

I get the same IP address and a message DNS request timed out
timeout was 2 seconds.

*** Request to www.craigslist.org timed-out.
This is on the XP machine across the room from the failing one.

On the target machine:
Same numbers and same message about DNS timeout and the request to timeout.

[[[[[ Could this be the source of this error? I see timeout messages on both the XP and the Win7 (target) machines? ]]]]]

if you get the same IP address as I do using nslookup then DNS would appear to be correct. However, what confuses me is the second part, where you describe a DNS timeout result also being reported from the same nslookup command. I can't see why a DNS timeout would occur if nslookup has already returned the correct IP address.....and it appears that is on working machine.

On the faulty machine; the same error messages.

Certainly a DNS timeout would give the problems originally described, but traceroute appears to find the host at www.craigslist.org correctly, so at face value, DNS and routing are working.

Without understanding a little more about the circumstances that cause a DNS timeout message and a correct DNS lookup to be returned from the same nslookup it's difficult to know what is casuing the original issue.

One thing did come to mind: you mention that you are using 3 DNS settings: OpenDNS, GoogleDNS and your service provider. Are they programmed into the router or set in you TCP/IP v4 settings on the affected machine? What happens is you drop back to using default DNS settings in the router and the TCP/IP v4 settings on the affected machine?

[Xircal]

I suggest the following steps.

Firefox

1. If you have the layout with the oblong orange Firefox button top left, hit ALT to toggle the text links on.
2. Click "Help" | "Restart with Add-ons disabled".
3. In the next menu which appears, click the button at the bottom called "Continue in Safe Mode" without checkmarking any of the boxes.

When Firefox reastarts all your Add-ons will be disabled, but plugins will remain active. Try and access the sites you normally get error messages on. If everything works as it should, then one of your add-ons is the culprit. If that's the case, proceed as follows.

1. Repeat step #2 above and then when you see the menu, checkmark the top box which is "Disable all Add-ons".
2. Click the button called "Make changes and restart".
3. Re-enable your add-ons one-by-one until the problem recurs. Then you'll know which one is the culprit.

Internet Explorer

1. Right click the IE icon on your desktop and go to "Properties".
2. Click the "Advanced" tab and then in the menu at the bottom, click the "Reset" button to restore IE defaults.

Google Chrome

Can't help you there, I don't use it. But look for a similar option as with the above steps.

[starvinmarvin]

You said you are using OpenDNS. Maybe you could uncheck that and go back to default settings which would use Comcast's DNS service and see what happens.

[DaLincerGuy]

Changed dns settings to "get dns from server" no change.

About to take computer to local, reliable computer store for their view of the problem. While there,
will first duplicate problem and if duplicated there, will hope they can find it.

More details as they unfold.

David