Weird network/internet problem

  • Thread starter Thread starter Andreas Ravnestad
  • Start date Start date
A

Andreas Ravnestad

Ok, this is a bit of a curiosity. I have recently experienced some trouble
reaching certain domains on both the internet and the local network here.

It all started today when I tried to reach google.com. Internet Explorer
told me that it couldn't find the server, so I tried doing a dns on the
google.com domain, which returned an ip and all. So, I jumped to my other
computer, typed in "google.com", and it worked perfectly.

By now this problem was catching both my interest and annoyance, so I
started doing some investigations. The problem is obviously local to the
computer, since it works perfectly on my other computer.

So, here's the list of checkpoints:

* I tried telnet to see if a connection could be established at all, which
however it couldn't
* I first checked my tcp/ip settings, and everything was good.
* I tried pinging the domain, no reply at all (request timed out).
* I rebooted my computer several times, also in safe mode, but still
nothing.
* I ran a full antivirus scan, no luck.
* I ran a full scan with Lavasoft Ad-Aware, nothing changed.
* I checked my lmhosts and hosts files, no entries there.
* I scanned the registry for both google.com and the ip returned on a dns,
didn't find anything suspect.
* Made a pizza and watched a movie, completely ignoring the computer for
two hours in an attempt to let it fix itself. Didn't work either.

Note 1! This problem exists with both google.com, google.co.uk, 3 out of 5
computers on my local network. Other than that everything is just peachy.

Note 2! The computer keeps crashing, telling me when I have rebooted that it
has "Recovered from a serious error something something".

Note 3! I'm obviously running WindowsXP, however with sp1 and _all_ the
latest updates from microsoft.com (even before this problem arised).

Next thing on the list is booting up with a Knoppix CD and see if the
problem persists. If so, I'll buy a new network card.

If you guys have any remote idea on what's going on, please let me know. All
suggestions appreciated :)
 
Google is my startup page. In the last two weeks 7 or 8 times
I've gotten the can't reach server message. I close IExplorer and
try again and it usually connects but sometimes it takes two attempts.
At first I thought that Google was so busy I couldn't get server time.

I have a network but usually connect and only run one machine.
Haven't noticed if this happens when the network is up and
running or just sort of randomly. I will start paying attention to details.
 
I think I have figured it out. Seems like the google.com and google.co.uk
domains have been hijacked by some spyware on my computer, that resolves
them to a third party server of some sort, probably a proxy or gateway that
just relays traffic and records search strings. Their
web/gateway/proxyserver seems to be unoperational at the moment though,
causing me to notice their misdoing. For those of you who's interested, the
ip to the "fake" google.com is 207.44.194.56. Dns your google.com and check
if it matches ;)

I still haven't found a remedy though. I have no idea how the spyware
hijacked this domain name.

Kind regards,
Andreas Ravnestad
Get and run spybot search and destroy.
http://www.safer-networking.org/
Spyware is loaded on your computer in many ways. KAZAA and many freeware
programs load spyware. You'll be amazed at what spybot search and destroy
finds on your computer from spy programs.
 
I think I have figured it out. Seems like the google.com and google.co.uk
domains have been hijacked by some spyware on my computer, that resolves
them to a third party server of some sort, probably a proxy or gateway that
just relays traffic and records search strings. Their
web/gateway/proxyserver seems to be unoperational at the moment though,
causing me to notice their misdoing. For those of you who's interested, the
ip to the "fake" google.com is 207.44.194.56. Dns your google.com and check
if it matches ;)

I still haven't found a remedy though. I have no idea how the spyware
hijacked this domain name.

Kind regards,
Andreas Ravnestad
 
Hi Andreas,
I observed this today, too, via one of my clients. If you find out
how it infected your computer, please let me know.
To remedy the situation, check to see if your DNS settings have been
replaced.

Start > Settings > Network Connections > Local Area Connection
Under the General tab, choose Properties
Then select Internet Protocol (TCP/IP) and click Properties.
Remove any entry from the DNS servers, and check "Obtain DNS server
address automatically"

Hope that helps!

Cheers,
-Keith

--
Keith H. Bentrup
Lucid Tech Solutions, LLC

Residential clients -> http://home.lucidts.com
Business/Corporate clients -> http://biz.lucidts.com
 
Back
Top