XP Internet Issue

[deanej]

I have an issue with a network for an organization at my college. One of the computers on it cannot connect to the internet (but can connect to other machines over the LAN if given an IP address). All other computers can connect fine and are running XP (except the Linux mail/file server).

DHCP Service is on, tried resetting things with command prompt, system restore is a no-go because no restore points before this problem happened exist, re-installed network adapter, safe mode doesn't work, can't ping anything (all requests time out).

In short, I'm stuck.

 

[Cutlass]

Have you checked firewall settings?

 

[deanej]

Oh yeah, also tried disabling the firewall and connecting. Didn't work.

 

[Petek]

Assuming your network is something like switched Ethernet, have you tried plugging the workstation's lobe cable into a different port on the switch?

 

[Maniacal]

Is everything plugged in?

 

[IglooDame]

If it can hit the local LAN but not the internet, there's a few things I'd check.

#1 - does it have the correct default gateway and subnet mask? I know you said it was on DHCP, but verifying with ipconfig wouldn't hurt.

#2 - can you ping google.com, and can you ping 8.8.4.4? In other words, is it a DNS issue?

#3 - can you pull up a local server's web page in the browser? In other words, is it a browser/proxy configuration issue?


edit: ignore #2, since you said "can't ping anything (all requests time out)"

 

[deanej]

I must have had a bad IP address (quite possible - I got it from a forum thread that might be several years old on another site). I can ping 8.8.4.4 and navigate to sites by IP, but it doesn't even know what www.google.com is. Its ipconfig is identical to one of the working machines except in the hostname, IP address, and network card fields.

 

[IglooDame]

I must have had a bad IP address (quite possible - I got it from a forum thread that might be several years old on another site). I can ping 8.8.4.4 and navigate to sites by IP, but it doesn't even know what www.google.com is. Its ipconfig is identical to one of the working machines except in the hostname, IP address, and network card fields.

If you can ping 8.8.4.4, that verifies layer-3 connectivity (routing), including subnet mask and default gateway. If you can navigate to sites by IP, that verifies any proxying your browser is set to is probably working correctly. Sounds like it might be DNS. Can you do an ipconfig with a /all ("ipconfig /all") and see if it is getting correct DNS servers? And do you have a way to put that 8.8.4.4 IP in for your primary DNS server (temporarily, to verify the issue - write down the one you'd be overwriting). Or, you could use the "nslookup" tool to verify DNS resolution from your own servers and from other places (like Google's 8.8.4.4).

 

[deanej]

Other manchines use the same DNS and changing the network card to use 8.8.4.4 for the DNS doesn't fix it. Here's where it gets really strange: nslookup yields this when trying to get an IP... on both the non-working and working machines:

*** Can't find server name for address 192.168.0.1: Non-existent domain
*** Default servers are not available
Server: UnKnown
Address: 192.168.0.1

before fetching the IP address. nslookup works fine on both even though IE and Firefox are apparently unable to get DNS results even though nslookup can.

Here's the result of a Windows network diagnostic (reduced to pertinent failures):
Query [www.microsoft.com] against DNS Server 192.168.0.1, (Type = 0x1, Options = 0x10e8) returns 0x2726

Hostname www.microsoft.com could not be resolved (Error code 0x2afc). Could be either gateway or DNS issue

HTTP: Error 12007 connecting to www.microsoft.com: The server name or address could not be resolved

Also, I tried to download the Microsoft Safety Scanner in case this was the result of malware, and it refuses to even start.

 

[IglooDame]

Assuming you're using nslookup correctly (no offense intended), it sounds like you might indeed have some malware screwing with your DNS resolution. Nslookup is AFAIK a separate process from the Windows DNS client, though, and I'd be surprised if a chunk of malware would get both - more like it simply intercepting/blocking everything going out on port 53, maybe?

 

[deanej]

Update: Microsoft Safety Scanner, once it finally ran, didn't find anything.