Google will not load

Forums › Microsoft Windows › Google will not load

1 | 2

tigercorp

668 posts

Ultimate Geek
+1 received by user: 81

#533153 13-Oct-2011 23:23

Lets use nslookup to see if your current dns server is giving you this dodgy ip address for google, and then we'll see what the telecom dns server returns.

In the command prompt type the following and press enter after each word:

nslookup
google.com
server 202.27.158.40
google.com

Then copy and paste (or type) all the results back here.

As an example my output when I do this is:

C:\>nslookup
Default Server: DIR-825
Address: 192.168.1.253

> google.com
Server: DIR-825
Address: 192.168.1.253

Non-authoritative answer:
Name: google.com
Addresses: 74.125.237.82
74.125.237.81
74.125.237.80
74.125.237.84
74.125.237.83

> server 202.27.158.40
Default Server: dnsc1.xtra.co.nz
Address: 202.27.158.40

> google.com
Server: dnsc1.xtra.co.nz
Address: 202.27.158.40

Non-authoritative answer:
Name: google.com
Addresses: 74.125.237.81
74.125.237.83
74.125.237.84
74.125.237.80
74.125.237.82

> exit

Straycat

16 posts

Geek

#533196 14-Oct-2011 08:29

Hi there,

Copy / paste doesnt work, so hopefully I've typed everything as it says....

------------------------------------------------------
Default Server: dsldevice.lan
Address: 192.168.1.254

Non-authoritative answer:
Name: google.com
Address: 64.125.87.101

server 202.27.158.40
Default Server: dnsc1.xtra.co.nz
Address: 202.27.158.40

google.com
Server: dnsc1.xtra.co.nz
Address: 202.27.158.40

DNS request timed out.
timeout was 2 seconds.
*** Request to dnsc1.xtra.co.nz timed-out
--------------------------------------------------------------

There you go...

jonb

1796 posts

Uber Geek
+1 received by user: 545

Trusted

#533217 14-Oct-2011 09:08

As another potential solution, try using malwarebytes

http://www.malwarebytes.org/products/malwarebytes_free

Straycat

16 posts

Geek

#533233 14-Oct-2011 09:59

I've ran Malwarebytes about 4 times, and it keeps coming up with no errors found (apart from the first time when it found 3 errors)

tigercorp

668 posts

Ultimate Geek
+1 received by user: 81

#533277 14-Oct-2011 11:21

Straycat: Hi there,

------------------------------------------------------
Default Server: dsldevice.lan
Address: 192.168.1.254

Non-authoritative answer:
Name: google.com
Address: 64.125.87.101

So it looks like your router is giving you the dodgy IP for google. Can you log onto the router and check that what the DNS servers are set to?

server 202.27.158.40
Default Server: dnsc1.xtra.co.nz
Address: 202.27.158.40

google.com
Server: dnsc1.xtra.co.nz
Address: 202.27.158.40

DNS request timed out.
timeout was 2 seconds.
*** Request to dnsc1.xtra.co.nz timed-out

This is weird how it times out against the Telecom server. Could be an be a number of things.

Between that nslookup and hosts file missing, you've had some major weirdness going on at your place.

The easiest path to a solution here is to reset the router and start again.
Use this page to help configure - http://telecom.custhelp.com/app/answers/detail/a_id/1180

Straycat

16 posts

Geek

#533346 14-Oct-2011 13:32

Before I do that, I must point out that this is on my DESKTOP computer, to which the wireless router is plugged into. I also run 3 laptops off the same router wirelessly, and they are all fine.

Shall I still do the reset with the router?

Geekzone support

Support Geekzone with one-off or recurring donations Donate via PressPatron.

tigercorp

668 posts

Ultimate Geek
+1 received by user: 81

#533470 14-Oct-2011 18:58

Straycat: Before I do that, I must point out that this is on my DESKTOP computer, to which the wireless router is plugged into. I also run 3 laptops off the same router wirelessly, and they are all fine.

Shall I still do the reset with the router?

In that case, hold off with the reset.

In the command prompt do an ipconfig /all on your desktop and one of the laptops. Compare the 2 and note the discrepancies (its likely only the IP address should be different) and report back your desktop's dns servers.

Straycat

16 posts

Geek

#533478 14-Oct-2011 19:28

OK, so i did that, and these are the results:-

My desktop PC (which is plugged into a wireless router):-

Windows IP Configuration

             Host Name.............................: owner-bc2576970
             Primary Dns Suffix...................:
             Mode Type.............................: Unknown
             IP Routing Enabled..................: No
             WINS Proxy Enabled................: No
             DNS Suffix Search List..............: lan

Ethernet adapter Local Area Connection:

            Connection-specific DNS Suffix....: lan
            Description...............................: Intel(R) 82566DC-2 Gigabit Network
Connection
            Physical Address.......................: 00-19-D1-8B-22-43
            Dhcp Enabled...........................: Yes
            Autoconfiguration Enabled..........: Yes
            IP Address...............................: 192.160.1.65
            Subnet Mask............................: 255.255.255.0
            Default Gateway........................: 192.168.1.254
            DHCP Server.............................: 192.168.1.254
            DNS Servers.............................: 192.168.1.254
            Lease Obtained........................: Friday 14 October 2011 10:16:10 a.m

Now, the laptop says this:-

Windows IP Configuration

            Host Name..............................: Flint
            Primary Dns Suffix....................:
            Node Type...............................: Hybrid
            IP Routing Enabled...................: No
            WINS Proxy Enabled..................: No
            DNS Suffix Search List................: lan

Wireless LAN adapter Wireless Network Connection 2:

            Media State..............................: Media disconnected
            Connection-specific DNS Suffix....:
            Description...............................: Microsoft Virtual WiFi Miniport Adapter
            Physical Address.......................: E0-2A-82-16-E9-3A
            DHCP Enabled..........................: Yes
            Autocinfiguration Enabled...........: Yes

Wireless LAN adapter Wireless Network Connection:

           Connection-specific DNS Suffix......: lan
           Description.................................: Ralink RT3090 802.11b/g/n WiFi adapter
           Physical Address.........................: E0-2A-82-16-E9-3B
           DHCP Enabled............................: Yes
           Autoconfiguration Enabled............: Yes
           Link-Local IPv6 Address...............: fe80::8c1a:4111:7b2e:e8dbx12<pre
           IPv4 Address..............................: 192.168.1.67<preferred>
           Subnet Mask..............................: 255.255.255.0
           Lease Obtained..........................: Friday, 14 October 2011 6:24:50 p.m
           Lease Expires.............................: Saturday, 15 October 2011 7:05:40 p
           Default Gateway..........................: 192.168.1.254
           DHCP Server...............................: 192.168.1.254
           DHCPv6 IAID..............................: 333458050
           DHCPv6 Client DUID....................: 00-01-00-01-14-23-90-49-64-31-
50-5A-DA-7E
           DNS Servers................................: 192.168.1.254
           NetBIOS over Tcpip......................: Enabled

Then it goes on with "Tunnel adapter etc:"

tigercorp

668 posts

Ultimate Geek
+1 received by user: 81

#533513 14-Oct-2011 21:36

The IP settings were all normal and nothing else made much sense, so I googled :)

A couple of very relevant threads:
http://www.experts-exchange.com/Software/Internet_Email/Anti_Spyware/Q_27240605.html
http://www.experts-exchange.com/Software/Internet_Email/Anti_Spyware/Q_27384237.html

These cases point to rootkit running rogue processes that are responsible for the redirects.

From the threads you can see (scroll down to the very bottom of the pages) several options for the solution which is to stop the process then remove it with an anti-malware like Malwarebytes.

IMO the one to try is:
RogueKiller - http://www.geekstogo.com/forum/files/file/413-roguekiller/
followed by Malwarebytes.

Other rootkit process checkers suggested are:
http://www.symantec.com/content/en/us/global/removal_tool/threat_writeups/FixTDSS.exe
http://support.kaspersky.com/downloads/utils/tdsskiller.zip

Or maybe Microsoft System Sweeper (beta)
http://connect.microsoft.com/systemsweeper

Straycat

16 posts

Geek

#533737 15-Oct-2011 16:10

Ok, so I tried all the above, and the Kapersky rootkiller detected two problems.

Virus.Win32.Rloader.a
Service: ACPI
Malware object, high risk
        Service type:    Kernel driver (ox1)
        Service Start:   Boot (0x0)
        File:                C:\WINDOWS\system32\DRIVERS\ACPI.sys
        MD5:               d8fb7d1c3f5bfaf53fe9cc6367e9e99
        MD5 (forged): 8fd99680a539792a30e97944fdaecf17

Locked File
Service:sptd
Suspicious object, medium risk
        Service type:    Kernel Driver (ox1)
        Service start:    Boot (0x0)
        File:                C:\WINDOWS\system32\Drivers\sptd.sys
        MD5:               7f1b7c446cd3f926af45b8c48bd593

When I click "Copy all to quarantine", and then "continue", it says it will be complete after reboot, which I am about to do...

I'll let you know what happens in the next post.

Straycat

16 posts

Geek

#533745 15-Oct-2011 16:21

Righth, hopefully, this is the final post.

I ran the Kapersky one, did the reboot on my PC, and lo and behold, GOOGLE WORKS!!!

Can I just say a big THANK YOU to all of you guys who tried to help, and especially to TIGERCORP.

Many many thanks!!!

Derek.(Straycat)

Quic Broadband

Move to New Zealand's best fibre broadband service (affiliate link). Free setup code: R587125ERQ6VE. Note that to use Quic Broadband you must be comfortable with configuring your own router.

l43a2

1784 posts

Uber Geek
+1 received by user: 591

ID Verified

Trusted

#533767 15-Oct-2011 17:26

yay :)

tigercorp

668 posts

Ultimate Geek
+1 received by user: 81

#533790 15-Oct-2011 18:29

Straycat: Righth, hopefully, this is the final post.

I ran the Kapersky one, did the reboot on my PC, and lo and behold, GOOGLE WORKS!!!

Can I just say a big THANK YOU to all of you guys who tried to help, and especially to TIGERCORP.

Many many thanks!!!

Derek.(Straycat)

Thanks for reporting back.
Its worthwhile knowing someone may have to run all 3 rootkit killers to find the problem.

1 | 2