I want my Google back

June 12, 2008 7:34 AM

I can't figure out what's wrong with my computer and I can't Google the problem. Can you help me bring my Google back?

- Google will load the front page, but hangs on search results indefinetely
- Gmail will also not load, unless I use "https://" instead of "http://", than it works fine
- 90% of other pages are fine, couple of them also won't load

I've tried AdAware/Spyware Doctor/TrendMicro.
I've also tried cleaning the cache/temp files/restarting Firefox, reinstalling Firefox, restarting computer, System Restore, turning firewall off/on, pinging Google, deleting all cookies, allowing only Google cookies.
My Internet connection is fine.
I don't have any pop-up blocker except Firefox default one.
It behaves exactly the same in Internet Explorer.
I cannot Google the problem, so I'm asking you.
Tell me the name of this thing and I will kill it with my bare hands (I love my Google very much).

posted by leigh1 to computers & internet (21 comments total)

Here's a question - have you tried installing Firefox 3? It's up to RC3, so it's, like, right on the precipice of being ready for prime time, and it would give us yet another interesting datapoint.

Since this issue also occurs in IE, I tend to doubt it will fix anything, but I'd be interested to know if it did.
posted by kbanas at 7:43 AM on June 12, 2008

These two things:
1.) effects both Firefox AND Internet Explorer
2.) HTTPS (port 443) works, but HTTP (port 80) doesnt

...leads me to guess that (its not a browser problem).. rather that something is blocking port 80

But I'm at a loss to guess what that might be.

You also said that you tried System Restore and that did NOT fix it... Do you have any other computers on the same internet connection that are working fine ? (perhaps a friend can bring a laptop over and test ?)
posted by jmnugent at 7:49 AM on June 12, 2008

Are you on a wireless network? I have had a problem where any pages that were larger than 1 802.11 frame (around 1.5-2kb) would not load. It was related to wireless interference, and changing the channel # on my router fixed the problem. It sounds similar to your problem, since the entire google homepage definitely fits within one frame, but the extended results do not.
posted by helios at 7:49 AM on June 12, 2008

- I haven't tried installing Firefox 3, but I can though, if everything fails
- Yes, I am on a wireless network, and my friends laptop works fine

Does someone knows something about some worm that redirects the DNS for Google?
posted by leigh1 at 7:56 AM on June 12, 2008

Helios and jmnugent are on the right track, I think. I was having internet connectivity problems, where my connection was dropping packets. Meaning, my desktop would send the request out to the net, but that request was getting lost somewhere. So my browser would sit there like yours, waiting for a response from a server. That the server never got and so wouldn't respond to.

Can you try using a different PC on the same internet connection, AND using yours on a different connection? This will pinpoint where the problem exists (your computer versus your internet connection). Knowing that makes diagnosis easier.

Wait- does it only happen with Google? Find your "hosts" file and see if google was somehow redirected. (If there are any entries in there at all regarding google, delete them. Unless this machine is on a corporate network, where you should talk to the IT people.) Or your internet security settings for same. Maybe google was somehow placed in the wrong security zone.
posted by gjc at 8:03 AM on June 12, 2008

If you're worried about DNS.... just go out to a Command Prompt (DOS Prompt) and type the following:

nslookup www.google.com

You should get a response similar to this:

Server: resolver1.opendns.com
Address: 208.67.222.222

Non-authoritative answer:
Name: google.navigation.opendns.com
Addresses: 208.69.32.230, 208.69.32.231
Aliases: www.google.com

The first part ("Server: resolver1.opendns.com") is the remote DNS server that is replying to your DNS requests. (mine is OpenDNS because I've specifically configured my computer to use www.opendns.com for DNS requests)

While you are out at a DOS prompt, you can clear your DNS cache by running the following commands:

ipconfig /flushdns (flushes your local DNS cache)

ipconfig /registerdns (tells your computer to start rebuilding the local dns cache)

All of the above (hopefully) might give you some answers to help figure out if its a DNS poisoning problem.
posted by jmnugent at 8:11 AM on June 12, 2008

Thanks gjc - I will try to figure out if this is my computer or my connection. I cant find the "hosts" file though. I'm on Vista.

jmnugent - I'm getting this:
DNS request timed out.
timeout was 2 seconds.
Server: UnKnown
Request to UnKnown timed-out.
I've flushed DNS cache - no luck.
posted by leigh1 at 8:21 AM on June 12, 2008

Ok Leigh1,

If you're still out at a DOS prompt, run this:

ipconfig /all

You'll get an array of information about your network settings. Somewhere in the list, there will be an item labeled "DNS Servers" and it should show 2 IP addresses

What are they ? (and if you DO have 2 DNS Servers listed... can you PING those IP's ?... )
posted by jmnugent at 8:25 AM on June 12, 2008

There is only one DNS server and I can ping it:

Pinging 192.168.2.1 with 32 bytes of data:

Reply from 192.168.2.1: bytes=32 time=2ms TTL=64
Reply from 192.168.2.1: bytes=32 time=1ms TTL=64
Reply from 192.168.2.1: bytes=32 time=1ms TTL=64
Reply from 192.168.2.1: bytes=32 time=1ms TTL=64

Ping statistics for 192.168.2.1:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 1ms, Maximum = 2ms, Average = 1ms
posted by leigh1 at 8:36 AM on June 12, 2008

The IP address 192.168.2.1 is most likely your wireless router. The fact that you get a nice strong ping reply is a good sign. (atleast it would seem your laptop has a solid connection to your router)

Normally I would ask you to reset (unplug Power..... wait a minute or two... replug Power cable) your wireless router, BUT you said your friends laptop is working fine. Wouldn't hurt to do it anyways. (rebooting the router might clear some of the routers cached info about your computers connection)

I'm sure you've checked this.. but are you sure your friends (working) laptop is connecting to the same wireless signal as yours?... (Do you have a network cable laying around?... disable the wireless on your laptop and use a wired/cable long enough just to test ?)
posted by jmnugent at 8:45 AM on June 12, 2008

Yes, I've tried reseting my router. Both mine and my friends laptops are connected on the same wireless signal. jmnugent, thank you for your effort.
I think that the problem is not my connection. Since computer is acting little weird, I think that I picked up some malware and wasn't able to clean it completely.
For example, I'm seeing this picture on a bunch of sites I usually visit, this is the same picture on bunch of sites, not some random ad, but the same picture everywhere. And that is really weird.
posted by leigh1 at 8:59 AM on June 12, 2008

Have you tried Hijackthis?
posted by Jofus at 9:10 AM on June 12, 2008

I'm wondering if that "your computer may be infected with spyware" thing is a sign that this is indeed the latest incarnation of the "Cool Web Searcher"?

TrendMicro has a tool here you may want to download and run, in case that helps. An exboyfriend had a bad malware infestation and that did the trick.
posted by EmpressCallipygos at 9:13 AM on June 12, 2008

You might try changing your DNS servers to OpenDNS and see if it helps.

Another thing that's done the trick is changing my max MTU packet size with drtcp to 1400. I'm not sure if it works with Vista though.

And, yea, malware/virus scanning sounds to be in order.
posted by jmd82 at 10:32 AM on June 12, 2008

You host file is located here: C:\Windows\System32\drivers\etc\hosts

I would be interested to know what it has in it.

An un-edited host file looks like this:

# Copyright (c) 1993-2006 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host

127.0.0.1 localhost
::1 localhost

posted by B(oYo)BIES at 10:33 AM on June 12, 2008

If you would like, I will take a look at your HijackThis log if you post it here (or MeMail me with it):

HiJackThis log - Trend Micro HijackThis 2.0.2
Click here to download HJTInstall.exe

* Save HJTInstall.exe to your desktop.
* Doubleclick on the HJTInstall.exe icon on your desktop.
* By default it will install to C:\Program Files\Trend Micro\HijackThis .
* Click on Install.
* It will create a HijackThis icon on the desktop.
* Once installed, it will launch Hijackthis.
* Click on the Do a system scan and save a logfile button. It will scan and the log should open in notepad.
* Click on "Edit > Select All" then click on "Edit > Copy" and Paste the entire contents of the log (no attachments) into this post or a MeMail

* DO NOT use the AnalyseThis button, its findings are dangerous if misinterpreted.
* DO NOT have Hijackthis fix anything yet. Most of what HJT lists will be harmless or even required by your Operating System.
posted by B(oYo)BIES at 10:41 AM on June 12, 2008

B(oYo)BIES, my host file looks exactly the same as yours so apparently it is unedited. I've also sent you an MeMail with my HijackThis logfile. Thank you:)
posted by leigh1 at 11:02 AM on June 12, 2008

You definitely have some malware still installed from that pic you posted. If B(oYo)BIES is unable to help you, I'd be happy to look at your HJT log as well. I would recommend running Adaware and Spybot in "Safe Mode" Download the update files and program from another computer and put it on a USB stick. Then hold down f8 while the computer boots and choose "Safe Mode". If you install them in Safe Mode, the malware will be less likely to be able to corrupt the software.
posted by Raichle at 1:02 PM on June 12, 2008

Leigh1: "I think that I picked up some malware and wasn't able to clean it completely.
For example, I'm seeing this picture on a bunch of sites I usually visit, this is the same picture on bunch of sites, not some random ad, but the same picture everywhere. And that is really weird."

Ah. Why didnt you say that in the first place? :P

Yeah, you've definitely got some kind of spyware/malware. Here is what I would do:

1.) Turn OFF "System Restore". (a lot of modern malware attempts to infect restore-points)

2.) Did I mention turning OFF "System Restore" ?... seriously. dont skip this step.

3.) Download the following: Spybot Search and Destroy, AdAware, McAfee Stinger, SmitFraud Fix, put them all in an empty temp folder and install them. Once they are installed, launch the programs long enough to update them BUT DONT SCAN YOUR SYSTEM YET.

4.) Unplug your system from the internet/network. So that it doesnt get re-infected as you are trying to clean it.

5.) Reboot into SAFE MODE..... (DO NOT run anti-spyware tools in Windows "Normal" mode. MAKE SURE YOU ARE IN "SAFE MODE".) You may need to scan, then reboot (still in SAFE MODE), scan again, reboot (still in SAFE MODE).... and repeat until you are clean.

Doing the 5 steps above, should give you some indication of what spyware you are infected with. Keep notes during the process and past back to this thread with the types of files the scan-tools are detecting. The more specific you can be, the more accurate Google results you will get on how to clean it. The above 5 steps may not full clean it - but it should give you enough data to isolate the exact infection and further Googling might be necessary to find specific cleaning steps.

Its possible, even with the best tools, that you will be unable to clean or fully-remove whatever spyware you are infected with. I've found (over the years) that recent types of spyware/malware tend to infect computers in multiple file locations (and sometimes even use encrypted auto-launching file types). Tracking down all the various system processes and hidden file locations can be a daunting task. There comes a point after an hour or two of fighting it, that you should consider looking for a qualified, local PC Consultant to help you with the problem. (and I dont mean Geeksquad or someplace like BestBuy :P
posted by jmnugent at 4:12 PM on June 12, 2008 [1 favorite]

See if you can locate and run a copy of WinsockXPfix
posted by stenseng at 5:02 PM on June 12, 2008

Geeksquad came, installed AVG Antivirus, found some Trojans, killed them, and now everything is fine. Apparently, I scanned only for spyware. Again, the simplest solution is the right one.
Thank you all for lending a helping hand:)
posted by leigh1 at 11:06 AM on June 13, 2008