Neither live.com or hotmail.com working or pingable. No malware found.

[jft135]

I ran into an interesting program this morning. I have a business customer that has his outlook setup to check his hotmail account. As of Sunday, he can't send or receive messages and can't login to the webmail.

I tried the most obvious things. Manual virus check, TDSS Killer, GMER, Combofix, HijackThis, Malware Bytes, etc. all clean. Winsock reset, Norton & McAfee Removal tools multiple times, flush DNS etc. Nothing. All hardware diagnostics come back clean, all drivers updated, clean Hosts file, reinstalled network driver, still nothing.

The funny thing is, all other computers on the network can connect. If I go to login.live.com I can connect, but hotmail.com and live.com do not work. Pinging also doesn't work to either address or pop3.live.com or smtp.live.com.

I am totally out of ideas. Any tips?

 

[shamrin]

That's not much to go on, but if you're looking for ideas I would say look at DNS and maybe your HOSTS file. If you're getting host not reachable from PING I doubt that has to do with a virus as they normally are watching port 80 and not dealing with ICMP packets AFAIK. What do you get when you pick hotmail's IP directly? Does hotmail even respond to pings?

 

[Tepin]

Are the ping requests timing out or is the host not found?

I just blocked bing.com at my firewall see what would happen, for mine it's obvious at least. Big banner that says the site is blocked by my firewall. Pings
just time out.

 

[Vicenarian]

random idea; but have you tried a different browser?

 

[jft135]

That's not much to go on, but if you're looking for ideas I would say look at DNS and maybe your HOSTS file. If you're getting host not reachable from PING I doubt that has to do with a virus as they normally are watching port 80 and not dealing with ICMP packets AFAIK. What do you get when you pick hotmail's IP directly? Does hotmail even respond to pings?

I've tried several different DNS providers and replaced the hosts file with a clean copy. Hotmail and Live aren't even responding to pings. Using the IP makes no difference.

random idea; but have you tried a different browser?

Yes. I forgot to mention that Firefox can find the sites, but neither Outlook, Internet Explorer, Telnet, or a ping can find them. That's what is so strange. I've even uninstalled and reinstalled IE and run office diagnostics. I'm starting to wonder if their old IT guy is ****** at them for firing him and he did something.

 

[johnrobert]

When I have a major problem like this I nuke sooner than later (Catastrophic network sockets corrupted)
When you consider all the time you have spent so far , and you would have to go this route anyway

Other than that if its XP I would try a repair

 

[jft135]

When I have a major problem like this I nuke sooner than later (Catastrophic network sockets corrupted)
When you consider all the time you have spent so far , and you would have to go this route anyway

Other than that if its XP I would try a repair

I totally agree when it is a consumer involved, but to consider nuking a mission critical business PC that is only exhibiting this one problem I like to try to get to the bottom of it. On the other hand, it is a good sign that the PC has been compromised in some way and should not be trusted.

Besides, at this point, this is personal and I won't easily admit defeat.

 

[Captain Spaulding]

Run a live CD on the machine does it work? That would tell you if it's an OS problem or possibly something at the network level.

Have you tried with the AV and other security software disabled?

 

[jft135]

Run a live CD on the machine does it work? That would tell you if it's an OS problem or possibly something at the network level.

Have you tried with the AV and other security software disabled?

That is my next plan of action (should have tried it sooner, but it was a 7am appt and I was still groggy). I have already fully removed all AV, firewalls, etc.

 

[Vicenarian]

If firefox can access the websites, but not IE, that's really strange. Did you check the Internet Options (IE) "Connections) tab? Check for any erroneous dial-up/VPN settings, check the LAN settings for a proxy, ensure "Automatically Detect Settings" is the only thing that's checked, etc. Maybe IE Parental controls? Internet zone/privacy settings? Cookie settings? Maybe try clearing the IE cache?


Just random ideas; but maybe, just maybe one of them will work

 

[shamrin]

Well, if you get Host Not Reachable when you ping 65.55.237.32 (Hotmail) but can reach and ping any other site, then I am really cheering for you to find the solution (not N&P) because I want to hear it. The Live CD test should be interesting.

 

[jft135]

If firefox can access the websites, but not IE, that's really strange. Did you check the Internet Options (IE) "Connections) tab? Check for any erroneous dial-up/VPN settings, check the LAN settings for a proxy, ensure "Automatically Detect Settings" is the only thing that's checked, etc. Maybe IE Parental controls? Internet zone/privacy settings? Cookie settings? Maybe try clearing the IE cache?


Just random ideas; but maybe, just maybe one of them will work

I just reset everything to default. It is really weird. Normally I don't post questions like this, but it is one of the stranger things I've come across lately.

 

[Vicenarian]

I didn't bother re-reading the thread, but have you tried Safe Mode with Networking? See if the issue persists there? If everything works in Safe Mode, fire up your favorite autoruns manager and filter down the list to determine the culprit.

 

[iladelf]

Wonder if the utility mentioned below (I haven't tried it; mentioned elsewhere here on the forums) could assist you in this situation?

http://www.rizonesoft.com/2011/complete-internet-repair/

 

[colonydata]

I totally agree when it is a consumer involved, but to consider nuking a mission critical business PC that is only exhibiting this one problem I like to try to get to the bottom of it. On the other hand, it is a good sign that the PC has been compromised in some way and should not be trusted.

i would probably nuke it at this point, just because it is business critical.

just a thought but have you tried a packet capture? it would be interesting to see what is going out from that pc.