Google & Gmail not opening in browser

[rakesh-the gilli]

Hi mates.. I recently formatted my system and installed Windows XP SP3. I have Google Chrome(5.0.375.55) and Firefox(3.6.3) browsers which do not open either of the google sites- Gmail.com or even google.com. If i manually enter google.co.in, then the page loads. Is there any solution as i cant access my gmail account. I am having a BSNL Dataone Broadband Connection.

When i try to open Gmail, it gives this error message(in chrome)..

404 Not Found
The requested URL /mail/ was not found on this server.
Apache/2.2.3 (CentOS) Server at mail.google.com Port 80

and when i try loading orkut.com it says(in firefox),

Unable to connect
Firefox can't establish a connection to the server at www.google.com.
The site could be temporarily unavailable or too busy. Try again in a few moments.
If you are unable to load any pages, check your computer's network connection.
If your computer or network is protected by a firewall or proxy, make sure that Firefox is permitted to access the Web.

But youtube is working fine..

[celldweller1591]

goto network connection> your connection icon>right click >properties > click ipv4 and click properties and then check on manually provide DNs and give it 4.2.2.1 and apply the changes. see if that works.

Apache/2.2.3 (CentOS) Server at mail.google.com Port 80

Apache server and CentOS

[rakesh-the gilli]

Hi celldweller1591.. I tried your setting but it didn't work.. Still unable to open google.com, gmail.com and orkut.com..

[it_waaznt_me]

Hmm ... Sounds interesting .. Did you try using OpenDns's service ... The DNS servers are 208.67.222.222 and 208.67.220.220 ...
After changing the dns settings, run this :
Start > Accessories > Command Prompt (Right Click, select Run As Administrator)
On the command prompt, type :
ipconfig /flushdns {Press Enter}

See if that works ..

[rakesh-the gilli]

Hey pal, i tried the openDNS method too.. but it didn't work.. Still getting the same error message.. In my services list, i found google updater service disabled. Could it be the reason?

[celldweller1591]

change google update service setting to manual. see if that works.

[asingh]

Just make a new network connection, and re-input all the ISP values.

[rakesh-the gilli]

Hi pals, even after trying the method of creating a new connection and entering the IP manually, it didn't work.. I enquired the BSNL customer representative but he couldn't find it too. He changed the DNS servers and verified, but ain't work either. Shall i ask other members in my area who have BSNL connection to verify whether they have any similar problems.? Is there any other way to find what the problem is.?

---------- Post added at 07:30 PM ---------- Previous post was at 07:28 PM ----------

change google update service setting to manual. see if that works..
Hey mate, it ain't work either.. Even changed DNS servers.. Any other way.?

[Gauravs90]

It may be a malware problem
scan with antimalware, avast

[The Unknown]

It seems there's some proxy server sitting between you and google. Check your proxy settings.
If they are not there, then its surely malware.

[rakesh-the gilli]

I scanned (fullscan) my entire hard drive for malwares using Spybot and adware (both free editions). It didn't find any malware.. Anything else should i try.? I also checked my proxy settings on both the browsers, no proxies there..

[The Unknown]

format & reinstall: the best solution for any problem in windows (a.k.a faildows)

[it_waaznt_me]

What doest traceroute shows ..?

Goto command prompt (as described above) and type in this command :
tracert google.com

And

tracert google.co.in

[rakesh-the gilli]

Sorry for being off the topic. Hey traceroute on google.com shows

C:\Documents and Settings\Rakesh>tracert google.com

Tracing route to google.com [213.175.216.204]
over a maximum of 30 hops:

1 1 ms 1 ms 1 ms 192.168.12.98
2 * * * Request timed out.
3 * * * Request timed out.
4 * * * Request timed out.
.
.
15 * * * Request timed out.
16 232 ms 224 ms 219 ms google.com [213.175.216.204]

and traceroute to google.co.in shows

C:\Documents and Settings\Rakesh>tracert google.co.in

Tracing route to google.co.in [209.85.231.104]
over a maximum of 30 hops:

1 1 ms 1 ms 1 ms 192.168.12.98
2 * * * Request timed out.
.
.
10 * * * Request timed out.
11 109 ms 113 ms 73 ms maa03s01-in-f104.1e100.net [209.85.231.104]

Is there any problem.?

[The Unknown]

Its an issue with the ISP.

[it_waaznt_me]

213.175.216.204 isnt Google. The whois info shows its a host in UK :

http://whois.domaintools.com/213.175.216.204

Most probably your dns is poisoned. Try opening Google through its ip : http://208.69.34.230/

I'm sure it will work. I think you should post your HijackThis logfile here ..

[Liverpool_fan]

It's certainly an ISP problem. Contact the Customer Care.
For the time being you can use a proxy such as http://atunnel.com

[The Unknown]

Originally Posted by it_waaznt_me

213.175.216.204 isnt Google. The whois info shows its a host in UK :

http://whois.domaintools.com/213.175.216.204

Most probably your dns is poisoned. Try opening Google through its ip : http://208.69.34.230/

I'm sure it will work. I think you should post your HijackThis logfile here ..

Dude, how do you say that DNS is poisoned ? Data cannot directly jump from India to US, it will go through some routes only.
And I think, windows does update the DNS records after reboot () [Linux doesn't use a cache by default, but can be configured to do so ]

[rakesh-the gilli]

Here are my ping details..

C:\Documents and Settings\Rakesh>ping gmail.com

Pinging gmail.com [209.85.231.83] with 32 bytes of data:

Reply from 209.85.231.83: bytes=32 time=77ms TTL=55
Reply from 209.85.231.83: bytes=32 time=75ms TTL=54
Reply from 209.85.231.83: bytes=32 time=77ms TTL=55
Reply from 209.85.231.83: bytes=32 time=78ms TTL=55

Ping statistics for 209.85.231.83:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 75ms, Maximum = 78ms, Average = 76ms

i see no problem as far as ping stats goes, it do connect with gmail.com but i still don't know what happened with browser connectivity. Oh yes i am using web proxies in the meanwhile. This is my Hijackthis report log file..

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:11:03 AM, on 14/06/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Norton AntiVirus\Engine\17.7.0.12\ccSvcHst.exe
C:\Program Files\Unlocker\UnlockerAssistant.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Norton AntiVirus\Engine\17.7.0.12\ccSvcHst.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\HijackThis\HijackThis.exe

O1 - Hosts: 213.175.216.204 google.com www.google.com
O1 - Hosts: 213.175.216.205 mail.google.com
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton AntiVirus\Engine\17.7.0.12\IPSBHO.DLL
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [UnlockerAssistant] C:\Program Files\Unlocker\UnlockerAssistant.exe -H
O4 - HKLM\..\Run: [MotiveReportAgent] "C:\Program Files\Common Files\Motive\McciBootStrapper.exe" /url="-APPKEY=Motive -WindowContext=ReportAgent -url=file://C:\Program Files\Common Files\Motive\ReportAgent.html" /browsertype=CustomMSIE /browserpath="C:\Program Files\Common Files\Motive\MotiveBrowser.exe" /hidden
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKCU\..\Run: [uTorrent] "C:\Program Files\uTorrent\uTorrent.exe"
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: Norton AntiVirus (NAV) - Symantec Corporation - C:\Program Files\Norton AntiVirus\Engine\17.7.0.12\ccSvcHst.exe

--
End of file - 2794 bytes

[ico]

Get rid of these

O1 - Hosts: 213.175.216.204 google.com www.google.com
O1 - Hosts: 213.175.216.205 mail.google.com

[hjpotter92]

And, also, check settings in gpedit.msc.

Go to, Start> Run...>gpedi.msc

[ico]

Do what I've said, your problem will be surely fixed.

[celldweller1591]

Get rid of these
O1 - Hosts: 213.175.216.204 google.com www.google.com
O1 - Hosts: 213.175.216.205 mail.google.com

+1. Its a hijacked Host file. check your c:\windows\drivers\etc\hosts file. Fix it and it will done

[rakesh-the gilli]

Hi, atlast you guys provided me the solution. I deleted the 2 host files as mentioned and voila gmail loaded without any problem, google.com automatically redirected to google.co.in, i could sign into my orkut account. Thanks guys.. But i need to know how on earth did this host file got changed as my system was a fresh formatted system.? I need to know as it will help me prevent this in future..

[ico]

Most probably, this was done by some Malware.

I suggest running a scan.

And keep on getting your HijackThis log checked regularly through www.hijackthis.de

[celldweller1591]

Get spyware terminator from crawler.com to monitor any suspicious activity in your computer. Believe me, it wont let pass anything undetected.

[rakesh-the gilli]

I am currently using Malwarebytes Anti-malware and Spybot search & destroy software. Both installed in my system. Aren't they worth.? Should i switch to spyware terminator so that it will help me get rid of malware problems, also please suggest a good anti-malware software to use..

[it_waaznt_me]

Originally Posted by The Unknown

Dude, how do you say that DNS is poisoned ? Data cannot directly jump from India to US, it will go through some routes only.
And I think, windows does update the DNS records after reboot () [Linux doesn't use a cache by default, but can be configured to do so ]

I say that because address translation is taking it to a host that isnt affiliated with Google. You can see the host entry which showed up in the hijackthis file got rid of the problem.

[The Unknown]

Originally Posted by it_waaznt_me

I say that because address translation is taking it to a host that isnt affiliated with Google. You can see the host entry which showed up in the hijackthis file got rid of the problem.

I had no idea about the hosts file getting hacked
Because its almost three years since I've used windows on my computer, ever since I faced the problem of 40 trojans, 20 viruses, 2 adwares and a spyware :O

[tapan2721]

too good...works perfectly fine!!