Thread: Cannot connect to update.microsoft.com or microsoft download servers

I have the same problem and this has been since my last update on31st december 2011

You should be a little more specific. How can you be so sure it's the same problem. I went through the past posts and i'm not sure if it was even clear what was blocking him from microsoft.

I have an HP pavillion with windows 7 home premium. I have the same problem and this has been since my last update on31st December 2011. I am not very tech savvy. Somebody please help
1.
Control Panel : Windows Update:
Check menu options shown on left.
or confirm Page opens.
2.
If you know how to do SYstem Restore ,
try a date earlier to Dec 30th.
Go to
control Panel.
Select Recovery
Menu page opens
Open System Restore. etc
3.
If you want you can CREATE a System Restore Point for today also first.

Feedback.

I will list the problem for your benefit....
I have been regularly updating my windows since october 2011 when i purchased the system through live update without any problem.
I also have Norton internet security 2012 which runs automatic updates.
On the 31st of Jan at around 9.30 am I ran my last update.
Since then I have not been able to connect to any of the microsoft sites including hotmail and msn. For both hotmail and msn it gives the message dns lookup failed for all browsers.(ie, chrome and firefox)
For microsoft site it takes me another page. I think it is a dummy page with bing logo. It has some advertisements and some nondescript pictures. If i try to ping microsoft it gives me a reply but when i try to acees with the same url it still takes me that page. the url that comes on the window is 212.113.36.83.
I heard that there is some dns hijack virus. could it be that? but I did a full system scan and nothing turned up.

the ip you mention isn't microsoft's
use this
207.46.19.254
put the ip directly in your browser.
can you now open microsoft.com?
Check your current dns server. Also change it to open dns:
208.67.222.222
208.67.220.220

Open C:/windows/system32/drivers/etc/hosts with notepad. Is there any line that doesn't start with a hash '#'? Copy paste those lines here.

EDIT:
Before you do any of these, it'd be better if you can reset your router to default settings and setup everything again. If you do this, check right then if your problem is solved instead of trying anything else. But if you don't want to reset it, atleast check your dns settings there. I never change dns server in my router, I do it in network card but it's possible to change in router too i guess.

And do a dnsflush before you connect to microsoft.com The usual order for finding the ip is first dns cache then hosts file then dns server. If you have any problem following this, just ask, I'll write everything in a orderly manner.

Originally Posted by thehost

the ip you mention isn't microsoft's
use this
207.46.19.254
put the ip directly in your browser.
can you now open microsoft.com?
Check your current dns server. Also change it to open dns:
208.67.222.222
208.67.220.220

Open C:/windows/system32/drivers/etc/hosts with notepad. Is there any line that doesn't start with a hash '#'? Copy paste those lines here.

EDIT:
Before you do any of these, it'd be better if you can reset your router to default settings and setup everything again. If you do this, check right then if your problem is solved instead of trying anything else. But if you don't want to reset it, atleast check your dns settings there. I never change dns server in my router, I do it in network card but it's possible to change in router too i guess.

And do a dnsflush before you connect to microsoft.com The usual order for finding the ip is first dns cache then hosts file then dns server. If you have any problem following this, just ask, I'll write everything in a orderly manner.

Thanks you for the reply
I did open the file in notepad but all the lines began with a #. The rest of it like changing to open dns and resetting the router etc has gone above my limited knowledge of computer hardware. Sorry. Well I did type the IP address in the browser and it opened a page with only text. No images were visible. And the links etc were just listed. It looked like a page with all the html tags typed incorrectly. The links are working but when i click on any link it takes me back to that dummy page with advertisements.

If unable to access the link/s listed here
http://www.indiabroadband.net/window...oval-tool.html (Malicious Software Removal Tool)

TRY
http://tinyurl.com/4q6gc3y

No31/ H613/P14800

Are these links to microsoft sites? because when I clicked on them they just took me the advertisement page I mentioned earlier

Option 1 :
Please confirm, whether you tried System Restore to an earlier date.
Assuming the update done on Dec 31st 2011 & some other applications/programs you have installed or web sites links visited
have introduced some malware.

,Option2 :
Keep your Windows OS installation cd ready
and
Start RUN type sfc /scannow
Your OS will be checked for Integrity and you will be asked to replace some files if affected by virus/trojans/malware/spyware etc.

Option 3:
Download the Microsoft Malware detection tool elsewhere and
install in your computer.
http://www.softpedia.com/get/Antivir...val-Tool.shtml
Option 4 ;
Download this application and run
Download WinSockFix 1.1.0.13 Free - WinSockFix - A free Winsock/Tcp repair utility - Softpedia

Option 5:
Allow a member to check your System ONLINE.
Download Teamviewer and establich contact.

Option 6:
Updates can wait and if OS is working otherwise normally,
Warning : REGISTRY is being modified. ( Take assistance from computer savvy friend )

In computer:To see what interfaces you have on your computer, type
Start RUN cmd Ok New window type
http://www.indiabroadband.net/broadb...tml#post335101 (Optimal MTU size)

OR

netsh interface ipv4 show subinterfaces

To change the MTU, type

netsh interface ipv4 set subinterface "Local Area Connection" mtu=nnnn store=persistent
where
Local Area Connection is the name of the network connection on your computer, from the list obtained above.
nnnn is the desired value for MTU.
Reboot after making the change.

OR post data before making changes.

Feedback with Option No. / action taken/ tried/ and result.
NO full quote.

Hi essbebe,
I will wait till the weekend to try it out. Someone who is much more tech savvy than me would be here then. Till then I will stay put but will do everything during the weekend and then post the results. Thank you very much for trying to help me out.

Option 7:
Did you try in SAFE MODE with Network connection ?
When system starts Press keyboard Key F7 or F8 for menu.

Well I did type the IP address in the browser and it opened a page with only text. No images were visible.

It's clear you have problem with dns resolution. You can open microsoft's index page with its ip but images dont show because they are at some other place whose real ip your system can't find out.

The ip corresponding to the website address is first found out from dns cache. If its not there it checks the hosts file, if still not found, it uses the dns server.

1)DNS cache hold the ip addresses temporarily. If you go to a website, its ip is cached for a while so you don't need to request its ip again from the dns server. This get cleared very often. But you can do it manually with

ipconfig /flushdns
in cmd

2)hosts file: This is the hosts file "C:/windows/system32/drivers/etc/hosts"
Any line that starts with # is a comment line.
If you put this line in it:

74.125.236.83 Yahoo! (Note: there's no # in this line)

trying to go to Yahoo! will open 74.125.236.83 which is actually google's ip. But if the real ip of yahoo is still there in the dns cache, it 'd use that ip instead of the one in hosts file.

3) DNS server: This is the remote server which indexes the ip adrresses of the webpages. Examples include those of BSNL or others like google dns, open dns, etc. By default if you dont specifically use a dns server, bsnl's server will be used. There are two places where you can choose your dns server:
i- In your network adapter options.
ii- In your router options.

Malware can change your hosts file and also change your adapter settings. You have already checked the hosts file and its intact. So only things left are the adapter and router. I remember someone had a similar problem when he used his linksys router. Microsoft pages weren't opening. He had the default 'admin' as password. Maybe viruses can change the router settigns with the default password. I don't know.

So whether there's a virus or not, you will eventually need to check your dns settings cause just removing the virus wont undo the settings.

This is what I'd do after scanning the system. First I'd flush the dns cache, then uninstall network adapter drivers, reinstall them, then reset router settings to factory defaults. Restart the system. Put appropriate settings into my router and network adapter and see if I can reach microsoft now. Even though its a lot of things it wont tke more than 10 mins. The most troubling thing for you may to get the antimalware software and its definitions. I think other security websites might also be blocked along with microsoft.

By the way are you sure the page that opened with the ip was microsofts (but without images,etc that pointed to other ips). If it wasn't then dont try anything I suggested.

OPTION 8;
Test now:
Conficker Eye Chart

do you see all the six images ?

Yes I can see all 6 images on conficker.
I think it is the microsoft site only because when i try to access microsoft by typing microsoft it takes me to another page which say bing and some advertisements. By the way I am having problem with hotmail and msn. there also i get the same message dns lookup error. By I can loginto windowslive solution center.

RECAP " Post No 25 to 38 for @prepal
Post No 33:Option 1 to 7 Weekend project.
Post No 30: pending reply.
option 37/8: No conflicker virus.


Feedback 39/9: For IP address mentioned in Post No 28.
Post as attachment the screen shot you get.

Example;


Feedback 39/10;
Give details of the modem/router model/number.
& MTU value entered ( usually in WAN page )

Feedback 39/11
Post ipconfig /all

Start RUN type cmd Ok
New window
type ipconfig /all



Para two:.
To attach screen shots; Safely Ignore if already known !
http://www.indiabroadband.net/bsnl-b...reen-shot.html (Monitor Screen Shot)

FORUM HINT
When you post here an option is seen "Go Advanced " click.
Then scroll down, select in Box Attach files "Manage Attachments"
Upload the picture here.will show as small thumbnail in your post..
or
Upload at tinypic.com and give the link as
i23.tinypic.com/123werty.jpg ( Example)no space dot etc

I am attaching the print screen for when I type microsoft on browser and also the ip that you gave for microsoft

Hi essbebe,
The first thumbnail is when I type the ip address and the second one is when i try to reach micrisoft website with url

From Post No 42: DNS entered twice.
IP Address: 109.74.196.50 Share this result
Location UNITED KINGDOM, ENGLAND, LONDON
Latitude, Longitude 51.500152, -0.126236 (51°30'1"S -0°7'34"E)
Connection through LINODE LLC

Feedback 43/12;
Who made this entry? in modem or Network LaN settings ?
Change it to google 8.8.8.8 and 8.8.4.4

Change in network/LAN/properties/ Deselect Box IPV6
select IPV4 Properties.
next page:
Change it to Google 8.8.8.8 and 8.8.4.4
Apply SAVE.
Reboot.

I dont know who made the entry/ Windows must have automatically detected the setting while the modem was installed I guess. In the LAN properties the radio option for obtain DNS server address automatically and IP address is on. But I think this IP address has been on right from the start. connection IPv6 says no network access.
I am saving your suggestions. On saturday I will have another computer at my disposal so will do the changes and let you know if the problem is rectified or not.

39/10 No reply from you.

43/12 and Post 44.

seems DNS like Google's Opendns etc. but may be for IPV6.
DNS Advantage

45/13
If you are using Google chrome type this link

http://www.update.microsoft.com/wind...e&thankspage=5

post the screen shot you get.

the same page is loading again

OK.You cannot make any changes in your system OS or modem. (example DNS etc )
update thread after Saturday.

I dont know who made the entry/ Windows must have automatically detected the setting while the modem was installed I guess. I think this IP address has been on right from the start.

I dont think it was what windows detected automatically. Check this blog. It was posted on 1st jan 2012, the same day you were infected.
Disclosure : Router based DNS MITM Attack | Welcome to the eScan Blog

It says router password was also changed. Try opening your router page.
In internet explorer, address is 192.168.1.1
default password 'admin' (its admin in most router i think)
default username is admin in my router. I think some don't need a username just password. See if you can even login to your router.

why am I not able to edit or delete my posts?

EDITbutton will appear only for 24 hours from first time of posting for you to delete the post contents. After this period you have to send PM ( Private Message to @Admin or @Just4Kix ( moderator) to delete the post/s )

or Post in same thread : ask members to IGNORE what appears in your previous post/s No ____ etc.

A big Thank you to all
I just called up mtnl and asked for the preferred dns alternate dns etc, changed it in the network settings and things are back to normal. Hopefully it doesnt happen again. Anyway mtnl people were not aware of this problem at all. Seems it happened with airtel connections too. Thanks once again