Something Strange Going On...

Posted by: ChrisN

Something Strange Going On... - 11/06/09 12:50 PM

My computer/browser/ftp client loses the ability to resolve certain urls.

My gear: iBook G4 1.33 w/10.4.11

Scenario: url for greenfrogmarket.com resolves just fine. Upload files with CyberDuck to that domain. Works fine, at first. Then, the ftp connection times out and will not resolve. It will not connect to that ftp server again, no settings have been changed or altered. Next, the url in Firefox or Safari for greenfrogmarket.com also will not resolve. Other domains using Cyberduck connect perfectly. Other websites using any browser resolve normally. Transmit also does not resolve the ftp connection using all the correct settings.

This same scenario has happened with three different internet connections. At first each internet connection works fine. Then upload files via ftp, then nothing works for the greenforgmarket.com domain on this computer. Other computers can view the site without a problem.

Attempted fixes:
Ran Onyx clearing internet caches, permissions, full routine. Used Software Update applying the appropriate updates including a Security update. Re-ran the 10.4.11 combo installer. No joy.

I do use a Belkin wireless usb device since my Airport card inside the iBook went bad. Don't think this is the problem since I tried an ethernet connection from the same internet source with the same results.

Any ideas? I'm in a bind since we have a big remodel project going at one of our stores and I am supposed to be doing frequent updates to our site.

Thanks in advance for any help.

Chris
Posted by: MacBozo

Re: Something Strange Going On... - 11/06/09 12:53 PM

Bad DNS server?
Posted by: Jim_

Re: Something Strange Going On... - 11/06/09 02:14 PM

Look in your HD/Library/Internet plug-ins folder. Do you see anything named QuickTime Plugin.xpt or plugin(s).settings? It's a DNS changer trojan.
Posted by: Jim_

Re: Something Strange Going On... - 11/06/09 02:18 PM

Originally Posted By: ChrisN
This same scenario has happened with three different internet connections. At first each internet connection works fine.
This is from the same machine?

To test Michael's DNS theory, if you don't have the files I mentioned above try putting 4.2.2.3 and/or 208.67.222.222 into your Domain Name Server settings in Network for the interface you're using.

Edit - In Terminal type "sudo crontab -l" (the letter L, and minus the quotes), hit Return, enter your password. It should return "crontab: no crontab for root". Anything else and your DNS settings have been compromised.
Posted by: carp

Re: Something Strange Going On... - 11/06/09 02:38 PM

Ghee

Not long ago someone told me that there is no virus or trojans for a Mac laugh
Posted by: Phosphor

Re: Something Strange Going On... - 11/06/09 02:57 PM

None that are self-installing, self-replicating and self-disseminating, Carp.
Posted by: Phosphor

Re: Something Strange Going On... - 11/06/09 03:03 PM

Originally Posted By: Reboot
[quote=ChrisN]To test Michael's DNS theory, if you don't have the files I mentioned above try putting 4.2.2.3 and/or 208.67.222.222 into your Domain Name Server settings in Network for the interface you're using.


While you're at it Chris, if you haven't before, have a thorough look at OpenDNS.com.
Posted by: starmillway

Re: Something Strange Going On... - 11/06/09 03:09 PM

Originally Posted By: carp
Ghee

Not long ago someone told me that there is no virus or trojans for a Mac laugh


They told you "no trojans"??? I'll send you a $100 bill if you can point out [link the thread in our forums] the poster/post who told you that!!!

wink - smile -
wink - smile -
wink - smile -
wink - smile -


.
Posted by: Jim_

Re: Something Strange Going On... - 11/06/09 03:28 PM

I'll double Kate's money if you can show me when I said no Trojans, and the DNS Changer is not a virus. I'm not going to pollute this thread by discussing this anymore, we've beat this horse already. Please do the same.

And what does clarified butter have to do with anything? crazy

Posted by: carp

Re: Something Strange Going On... - 11/06/09 03:38 PM

Originally Posted By: Phosphor
None that are self-installing, self-replicating and self-disseminating, Carp.


From Reboot
Quote:
It's a DNS changer trojan.


So are you saying that ChrisN installed it himself ?
Posted by: carp

Re: Something Strange Going On... - 11/06/09 03:43 PM

You can find it yourself - go for it buddy laugh

It was you who said there is no virus on the Mac , after I even posted a link to a virus article , which you said that even if the link called it a virus (there black and white) that YOU thought it was a minor trojan
Posted by: Jim_

Re: Something Strange Going On... - 11/06/09 04:05 PM

Originally Posted By: carp
Originally Posted By: Phosphor
None that are self-installing, self-replicating and self-disseminating, Carp.


From Reboot
Quote:
It's a DNS changer trojan.


So are you saying that ChrisN installed it himself ?
I don't know who all has access to his machine. If it's there the only way it could have got there is if someone typed a password and installed it. It happened to Kate, I believe she downloaded it from a site that she wanted to view a video at and it said she needed a video codec to view it. And I don't think Kate was viewing porn. blush It's also come from legit looking sites/links.
Posted by: ChrisN

Re: Something Strange Going On... - 11/06/09 04:18 PM

How about this one?

nsIQTScriptablePlugin.xpt

Chris

Posted by: ChrisN

Re: Something Strange Going On... - 11/06/09 04:32 PM

Yes, all the same machine.

Terminal:

crontab: no crontab for root

Thanks for the replies. This has me baffled.

Chris
Posted by: Phosphor

Re: Something Strange Going On... - 11/06/09 05:11 PM

That's a common plugin, Chris. You might want to check to see if you have the latest version, anyway.
Posted by: Phosphor

Re: Something Strange Going On... - 11/06/09 05:15 PM

Didn't that DNS changer also come wrapped up in some pirated iWorks suites offered on bit torrent servers, et al? I suppose if it was able to be bundled for install with an otherwise legitimate-appearing iWorks, it could be attached to any other installer's script, right?
Posted by: Jim_

Re: Something Strange Going On... - 11/06/09 05:34 PM

Originally Posted By: ChrisN
How about this one?

nsIQTScriptablePlugin.xpt

Chris

It's okay.

To try and see what may be happening open up Console app in the Utilities folder. Get to the Console log window by clicking logs and choose Console.log. Hit Clear to clear the text so we have a blank window. Then try the upload. Let's see if anything interesting comes up in the Console window around the time the connection fails to try and pinpoint where in the chain the link is dropping and see if it is the computer or something else.

Try flushing the DNS cache of the computer manually. In Terminal type lookupd -flushcache and hit Return, space between d and hyphen. Restarting "should" do it too but this will be good to run after the duck drowns to see if you then can get to http://greenfrogmarket.com. If that doesn't fix it I'd look into clearing the DNS cache of your router. Some have a setting to clear it, most you just power down the router, I'd say you've tried that though.

If you are using a router, if you bypass it and connect the Mac directly via Ethernet to the modem how does it go? You may need to power cycle the modem for it to see the new connection on the Mac. Those have their caches too BTW that a power cycle will clear. If your modem is ISP supplied with a built in router and you don't use a router of your own none of that will matter.

So the same problem happens with Transmit? Not clear if it does or if it just won't connect after Cyber Duck fails.

Even if it was a temporary drop of your ISP's signal it would break the FTP connection but it shouldn't affect the other apps, thinking out loud.

Do you have another machine at the same location to try it on? I was thinking it would actually be good if you had one to put into Target Disk mode to boot your machine from to see it if is a software problem, I'm doubting hardware. Use Ethernet or you'll have to install the USB driver.

Posted by: Jim_

Re: Something Strange Going On... - 11/06/09 05:42 PM

Originally Posted By: Phosphor
Didn't that DNS changer also come wrapped up in some pirated iWorks suites offered on bit torrent servers, et al? I suppose if it was able to be bundled for install with an otherwise legitimate-appearing iWorks, it could be attached to any other installer's script, right?
Legitimate appearing from a torrent? wink All bets are off when it's from there.

Yes, it could be attached but that's what's meant by download from only trusted sites, huh? It is a socially engineered trojan. They don't last long. Word spreads fast and since it's a trojan once the source is shut down it can't propagate anymore.
Posted by: ChrisN

Re: Something Strange Going On... - 11/06/09 07:32 PM

No Bit Torrent here or anything like that. No new sw or anything. Tried the suggested DNS numbers, no change.

This is weird. Expecting to hear the Twilight Zone music...

Chris
Posted by: Jim_

Re: Something Strange Going On... - 11/06/09 07:49 PM

Originally Posted By: ChrisN
No Bit Torrent here or anything like that. No new sw or anything. Tried the suggested DNS numbers, no change.

This is weird. Expecting to hear the Twilight Zone music...
LOL. Been there. Network stuff can be a real mind bender. So many places things can go wrong, but also traceable by eliminating different phases of the chain. Try everything else I suggested. Start with keeping Console open to try and see if the system is complaining about anything at the time the connection drops. Then next step I would suggest is go straight to the modem via Ethernet if you're using your own router.
Posted by: starmillway

Re: Something Strange Going On... - 11/06/09 08:48 PM


I clicked on a link i HuffPost and was redirected to a page that wanted me to let some program "fix" my "screwed up" drive, etc. It wouldn't let me quit the page, etc. I then tried to type in words in the url of the browser, but they would not finish or give me the list of suggestions, for example: mactech would not fill in http://fo rums.mactech.c om/ ubbthreads, etc. [without the spaces smile]

So the solution for me was to run DNSChanger Removal Tool.app which I still have but don't remember where I got it.





.
Posted by: Jim_

Re: Something Strange Going On... - 11/06/09 08:56 PM

You probably installed it long before you came to that page. It didn't do anything for a while and just chose the HuffPost click to fire off. The only way it got there was through some installer, just going to a page wouldn't install it.
Posted by: starmillway

Re: Something Strange Going On... - 11/06/09 10:20 PM


Well, I just know its gone! That's enough for my mind to gobble for now. Thanks smile

Posted by: ChrisN

Re: New Development - 11/07/09 09:22 AM

Another computer on one of the same networks can't resolve the greenfrogmarket.com domain. My desktop Mac also will not resolve the url. The only thing I can think of is that something is wrong on our webhost's end. Last Sunday GoDaddy had our site offline because of an automatic renewal that did not go through properly. That issue was resolved immediately and the site was back online within an hour. Later this week when I began uploading new files to the site via ftp is when this problem started occurring with some computers not being able to resolve the url. All other urls are fine and there are no other issues with the computers that would cause this problem.

The only thing hard for me to understand is why only some computers are having this trouble and everyone else can see the site, as far as I know.

Does this seem as though it must be a GoDaddy issue? I am going to call their tech support again to see what they can do. When on the phone with them the other day they said they can see the site just fine, of course. Trouble is, their online ftp app will not connect to the site from my computer. Their online file manager does not work properly with Safari or Firefox. At the moment I have no way to do website updates. Calling GoDaddy now...

Chris
Posted by: Jim_

Re: New Development - 11/07/09 09:36 AM

Originally Posted By: ChrisN
Does this seem as though it must be a GoDaddy issue?
Don't know. I've given a lot of suggestions, and asked questions about your router/modem setup, but you haven't replied to them, or mentioned if you have tried what I suggested. smile

What exactly is your hardware set up. Router, modem type, any hubs/switches. The first thing I would try is connecting straight to the modem from one computer, but that also depends on if the modem is also the router.
Posted by: ChrisN

Re: New Development - 11/07/09 01:50 PM

Tried the DNS numbers - no change (using the Open DNS numbers now -208.67.222.222 , 208.67.220.220), sudo crontab - came up fine, no strange plugins in the Internet Plugins folder.

At work now where the network is wireless with a so-called satellite isp. They beam the signal to a receiver on our roof from across town. The receiver has an ethernet cable running to the wireless router. Not sure what gear the receiver has in it. Not sure if I can plug in directly from the receiver ethernet cable and get a proper signal. I can go upstairs to the wireless router and plug in directly there. we do have decent tech support from our local isp if needed.

On this same network I just checked our domain from a co-workers computer with the same dead end result. Safari says "contacting"... and it goes nowhere until timing out. It seems as though each network where I have recently uploaded files to the domain gets bolloxed.

Working late today and go plug in at the router if that will help.

Thanks for the help, I do appreciate it.

Chris
Posted by: Jim_

Re: New Development - 11/07/09 02:33 PM

So this happens at two different locations too? Home and work?

If so it's got to be Go Daddy.
Posted by: MacBozo

Re: New Development - 11/07/09 02:42 PM

I was also thinking that it may be on the host's end of things. Are they port blocking?
Posted by: ChrisN

Re: New Development - 11/07/09 03:16 PM

That's what I thought too. But, of course, everything is fine on there end, so there is no problem. I spent an hour on the phone with their tech support and they did try a series of tests including megaproxy.com and the site shows up fine there.

What is weird is that when I tested the site at work yesterday before uploading files, it was resolving just fine. After uploading a few files I could not connect with browser or ftp. This problem only seems to be with networks I have used to upload files to the domain. I have looked at my html files on my computer and dl'd from the site - there is nothing in the html that should not be there.

Does greenfrogmarket.com load ok for you? I'm betting it does.

Scratching my head...

Chris
Posted by: MacBozo

Re: New Development - 11/07/09 03:26 PM

Loads up right quick.

Now, I'm beginning to think that there might be IP blocking going on? You upload and then that IP gets blocked? Just guessing here.
Posted by: Jim_

Re: New Development - 11/07/09 05:03 PM

Does it happen at both work and home?

You said two different networks so I assume yes, it happens with two different ISP's and/or accounts?
Posted by: ChrisN

Re: New Development - 11/07/09 07:53 PM

Yes, two different ISPs. One work and one at home.

Funny, they work fine until after uploading files to the domain while on each network.

Chris
Posted by: Jim_

Re: New Development - 11/07/09 08:23 PM

Originally Posted By: ChrisN
Yes, two different ISPs. One work and one at home.
Hmm, my money is it's nothing with your end. I'll see what happens from my end tomorrow.
Posted by: ChrisN

Re: Problem Fixed - 11/08/09 09:52 AM

Not sure how it got fixed, has to be something on GoDaddy' end. The domain now resolves properly. I just uploaded files via CyberDuck and we are still in business.

Maybe, they did some further investigation at GD after I called yesterday. I can't help but think something changed when our domain was off briefly a week ago that has now been corrected, whatever it was.

Thanks to Reboot for his generous offer to take the time to help troubleshoot this. I'm glad it is fixed and and was pretty sure that nothing had changed on my end.

Thanks to all you great responders!

Chris
Posted by: Jim_

Re: Problem Fixed - 11/08/09 10:06 AM

Had to have been something on their end since it happened from two different ISP's also.

Glad it's resolved anyway. cool
Posted by: ChrisN

Re: Problem Fixed - 11/08/09 10:41 AM

Me too. Whew!

Very frustrating and it points out how much I do not really know about how the world wide innertubes work under the hood. Funny, how we just expect things to work. This does kind of leave me with a bad taste for GD. Most of the domains and websites I manage are with other hosts and to be fair, they do have the occasional problem too.

Chris
Posted by: ctan

Re: Something Strange Going On... - 02/05/10 05:57 PM

Did you try the ftp and web browsers with the IP address directly? I see the IP, but it doesn't look like a dedicated IP. If you can get the IP URL you can attempt the same thing without using DNS and see what reults you get.

That should also help you track down if there is a DNS issue or not.