Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm having a really, really weird issue with one of the Windows 7 laptops in our office.

When it connected to our office network (either by WiFi or cabled connection), everything except browsing the web works fine. It can receive emails via Exchange, initiate VPNs, copy files, connect to network resources, it can ping websites (like google, etc), nslookupis fine. But if you open up a web browser, forget about it. Everything just times out.

If I connect the laptop to our guest network (which sits on an isolated vlan, but uses the same gateway as the office network), everything is fine (except obviously you can't access office network resources).

Sometimes the problem goes away after a restart, sometimes it doesn't. Sometimes it goes away on its own after 24 hours, sometimes it doesn't.

A wireshark trace looks like this:

enter image description here

A firewall trace looks like this:

enter image description here

The interesting thing here is that I'm attempting to connect to directly (which is the home page of the browser). Its IP addresses are:


These are not the IP addresses showing up in the firewall. The IP addresses in the firewall line up with


wget looks like this:

--2012-05-18 08:49:39--
Connecting to||:80... failed: Connection timed out.
Connecting to||:80... failed: Connection timed out.
Connecting to||:80... failed: Connection timed out.

This is just really, really weird. It's isolated (at the moment) to just this machine, regardless of which network port or IP address it has. Any ideas?

share|improve this question
Is everything slow however (your emails, etc.)? – George May 17 '12 at 22:29
Which browser is used? Does it also happen with a wget-like tool? – Sašo May 17 '12 at 22:35
@Sašo - even wget times out; I've updated the question with the output. – Mark Henderson May 17 '12 at 22:50
@George - not that I've noticed, but it is possible – Mark Henderson May 17 '12 at 22:51
The reason I was asking is sometime the simplest solution is to run Malwarebytes and/or Spybot. That's why I was asking. – George May 17 '12 at 22:54
up vote 2 down vote accepted

If the problem is malware related, the simplest way to solve it is to run ComboFix, which is basically just a bunch of malware removal programs bundled into one. It's pretty much the antimalware equivalent of carpet bombing everything.

Note: While I personally have no bad experiences with it, ComboFix is extremely aggressive and can end up making things worse. Generally I only use it when other software fails me.

share|improve this answer
This put me on the right track. A malware search returned nothing, but the edge firewall was reporting false positives on some AJAX sessions and blocking all HTTP outbound connections. – Mark Henderson May 21 '12 at 7:53

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.