Windows Server 2003 - unable to browse using IE or Firefox

Open a command prompt on the server console and do an nslookup of some outside host like www.microsoft.com:

C:\>nslookup
Default Server:  yourdnsserver.yourdomain.com
Address:  192.168.10.10
> set type=A
> www.microsoft.com.
Server:  yourdnsserver.yourdomain.com
Address:  192.168.10.10
Non-authoritative answer:
Name:    lb1.www.ms.akadns.net
Addresses:  207.46.193.254, 207.46.192.254
Aliases:  www.microsoft.com, toggle.www.ms.akadns.net
         g.www.ms.akadns.net
> 

Does it resolve www.microsoft.com ok?  If so, try browsing to http:// and the IP address instead of the hostname (http://207.46.193.254 in this example).  Does that work?

If nslookup fails the lookup of www.microsoft.com you have a DNS configuration problem.

The DNS server on my network. All of the other machines on the network have no difficulty resolving external hosts. In fact, in Firefox, I can see the status bar displaying "Waiting for http://www.cnn.com", but then a window comes up and says "The document contains no data". This makes me think that it isn't a DNS issue. Also the fact that I can use tracert from a command prompt and have the host correctly resolved.

I changed my DNS server on the machine to an outside provider and tried the nslookup command. The output is as follows:

Server:  dns-nb00.aliant.net
Address:  198.164.30.2

Non-authoritative answer:
Name:    lb1.www.ms.akadns.net
Addresses:  207.46.19.254, 207.46.19.190
Aliases:  www.microsoft.com, toggle.www.ms.akadns.net
          g.www.ms.akadns.net

Do you get the same result with nslookup if you do *not* change the DNS server to the outside provider?  You need to do an ipconfig /flushdns first, then do the nslookup from the inside DNS server.  What happens if you browse to the IP address instead of www?

I can still resolve to the 207.46.19.254 address with my internal DNS server.

Browsing to the IP address results in the same alert dialog - "The document contains no data"

No difference with the inside DNS server after ipconfig /flushdns.

Browsing computers, files and folders under my network places is done by the browser service. The browser service is populated by netbios broadcasts.

You have a problem with netbios.

So many things can cause this issue. Please provide a IPconfig /all on your DC. Let's check for a multihomed DC, also the node type and make sure netbios is enabled, as well as "file and printer sharing".

Once done. I would look into the firewall blocking Netbios transactions.

Most likely your TCP/IP stack is broken, I know you have tried netsh but you need to reset it, give this a go.

http://support.microsoft.com/default.aspx?kbid=299357

ChiefIT: I don't have trouble browsing objects inside my network, only browsing the Internet.

do you have a firewall or a router with access-lists.
can you check if there is any restrictions to port 80 or http.

CCEF Guy:

http://support.microsoft.com/default.aspx?kbid=299357 didn't help.

kak1004:
No access list on my network.

Hmm, why did I get that backwards.

Simple, but can be a problem.

Have you checked your default gateway??

What is the specific error when you use IE (not Firefox)?

ChiefIT:

Gateway is correct and logical - nslookup and tracert both work correctly.

IT-Monkey-Dave:

Internet Explorer cannot display the webpage
   
   What you can try:
     You are not connected to the Internet. Check your Internet connection  
 
     Retype the address.  
 
     Go back to the previous page.  
 
   Most likely causes:
"You are not connected to the Internet.
"The website is encountering problems.
"There might be a typing error in the address.

Is this a multihomed server?

Sorry to keep asking questions but...  Can you telnet from this server into a public web server on port 80?

telnet www.somedomain.com 80

ChiefIT:

No.

IT-Monkey-Dave:

What should I see when I do? I'm getting a blank black screen with a cursor top-left of command window when I try:

telnet www.cnn.com 80

I did a fresh install of Opera to see what would happen - it doesn't work either...

Type NSlookup www.google.com

If it stops at the router, you are denied at the router.

It may stop at your router. If so, you have either a Deny for accessing outside web sites and that is defined on the router. If Cisco, that would be an access-list 10 IPaddress deny.

Another problem I recently ran into is, (believe it or not), you may have run out of licenses for your router. Watchgaurd Firebox routers have a 30 user limit:
http://www.experts-exchange.com/OS/Microsoft_Operating_Systems/Windows/XP/Q_24649657.html

One last thing:

Also try Safemode with Network support. That will use the generic NIC drivers from Microsoft.

You may have a driver hosed up. I have seen that before.

The telnet test is to see if you successfully connect to the remote server on port 80, which the browser uses.  If you telnet in and enter an invalid command like "quit" you should get some html gibberish message back that at least confirms you did connect to the server on that port.

I'm running out of ideas...

do you have a hardware firewall that blocks this machine from getting out to the 'net based on IP range?

IT-Monkey-Dave:

Me too, that's why I came to experts-exchange.com :)

jasonthomas3000:

No.

TCPIP.sys my be messed up. You could try to run SFC /scannow.

Also I have seen it where an IP conflict does weird things. Go to the command prompt and type NBTSTAT -a xxx.xxx.xxx.xxx  (where xxx.xxx... is your IP).

Furthermore, I really think this problem may be on the router. Did you find anything out using NSlookup?

ChiefIT:

Thank you for your suggestions. SFC /scannow didn't change anything.

Results of NBTSTAT:

Local Area Connection:
Node IpAddress: [192.168.2.19] Scope Id: []

           NetBIOS Remote Machine Name Table

       Name               Type         Status
    ---------------------------------------------
    SERVER2000     <00>  UNIQUE      Registered
    FAS            <1C>  GROUP       Registered
    FAS            <00>  GROUP       Registered
    SERVER2000     <20>  UNIQUE      Registered
    FAS            <1B>  UNIQUE      Registered
    FAS            <1E>  GROUP       Registered
    FAS            <1D>  UNIQUE      Registered
    ..__MSBROWSE__.<01>  GROUP       Registered

    MAC Address = 00-0C-6E-8C-D3-A0

This issue persists between networks, i.e. I have moved the machine from a client site to my office, with no mitigation. All other machines on both networks are able to browse the internet.

NSLOOKUP previously tried in this thread:

I changed my DNS server on the machine to an outside provider and tried the nslookup command. The output is as follows:

Server:  dns-nb00.aliant.net
Address:  198.164.30.2

Non-authoritative answer:
Name:    lb1.www.ms.akadns.net
Addresses:  207.46.19.254, 207.46.19.190
Aliases:  www.microsoft.com, toggle.www.ms.akadns.net
          g.www.ms.akadns.net

Thanks!

Starting the server in Safe Mode with Networking the browsers work.

This appears to be a malware infection of some sort - now I have to determine which one...

Let's check one more thing prior to concluding it is a malware infection:

Go to the command prompt and type>

Net config redir

Or was it

Net server redir

This will list the bindings that netbios is bound to. If it is bound to the wrong binding, (let's say on a NIC that was disabled), you will not be able to start netbios.

_____________________________
As far as a malware infection: The first that comes to mind is the conficker worm. This has the ability to shut down services. It also uses the RPC service to infect all clients and servers on the network using admin credentials. Furthermore, it knocks down your ability to go to certain web sites and download Windows updates, or AV tools to remove it. If you only have access to select sites, may I recommend going to malwarebytes site and see if you can get that. It detects conficker. Symmantec just released a conficker removal tool. No One beatse Symmantec's removal tools, in my opinion. You might have to download it on another machine and run it. Pay attention to the removal details on Symmantec's site.

If you suspect conficker/downadup, I also recommend immediately isolating that machine from the network by unplugging the cord!!! It's nasty Joo-Joo to have that accessible to your network.

I've resorted to re-installing the O/S - I've run out of time for this issue as the machine needs to be back in service ASAP.

I tried ad-aware, spybot search & destroy and AVG 8.5 - none of them saw any infection.

I'm presently installing all of the updates to this machine.

Thanks to all for the suggestions!

Andrew

This is a NIC driver issue:

You might have IPsec on the NIC driver. I have seen this before.

Or you might consider uninstalling and reinstalling the NIC driver.

No IPsec on the NIC.

Uninstalling and Reinstalling NIC - no benefit.

O/S reinstalled, all working now.

You did this off a repair install??