Browsing on a Windows XP computer doesn't work if website is on port 80 but is fine for port 443, 10000

Question

In a Windows XP computer suddenly browsers stop showing websites. While running procmon I noticed that I can easily go to websites running on port 443, port 10000 and port 9675 ( spiceworks ).

Also ping, nslookup, tracert work fine.

Trying telnet IP 80 doesn't work. But I can telnet to other TCP services like FTP/SMTP

This problem goes away once the computer is restarted. But it keeps cropping up randomly. How can I troubleshoot this?

Answer 1

This sounds like something is adding a firewall (or port filtering) entry. I assume your anti-virus software is up to date and you are running the latest patches etc.

It might be worth checking the firewall settings periodically, also you might want to check the application logs to see if a program has set a firewall entry on purpose.

Answer 2

There are a couple of things you could try from the problematic machine (if you haven't already):

1. Do a TCP/IP stack repair using:

   netsh int ip reset c:\resetlog.txt
   

2. Use netcat to connect to port 80 and do a HEAD/GET and check response.
3. Run wireshark when browsing to a site on port 80 and verify you are getting SYN/ACKs or whether atleast your SYNs are going through to the site.

4. Run the following and check port status:

   nmap -p80 -sT -vv -g34800 <remote-ip>
   

5. Use procmon and filter only Network Activity and attempt to browse to different sites, including those ones that are not on 80 and see if there is any difference in the captures.
6. Create another user and attempt to browse to the site.
7. Check system firewall, third party applications that might prevent communication on port 80.

My thoughts are inclined towards a possible malware infection that is preventing communication on port 80 of any site, quite possibly an outbound packet on port 80 > silent drop. If other systems on the network are able to access the Internet then you can bet it's a system issue.