I have purchased a new machine - http://www.ozbargain.com.au/node/61698
(upgraded to 1TB of HDD and 6GB of RAM).
Upon receiving the machine, it was without an OS (they had upgraded the OS from 500GB to 1TB), so the store gave me a burnt DVD of the install media (Windows x64 Home Premium). I went home, installed the OS and then connected it to my home network.
At this point, I was able to access the following:http://www.trendmicro.com.au/au/campaign/hc-register/64bit/?WT.mc_id=0912_housecall71_64downloadText_AU
(but see below)http://www.google.com.au/http://www.ozbargain.com.au/
etc etc (i.e. most sites)I was sometimes able to access the following:
http://www.avg.com.au/ (sometimes nothing, somethings top navigation header only, sometimes entire page)
http://windows.microsoft.com/en-AU/windows/products/security-essentials (but see below)
http://www.bleepingcomputer.com (some parts of some pages, some pages don't load at all)
I was not able to access the following:
http://go.microsoft.com/fwlink/?LinkID=231277 (download for Microsoft Security Essentials)
https://imperia.trendmicro-europe.com/machform/embed.php?id=149 (data entry form for download of HouseCall - inside of http://www.trendmicro.com.au/au/campaign/hc-register/64bit/?WT.mc_id=0912_housecall71_64downloadText_AU)
I was able to download and install Chrome and Firefox - they exhibited the same behaviour as IE.
As such, I was concerned that the machine was compromised. So I deleted the hard disk partitions and started again, checking to make sure that the machine was not connected to the Internet (no Ethernet cable connected).
So I did a second clean install (Windows 7 x64 Home Premium), then plugged in the Ethernet cable and tried again (i.e. there was no more than 10 seconds between when my machine was connected to the internet for the first time, and I retested the problem sites).
Exactly the same results (couldn't download MSE etc).
At this point I returned the machine to the store, explained the problem and asked them to reinstall the OS. I popped back (a week later, after some holidays) and picked up the machine. Prior to leaving the store I confirmed I could access http://www.trendmicro.com.au/au/campaign/hc-register/64bit/?WT.mc_id=0912_housecall71_64downloadText_AU
fully (including the data entry form). Thus I assumed the machine was clean when I took it home.
Upon getting it home, I have turned off all devices connected to the (WRT54GL running Tomato) router (XBox, other laptop, Android phone, iPhone) except for my (Linksys SPA3102) ATA. The router is connected to my cable modem (Motorola Surfboard).
I booted up the machine, and again - same problem. It was (seemingly?) working at the store, but not at home.
All of the above (problematic) links are working fine on my other laptop (connected to the same router with the same Ethernet cable).
On my (working laptop) I downloaded a number of utilities onto a USB stick, transferred them over and ran them to try and identify any problems. They are as follows:
* Microsoft Security Essentials - didn't find anything
* Kaspersky TDSSKiller - didn't find anything (http://www.bleepingcomputer.com/virus-removal/remove-tdss-tdl3-alureon-rootkit-using-tdsskiller
* Farbar Service Scanner - most files said MD5 was legit, except for afd.sys, tcpip.sys and dnsrslvr.dll (http://www.bleepingcomputer.com/forums/topic439019.html/page__p__2565396__hl__microsoft__fromsearch__1#entry2565396
* RKill - didn't find anything
* SUPER Anti Spyware (nothing except some tracking cookies)
There isn't any obvious malware under 'Programs and Features'. I can't see any obvious malware processes in Task Manager. The HOSTS file is entry (except for the default commented entries). Loading the PC in Safe Mode still has the same behaviour (e.g. can't access www.microsoft.com).
I am at a bit of a loss as to the best way to proceed. My obvious solution would be to nuke the partitions and start again, but I've tried that twice already.