IE6 Stops Working, Emails, Ping, Other ports just fine

[Neo Anderson]

My system: Windows 2000 Pro, Norton Internet Security 2004.

Every time I started to use IE6 for several page, it stopped working.
Error:

"The page cannot be displayed

The page you are looking for is currently unavailable. The Web site might be
experiencing technical difficulties, or you may need to adjust your browser
settings.....

Cannot find server or DNS Error Internet Explorer ".

However, I can ping "google.com" just fine with 0% loss; I can use Outlook
just fine to send/receive emails; I can access my local network files.

This shall be not a problem of my ISP, as I have tried under 3 different
ISPs including dialups, wireless, DSL.

I suspect that AOL could be causing this problem, as it only happened some
time after I installed AOL 9.0.

Use Netscape to browse, the error msg is "The connection was refused when
attempting to contact www.google.com".

Can only be fixed after I restart my computer, which will take 30 minutes:-(

Any help?? This is really boring and odd!!!

 

[Neo Anderson]

Forgot to mention one important aspect: I can even use IE to access any
secure https website, just not http. I also tried ftp.microsoft.com with IE
and it's fine.

Was using latest Windows 2000 SPs and IE patches. Also I tried to disable
Norton Internet Security and did not solve it.

Neo

 

[PA Bear]

Dealing with Trojans & Hijackware

A. Trojans

1. Check in at Windows Update and install all critical updates & reboot.

2. Download and run Stinger (http://vil.nai.com/vil/stinger/); then...

3. Update your virus definitions, enable Show Hidden Files
(http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2002092715262339)
and then run a full system scan in Safe Mode
(http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2001052409420406)
with nothing else running in background. Note the files identified and
removed then find the corresponding page for the file at your AV maker's
online support pages (e.g.,
http://securityresponse.symantec.com/avcenter/venc/data/adware.winfavorites.html)
and follow *all* Removal steps, including editing the Registry if directed.

WinXP Only (WinME similar): If this scan finds anything, create a new
Restore Point then:

Disk Cleanup > More options > Delete all but the most recent Restore
Point.

B. Hijackware

Help with Hijackware (MS MVP sites all)
http://aumha.org/a/parasite.htm
http://aumha.org/a/quickfix.htm
http://mvps.org/winhelp2002/unwanted.htm
http://inetexplorer.mvps.org/Darnit.htm
http://www.mvps.org/sramesh2k/Malware_Defence.htm

CoolWebSearch Chronicles
http://www.spywareinfo.com/~merijn/cwschronicles.html

Run these tools in the following order with nothing else running in
background:

1. CWShredder v1.59.1 (no updates available currently; fix all found)

2. Ad-Aware SE (reconfigure per Post #2 in
http://aumha.org/forum/viewtopic.php?t=5877; fix all found)

3. Spybot (RTFM but generally fix everything in red)

Important: You must seek updates for Ad-Aware, Spybot, etc., before each and
every use, even "right out of the box". But even they can't catch
everything, 24/7. When all else fails, HijackThis
(http://forum.aumha.org/downloads/hijackthis.zip) is the preferred tool to
use. It will help you to both identify and remove any hijackware/spyware.
**Post your files to http://forums.spywareinfo.com/ or
http://forum.aumha.org/viewforum.php?f=30 for expert analysis, not here.**

[Alternate download pages for many of the above tools may be found at
http://aumha.org/a/parasite.htm.]

So How Did I Get Infected Anyway?
http://boards.cexx.org/viewtopic.php?t=957

--
~Robear Dyer (PA Bear)
MS MVP-Windows (IE/OE), AH-VSOP

WinXP SP2: What's New for Internet Explorer and Outlook Express
http://www.microsoft.com/windowsxp/sp2/ieoeoverview.mspx

What You Should Know About Spyware
http://www.microsoft.com/athome/security/spyware/devioussoftware.mspx

AumHa Forums
http://forum.aumha.org

 

[Jan Il]

Hi Neo

Try the following and see if it helps:

If you are running programs like ad-ware, pop up killers, ect, that’s where
you look to fix your problem. Check your security settings there, set to
Medium or Low. Also, set IE6 security to medium.

also...

Can't display page (Server or DNS error) or "Internet Explorer could not
open the search page"
http://inetexplorer.mvps.org/answers.htm#dns

Error message: The page cannot be displayed
http://support.microsoft.com/default.aspx?scid=kb;EN-US;241344

Access denied to secure sites - Courtesy of Frank Saunders:

Make sure your firewall is not blocking port 443. See
<http://windows-help.net/WindowsXP/troub-10.html>
http://www.mvps.org/inetexplorer/answers2.htm#secure_sites
<http://www.mvps.org/inetexplorer/answers2.htm>
<http://www.mvps.org/inetexplorer/data/jjblack.htm>
HOW TO: Troubleshoot Situations Where You Cannot Connect to Secure Web Sites
by Using Internet Explorer in Windows XP
<http://support.microsoft.com/?kbid=813444>
"The Page Cannot Be Displayed" Error Message on a Secure Web Site
<http://support.microsoft.com/?kbid=303807>

Other information.......

http://service1.symantec.com/suppor...tml&header=no&nextgr=button_sub_next_step.gif
or
http://snipurl.com/90q3

or ......

Repairs the corrupted or altered (spyware) HTTP prefixes
http://mvps.org/winhelp2002/RepairDefaultPrefix.reg


If these steps do not resolve your problem, please post back to this thread
with the details and any error messages.

Hope this helps

Jan
Smiles are meant to be shared,
that's why they're so contagious.

Please reply to the newsgroup so others may benefit.
Replies are posted only to the newsgroup for the benefit or other readers.

How to make a good newsgroup post:
http://www.dts-l.org/goodpost.htm

 

[Neo Anderson]

Thanks a lot.

I tried the security settings. No luck.

Note my problem is that I CAN access https, but NOT http. Seems like port
80 got the problem. Port 443 shall be fine to me.

I have NIS and Google toolbar. Tried disabling them, no luck.

Of course my NIS is the latest version/data. I am confident that I shall
not have spyware/adware installed as I know Norton IS is very good against
them and I am always careful at installing any external software.

Yes, I tried these linked and none of works for me. My problem is that I
can use IE6 to browse internet every time I restarted windows. Then,
probably after I visited some websites, it would fail all together.

Neo!!!

 

[Robert Aldwinckle]

My problem is that I can use IE6 to browse internet every time

I restarted windows. Then, probably after I visited some websites,
it would fail all together.

Before trying to visit a site which you suspect will "fail" using IE,
use nslookup to verify that your DNS is finding the address
correctly and use ping -n 1 to make sure that the address that
IE would be using is the same as the one that nslookup is finding.
A contrary condition could occur if either your HOSTS file or your
dnscache is overriding with a different address. HOSTS can be
corrupted by malware, etc.

Here is a specific example from a previous reply
of the type of analysis you could do following that idea.
FYI the user I was replying to had already remarked
that when the problem occurred a different browser
showed the same symptom. Also, I describe how to use
telnet from an XP background. I don't know if W2K has
the same UI with its telnet command. I do know that NT4's
was different but could be adapted to provide similar results.

<excerpt>
What does nslookup show for that server name?

FWIW here is what mine shows if you need a comparison.

Non-authoritative answer:
Name: www.moac.org
Address: 69.57.179.170

Try ping -n 1 www.moac.org
(This is to test the address resolution not the connectivity.)
Does it show the same address being used?

If not you must be getting a wrong address from HOSTS
or from your OS dnscache. The latter is less likely but you need
to be aware of your dnscache if you make changes to your HOSTS.
E.g. try the following command pipeline:

ipconfig /displaydns | find /i "moac"

If that finds a entry before deleting an entry for moac from HOSTS
you would find the same entry after that until you entered:

ipconfig /flushdns


If the address resolution seems to be fine the next thing to do
is try to verify connectivity to that server without using IE.
E.g. if you have a different browser and it connects fine
your symptom has a completely different meaning than
if neither browser can connect.

If you don't have another browser you can check that there is
an open port 80 there and even simulate some of what IE does
using your telnet command.

E.g. enter: telnet www.moac.org 80
If the screen clears you have proof that there is a port 80 open.
Often at this point it is sufficient to enter GET /
(That's GET<space><slash><Enter>.)
Unfortunately, this particular site apparently requires more specificity
in our requests.

However, if you get that far rather than try to figure out a better
simulation you would probably be further ahead to assume that
your symptom has more to do with an error induced by an
AutoSearch hijacker. See others' posts for information on how
to check for and deal with that possibility.


HTH

Robert Aldwinckle

 

[Neo Anderson]

It is not working.

nslookup google.com

Server: nscache.prserv.net
Address: 165.87.13.129

Non-authoritative answer:
Name: google.com
Addresses: 216.239.39.99, 216.239.37.99, 216.239.57.99

telnet www.google.com 80

Connecting To www.google.com... Could not open a connection to host on port
80 :
Connect failed

telnet www.google.com 443

(blank screen)


Pinging www.moac.org [69.57.179.170] with 32 bytes of data:

Reply from 69.57.179.170: bytes=32 time=190ms TTL=49

Ping statistics for 69.57.179.170:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 180ms, Maximum = 190ms, Average = 185ms

nslookup moac.org

Server: nscache.prserv.net
Address: 165.87.13.129

Name: moac.org
Address: 69.57.179.170

PS My host file is perfectly fine and read only!

Neo!!!

 

[PA Bear]

And I /still/ say you've been hijacked!

Help with Hijackware
http://aumha.org/a/parasite.htm
http://aumha.org/a/quickfix.htm
http://mvps.org/winhelp2002/unwanted.htm
http://inetexplorer.mvps.org/Darnit.htm
http://www.mvps.org/sramesh2k/Malware_Defence.htm
--
~PA Bear

It is not working.

<snip>

 

[Neo Anderson]

I have Nortorn Intenet Security 2004 and Spybot installed. Nothing is
detected.

 

[Robert Aldwinckle]

It is not working.

The idea is to do an nslookup on the server name that you intend
to use with your browser. You are doing an nslookup on the domain
name, which you do not use with your browser.

The idea of the ping -n 1 is to find the IP address which your
TCP/IP services picked when resolving that server name.
In Windows there is the HOSTS file which can override that lookup.
In NT5 there is the dnscache which is initially populated by HOSTS
file entries but which then might also perpetuate old lookup values.

Connecting To www.google.com... Could not open a connection to host on port
80 :
Connect failed

It would have taken a few moments for that last message to be made.
During that time you could have switched to a second command window
and entered netstat -anop tcp to find out which IP address is being
used by the connection your telnet command created.

Note to non-XP lurkers: the o switch is an XP-only switch.
You should still be able to use the other three options in any
version of Windows.

(blank screen)

That's interesting. Have you tried using https:// as a protocol
prefix to get IE to connect with Google?

FWIW I just did that and discovered that Google then took
it as an opportunity to redirect me to a Canadian Google server
www.google.ca using http protocol. YMMV.

....

PS My host file is perfectly fine and read only!

Neo!!!

What you have proved is that something is blocking access
to that specific site for that specific port. Malware can do that.

I have recently become aware of the possibility of it modifying
the TCP/IP stack which most of my traditional diagnostics
would be oblivious of.

In XP we have some commands which let us check on this
possibility and possibly repair it. Apparently XPsp2 has added
even more command line repair capability. Here is an excerpt
from a recent reply about this. Please note that I have not had
any experience using these techniques and I am just telling you
about them to make you aware of them. For more knowledgeable
assistance I think you should try checking with an XP newsgroup
which specializes in networking.


The following was in reply to an XP user who could not connect
to download the WinsockFix.zip repair program.

<excerpt>

XPsp2 has a new netsh command which could substitute:

netsh winsock reset


You can also list what you have before doing that

netsh winsock show catalog


There is a related command

netsh interface ip reset resetlog.txt

(and associated show commands)


Do a Google Groups search for
netsh resetlog
to see what context others have used it and how they fared.


Good luck

Robert Aldwinckle

 

[Neo Anderson]

You are doing an nslookup on the domain
name, which you do not use with your browser.

I do want to access google.com and i can't.

if you mean the name server:

nslookup 12.127.16.83

Server: tmtu.mt.rs.els-gms.att.net
Address: 12.127.16.83

Name: tmtu.mt.rs.els-gms.att.net
Address: 12.127.16.83

Furthermore, I can't access the google.com using its ip addr in my browser.

 

[Robert Aldwinckle]

....

I do want to access google.com and i can't.

Then I don't think that that is an interesting question.
Why do you think that there would be an HTTP server there
using that name?

Also, if that is what you were trying to do then why didn't you show
the results of trying to use telnet with that name instead of the

telnet www.google.com 80

which you showed as your example?


Hmm... I have just done a netcap of IE trying http://google.com/
and it works fine but of course it redirects immediately to a real
HTTP server.

if you mean the name server:

....

No. I already agreed with you that the fact that telnet 443 can find
an open port proves that your DNS is not the issue.

FWIW I just tested lookups using both of the server addresses
you gave and don't see a problem with them doing lookups for
either the google domain name or its server names. Note though
that www.google.com is an alias for an Akamai server.


Did you experiment at all with those netsh commands I mentioned?
Notice that before committing to using a command that changes anything
you could use the netsh help functions and any of the show commands.

Oops. I just noticed the cross-post. I'm posting from ie6.browser.
So perhaps some of my suggestions won't apply to your OS
or you will have to adapt them. E.g. you might have netmon if your
OS is a server; otherwise use Ethereal (or some other third-party tool.)
I don't know if your TCP/IP stack can be queried but apparently
you might have some netsh functionality.

<title>KB242468 - How to Use the Netsh.exe Tool and Command-Line Switches</title>

(MSKB Boolean search for
netsh AND kbwin2000search
)


<title>KB148942 - How to Capture Network Traffic with Network Monitor</title>

(MSKB Boolean search for
netmon AND kbwin2000search
)


Good luck

Robert
---

 

[PA Bear]

With no offense intended and your handle notwithstanding, I would not
consider "nothing detected" to be the equivalent of an "All Clear", Neo.

If you're interested, I'll post additional suggestions but IMHO you cannot
say with any certainty that the machine is malware-free unless your
HijackThis v1.98.02 log, run in Safe Mode with 'Show Hidden Files' enabled,
passes the judgment of experts far-more experienced than Yours Truly.

 

[rusga]

Neo,

Ty installing Opera 7.54 (non java version) and see if you can surf. If
so, then it's IE that is cracked somehow.
Note: Disable javascript when surfing.

ADVICE: *DO NOT* accept:

a) Java
b) Javascript
c) VBscript
d) ActiveX (safe or unsafe including Flash)
e) Plugins

.... some other "features" should also be supressed, but these should be
enough for a less "wide open" surfing.
IE is known to be the door too all evil (I've tested it).
The best anti-virus you have is yourself and your administrative higien.

Best regards,
rusga

PS: As soon as you have Opera installed, stick to it.
PSS: ******* Remember, IE stands for Internet Exploiter ********

 

[Neo Anderson]

It's not IE. I have netscape installed and it can't either. I telnet port
80 and it didn't work.

 

[Steve G]

It's not IE. I have netscape installed

and it can't either. I telnet port
80 and it didn't work.

Just posting to let you know that you aren't alone. I get the same
thing -- but only after visiting certain sites, and only with a
certain browser.

Specifically, I am using Opera 7.5 -- and can browse around to most
sites (Yahoo, Google, etc) but EVERY TIME I load some sites (e.g.,
Orbitz.com, TheSmokingGun.com, etc.) something hozes my networking and
after that NO CLIENT (e.g., IE6, Mozilla, Telnet to port 80) can
access port 80 on ANY site thereafter. I don't remember if I tried
443 (https) but I do know that smtp, etc all still work fine even when
going out on 80 no longer functions. Also, with a still functioning
system I can access those same URLs using Mozilla or IE and I don't
have any problem. The combination of Opera hitting Orbitz will always
cause this.

The only way I've resolved it is to reboot and either use anything
other than Opera or continue using Opera (my favorite browser) and
just avoid the sites that have given me trouble in the past. I have
two machines running Win2K Pro and one does this while the other Win2K
machine does not. So something is goofy on my one machine, which I
plan to resolve by reformatting and installing WinXP Pro on.

But it is the strangest thing though, eh?

- Steve

 

[Robert Aldwinckle]

something is goofy on my one machine which I

plan to resolve by reformatting and installing WinXP Pro on

You should report your observations to your ISP.
It sounds just as likely that the failure is an intermittent one in their DNS
which all of the work you are proposing doing would not change at all.

FWIW I have the same symptom (only rarely). I'm on dial-up so the
only thing that I have to do to restore connectivity is hangup and redial.


HTH

Robert Aldwinckle

 

[Guest]

Thank you! Sometimes there aren't any quick fixes and we have to follow the
steps. Thanks for getting this one straightened out. I was really getting
frustrated reading all those other posts. Ugghhhh! A lot of patience and
methodical thinking can really pay off in this line of work.

Dealing with Trojans & Hijackware

A. Trojans

1. Check in at Windows Update and install all critical updates & reboot.

2. Download and run Stinger (http://vil.nai.com/vil/stinger/); then...

3. Update your virus definitions, enable Show Hidden Files
(http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2002092715262339)
and then run a full system scan in Safe Mode
(http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2001052409420406)
with nothing else running in background. Note the files identified and
removed then find the corresponding page for the file at your AV maker's
online support pages (e.g.,
http://securityresponse.symantec.com/avcenter/venc/data/adware.winfavorites.html)
and follow *all* Removal steps, including editing the Registry if directed.

WinXP Only (WinME similar): If this scan finds anything, create a new
Restore Point then:

Disk Cleanup > More options > Delete all but the most recent Restore
Point.

B. Hijackware

Help with Hijackware (MS MVP sites all)
http://aumha.org/a/parasite.htm
http://aumha.org/a/quickfix.htm
http://mvps.org/winhelp2002/unwanted.htm
http://inetexplorer.mvps.org/Darnit.htm
http://www.mvps.org/sramesh2k/Malware_Defence.htm

CoolWebSearch Chronicles
http://www.spywareinfo.com/~merijn/cwschronicles.html

Run these tools in the following order with nothing else running in
background:

1. CWShredder v1.59.1 (no updates available currently; fix all found)

2. Ad-Aware SE (reconfigure per Post #2 in
http://aumha.org/forum/viewtopic.php?t=5877; fix all found)

3. Spybot (RTFM but generally fix everything in red)

Important: You must seek updates for Ad-Aware, Spybot, etc., before each and
every use, even "right out of the box". But even they can't catch
everything, 24/7. When all else fails, HijackThis
(http://forum.aumha.org/downloads/hijackthis.zip) is the preferred tool to
use. It will help you to both identify and remove any hijackware/spyware.
**Post your files to http://forums.spywareinfo.com/ or
http://forum.aumha.org/viewforum.php?f=30 for expert analysis, not here.**

[Alternate download pages for many of the above tools may be found at
http://aumha.org/a/parasite.htm.]

So How Did I Get Infected Anyway?
http://boards.cexx.org/viewtopic.php?t=957

--
~Robear Dyer (PA Bear)
MS MVP-Windows (IE/OE), AH-VSOP

WinXP SP2: What's New for Internet Explorer and Outlook Express
http://www.microsoft.com/windowsxp/sp2/ieoeoverview.mspx

What You Should Know About Spyware
http://www.microsoft.com/athome/security/spyware/devioussoftware.mspx

AumHa Forums
http://forum.aumha.org

My system: Windows 2000 Pro, Norton Internet Security 2004.

Every time I started to use IE6 for several page, it stopped working.
Error:

"The page cannot be displayed

The page you are looking for is currently unavailable. The Web site might
be
experiencing technical difficulties, or you may need to adjust your
browser
settings.....

Cannot find server or DNS Error Internet Explorer ".

However, I can ping "google.com" just fine with 0% loss; I can use
Outlook
just fine to send/receive emails; I can access my local network files.

This shall be not a problem of my ISP, as I have tried under 3 different
ISPs including dialups, wireless, DSL.

I suspect that AOL could be causing this problem, as it only happened some
time after I installed AOL 9.0.

Use Netscape to browse, the error msg is "The connection was refused when
attempting to contact www.google.com".

Can only be fixed after I restart my computer, which will take 30
minutes:-(

Any help?? This is really boring and odd!!!

 

[googlegroups]

I think I found the culprit.

The Norton Anti-Virus (NAV) "Common Client Network Proxy Service" (
ccProxy.exe ) from Symantec dies. It happens for me when using Opera
7.5x against certain web sites ... (including groups-beta.google.com
interestingly enough <g>).

There are tons of newsgroup and other forum messages with users
reporting the same problem.

I don't know if the problem is NAV or Opera, but the combination is
what will cause the problem to rear up for me. Maybe they will figure
out the problem ... but in the meantime I modified the service
configuruation (recovery) to restart on all failures.

 

[Guest]

hi Neo

Did you ever find a solution that worked to your problem? I have seen so
many other people with this problem on this newsgroup (it seems to be by FAR
the most commonly reported issue on this newsgroup) but as yet I havent seen
anyone say it fixed there problem. My suspicion is that most people are
giving up and reinstallking their entire operating system as the only option.

Do let me know. I want to raise the profile of this issue, as I dont believe
Microsoft are proving a proper resoltuion for all the damaged IE6 users
damaged by the numerous vuilnerablilities that they've at least admitted to .

Do post back and let me know?

Kind Regards,

Diom
(yet another user with intermittent DNS server errors in IE6)h

You are doing an nslookup on the domain
name, which you do not use with your browser.

I do want to access google.com and i can't.

if you mean the name server:

nslookup 12.127.16.83

Server: tmtu.mt.rs.els-gms.att.net
Address: 12.127.16.83

Name: tmtu.mt.rs.els-gms.att.net
Address: 12.127.16.83

Furthermore, I can't access the google.com using its ip addr in my browser.