Some web pages not opening at all!

[Scott]

Hi all!
Long time reader, first time poster.
Over the last few days I've been having trouble displaying certain web pages
and thought that the server hosting them must be down.
The first is www.btconnect.com and the 2nd is www.kubeonline.com
I found out that it is not the server as friends of mine can access both
these sites without problems.
Any idea what is going on?
It all started one morning when I came to work and tried to get my email
only to have it stick at number 3 of 80. I had set the server timeout at 300
seconds but this still didn't help as I still got server timeouts. I'm on
broadband so don't understand this at all!
After this happened, I tried to get my mail through web based email but, as
I'm sure you've worked out dear reader, that didn't pan out too well.
I've tried uninstalling explorer and reinstalling and even tried using msn
explorer but to no avail. Will a reinstallation of Windows help with this
problem (though I am hoping someone can advise on something a little easier
and less time consuming) or am I going to have to wipe the pc altogether?

Thanks for any help given no matter how small

Scott

 

[Chuck]

Hi all!
Long time reader, first time poster.
Over the last few days I've been having trouble displaying certain web pages
and thought that the server hosting them must be down.
The first is www.btconnect.com and the 2nd is www.kubeonline.com
I found out that it is not the server as friends of mine can access both
these sites without problems.
Any idea what is going on?
It all started one morning when I came to work and tried to get my email
only to have it stick at number 3 of 80. I had set the server timeout at 300
seconds but this still didn't help as I still got server timeouts. I'm on
broadband so don't understand this at all!
After this happened, I tried to get my mail through web based email but, as
I'm sure you've worked out dear reader, that didn't pan out too well.
I've tried uninstalling explorer and reinstalling and even tried using msn
explorer but to no avail. Will a reinstallation of Windows help with this
problem (though I am hoping someone can advise on something a little easier
and less time consuming) or am I going to have to wipe the pc altogether?

Thanks for any help given no matter how small

Scott

Scott,

Do an NS Lookup for the web pages with problems, using either of the following:
<http://www.all-nettools.com/toolbox>
<http://www.dnsstuff.com/>

Once you have ip addresses for each web site:
1) Browse by name;
2) Browse by ip address;
3) Ping by name;
4) Ping by ip address.

Report back here success / failure (and exact text of error) of each of the 8
tests. Once we know that, we can decide what to check next.

Cheers,
Chuck
Paranoia comes from experience - and is not necessarily a bad thing.

 

[Scott]

Scott,

Do an NS Lookup for the web pages with problems, using either of the following:
<http://www.all-nettools.com/toolbox>
<http://www.dnsstuff.com/>

Once you have ip addresses for each web site:
1) Browse by name;
2) Browse by ip address;
3) Ping by name;
4) Ping by ip address.

Report back here success / failure (and exact text of error) of each of the 8
tests. Once we know that, we can decide what to check next.

Cheers,
Chuck
Paranoia comes from experience - and is not necessarily a bad thing.

Test results are as follows:

ns lookup
Name: www.btconnect.com
Address: 193.113.209.25
Name: www.btconnect.com
Address: 193.113.209.8

1) Browse by name; at bottom of browser says done but no page loaded
2) Browse by ip address; takes me to an MSN search
3) Ping by name; Host unreachable
4) Ping by ip address. No results - says done at bottom of page


Name: www.kubeonline.com
Address: 194.46.8.82


1) Browse by name; takes me to an MSN search
2) Browse by ip address; takes me to an MSN search
3) Ping by name; 4 packets transmitted, 4 packets received, 0% packet loss
Host reachable, average round-trip time: 105.096 ms
4) Ping by ip address. 4 packets transmitted, 4 packets received, 0%
packet loss
Host reachable, average round-trip time: 102.729 ms

Thanks, Scott

 

[Chuck]

Test results are as follows:

ns lookup
Name: www.btconnect.com
Address: 193.113.209.25
Name: www.btconnect.com
Address: 193.113.209.8

1) Browse by name; at bottom of browser says done but no page loaded
2) Browse by ip address; takes me to an MSN search
3) Ping by name; Host unreachable
4) Ping by ip address. No results - says done at bottom of page


Name: www.kubeonline.com
Address: 194.46.8.82


1) Browse by name; takes me to an MSN search
2) Browse by ip address; takes me to an MSN search
3) Ping by name; 4 packets transmitted, 4 packets received, 0% packet loss
Host reachable, average round-trip time: 105.096 ms
4) Ping by ip address. 4 packets transmitted, 4 packets received, 0%
packet loss
Host reachable, average round-trip time: 102.729 ms

Thanks, Scott

Scott,

OK, I use VisualRoute
<http://www.visualware.com/redirection/support.html#visualroute>, which tells
me:

Report for www.btconnect.com [193.113.209.8]

Analysis: Connections to HTTP port 80 on host 'www.btconnect.com'
[www1.btconnect.com] are working, but ICMP packets are being blocked past
network "IP Pools" at hop 20. It is a HTTP server (running Zeus/4.2).

This agrees with your "Host unreachable".

I'm betting you have a browser hijack, or maybe Winsock corruption.

How current is your virus protection? Try one or more of these free online
virus scans:
<http://www.bitdefender.com/scan/license.php>
<http://www.pandasoftware.com/activescan/com/activescan_principal.htm>
<http://www.ravantivirus.com/scan/>
<http://security.symantec.com/ssc/home.asp>
<http://housecall.trendmicro.com/housecall/start_corp.asp>

Now check for, and learn to defend against, additional carriers of infection.

First, download LSP-Fix and WinsockXPFIx from <http://www.cexx.org/lspfix.htm>,
and CWShredder from <http://www.majorgeeks.com/download4086.html>. All are
free.

Next, close all Internet Explorer and Outlook windows, then run CWShredder.
Have it fix all.

Now check for, and remove, spyware. Get HijackThis
<http://www.majorgeeks.com/download.php?det=3155> and Spybot S&D
<http://www.safer-networking.org/index.php?page=download>. Both free.
1) Install and run Spybot. First update it ("Search for updates"), then run a
scan ("Check for problems"). Trust Spybot, and make all recommended deletions.
2) Install and run HijackThis. Do NOT make any changes immediately. Save the
HJT Log. <http://forums.spywareinfo.com/index.php?showtopic=227>
3) Have your HJT log interpreted by experts at one or more of the following
forums (and post it, or a link to your forum post, here):
<http://forums.net-integration.net/>
<http://forums.spywareinfo.com/>
<http://spywarewarrior.com/index.php>
<http://forums.tomcoyote.org/>
<http://www.wilderssecurity.com/>

If removal of any spyware affects your ability to access the internet (some
spyware builds itself into the network software, and its removal may damage your
network), run LSP-Fix and / or WinsockXPFIx.

If no result from the spyware checking, try LSP-Fix / WinsockXPFix.
http://support.microsoft.com/?kbid=811259

Cheers,
Chuck
Paranoia comes from experience - and is not necessarily a bad thing.

 

[Scott]

Scott,

OK, I use VisualRoute
<http://www.visualware.com/redirection/support.html#visualroute>, which tells
me:

Report for www.btconnect.com [193.113.209.8]

Analysis: Connections to HTTP port 80 on host 'www.btconnect.com'
[www1.btconnect.com] are working, but ICMP packets are being blocked past
network "IP Pools" at hop 20. It is a HTTP server (running Zeus/4.2).

This agrees with your "Host unreachable".

I'm betting you have a browser hijack, or maybe Winsock corruption.

How current is your virus protection? Try one or more of these free online
virus scans:
<http://www.bitdefender.com/scan/license.php>
<http://www.pandasoftware.com/activescan/com/activescan_principal.htm>
<http://www.ravantivirus.com/scan/>
<http://security.symantec.com/ssc/home.asp>
<http://housecall.trendmicro.com/housecall/start_corp.asp>

Now check for, and learn to defend against, additional carriers of infection.

First, download LSP-Fix and WinsockXPFIx from

and CWShredder from <http://www.majorgeeks.com/download4086.html>. All are
free.

Next, close all Internet Explorer and Outlook windows, then run CWShredder.
Have it fix all.

Now check for, and remove, spyware. Get HijackThis
<http://www.majorgeeks.com/download.php?det=3155> and Spybot S&D
<http://www.safer-networking.org/index.php?page=download>. Both free.
1) Install and run Spybot. First update it ("Search for updates"), then run a
scan ("Check for problems"). Trust Spybot, and make all recommended deletions.
2) Install and run HijackThis. Do NOT make any changes immediately. Save the
HJT Log. <http://forums.spywareinfo.com/index.php?showtopic=227>
3) Have your HJT log interpreted by experts at one or more of the following
forums (and post it, or a link to your forum post, here):
<http://forums.net-integration.net/>
<http://forums.spywareinfo.com/>
<http://spywarewarrior.com/index.php>
<http://forums.tomcoyote.org/>
<http://www.wilderssecurity.com/>

If removal of any spyware affects your ability to access the internet (some
spyware builds itself into the network software, and its removal may damage your
network), run LSP-Fix and / or WinsockXPFIx.

If no result from the spyware checking, try LSP-Fix / WinsockXPFix.
http://support.microsoft.com/?kbid=811259

Cheers,
Chuck
Paranoia comes from experience - and is not necessarily a bad thing.

Cheers. Hopefully someone can let me know

http://forums.spywareinfo.com/index.php?act=ST&f=18&t=7318

Scott

 

[Chuck]

Cheers. Hopefully someone can let me know

http://forums.spywareinfo.com/index.php?act=ST&f=18&t=7318

Kewl. A 5 hour response at SWI Forums. Maybe things are improving.

About:blank and MyWay / MyWebSearch. Not good. Resilient code.

Cheers,
Chuck
Paranoia comes from experience - and is not necessarily a bad thing.

 

[Scott]

Kewl. A 5 hour response at SWI Forums. Maybe things are improving.

About:blank and MyWay / MyWebSearch. Not good. Resilient code.

Cheers,
Chuck
Paranoia comes from experience - and is not necessarily a bad thing.

New log

Logfile of HijackThis v1.97.7
Scan saved at 10:51:37, on 17.06.2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\mHotkey.exe
C:\WINDOWS\System32\igfxtray.exe
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\Altnet\Points Manager\Points Manager.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\System32\rundll32.exe
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\AIM95\aim.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
C:\Program Files\PeerGuardian_1.99pr7\PeerGuardian_1.99b_pr7.exe
C:\Program Files\Palm\HOTSYNC.EXE
C:\Program Files\Messenger\msmsgs.exe
C:\PROGRA~1\Altnet\DOWNLO~1\asm.exe
C:\WINDOWS\System32\P2P Networking\P2P Networking.exe
C:\Documents and Settings\Andy\Desktop\New Folder\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
http://www.freeserve.co.uk
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,Shellnext =
wmplayer.exe
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program
Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {243B17DE-77C7-46BF-B94B-0B5F309A0E64} - C:\Program
Files\Microsoft Money\System\mnyside.dll
O2 - BHO: (no name) - {4A2AACF3-ADF6-11D5-98A9-00E018981B9E} - C:\Program
Files\NewDotNet\newdotnet6_30.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} -
C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} -
C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: MSN Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} -
C:\Program Files\MSN Toolbar\01.01.1629.0\en-gb\msntb.dll
O4 - HKLM\..\Run: [CHotkey] mHotkey.exe
O4 - HKLM\..\Run: [DSL Connection Manager] C:\Program
Files\INTEL\DSLSetup\ProDsl.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [AltnetPointsManager] C:\Program Files\Altnet\Points
Manager\Points Manager.exe -s
O4 - HKLM\..\Run: [ccApp] C:\Program Files\Common Files\Symantec
Shared\ccApp.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [New.net Startup] rundll32
C:\PROGRA~1\NEWDOT~1\NEWDOT~2.DLL,NewDotNetStartup -s
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program
Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [Microsoft Works Update Detection] c:\Program
Files\Microsoft Works\WkDetect.exe
O4 - HKCU\..\Run: [AIM] C:\PROGRA~1\AIM95\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe"
/background
O4 - HKCU\..\Run: [Symantec NetDriver Monitor]
C:\PROGRA~1\Symantec\LIVEUP~1\SNDMon.EXE
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - Startup: HotSync Manager.lnk = C:\Program Files\Palm\HOTSYNC.EXE
O4 - Startup: Shortcut to msmsgs.lnk = C:\Program Files\Messenger\msmsgs.exe
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program
Files\InterVideo\Common\Bin\WinCinemaMgr.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft
Office\Office10\OSA.EXE
O4 - Global Startup: PeerGuardian.lnk = C:\Program
Files\PeerGuardian_1.99pr7\PeerGuardian_1.99b_pr7.exe
O9 - Extra button: AIM (HKLM)
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O9 - Extra button: Real.com (HKLM)
O9 - Extra button: Money Viewer (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Messenger (HKLM)
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O12 - Plugin for .spop: C:\Program Files\Internet
Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.freeserve.co.uk
O16 - DPF: ppctlcab - http://www.pestscan.com/scanner/ppctlcab.cab
O16 - DPF: Ulster Bank AnyTime -
https://anytime2.ulsterbank.com/asp/AnyTime.cab
O16 - DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} (Microsoft Office Template
and Media Control) - http://office.microsoft.com/templates/ieawsdc.cab
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) -
http://www.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX
Control) - http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus
scanner) -
http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {2FC9A21E-2069-4E47-8235-36318989DB13}
(PPSDKActiveXScanner.MainScreen) -
http://www.pestscan.com/scanner/axscanner.cab
O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) -
http://www.cult3d.com/download/cult.cab
O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} -
http://a1540.g.akamai.net/7/1540/52...pple.com/abarth/us/win/QuickTimeInstaller.exe
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) -
http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37965.5158217593
O16 - DPF: {A7EA8AD2-287F-11D3-B120-006008C39542} (CBSTIEPrint Class) -
http://offers.brightstreet.com/cif/download/bin/actxcab.cab
O16 - DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} (Symantec RuFSI Registry
Information Class) -
http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) -
http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {E82ED244-76EF-4D34-BDB3-AB21A522F38E} (webhelper Class) -
http://www.btconnect.com/public/home/download/btbconnectwebcontrol013.cab
O17 -
HKLM\System\CCS\Services\Tcpip\..\{B0436F63-C9B5-4452-9641-E6386BC73CDB}:
NameServer = 194.72.6.51 194.72.6.52

Thanks for all your help, Chuck
It was really appreciated!
Scott

 

[Chuck]

On Thu, 17 Jun 2004 10:53:06 +0100, "Scott"

<SNIP HJT Log etc>

Dude, you've got NewDotNet. Yuck. Get rid of it.

O2 - BHO: (no name) - {4A2AACF3-ADF6-11D5-98A9-00E018981B9E} - C:\Program
Files\NewDotNet\newdotnet6_30.dll
O4 - HKLM\..\Run: [New.net Startup] rundll32
C:\PROGRA~1\NEWDOT~1\NEWDOT~2.DLL,NewDotNetStartup -s
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net

Cheers,
Chuck
Paranoia comes from experience - and is not necessarily a bad thing.