Can't get to just one site....

mtroxmtrox Minnesota
edited August 2006 in Science & Tech
I have an Win XP workstation that can’t get to one, just one website, “http://www.co.hennepin.mn.us/”.

If I plug my laptop into that cable modem I can get there. I checked:
  1. hosts file
  2. restricted sites
  3. deleted all cookies
  4. ipconfig /flushdns
  5. all security settings in IE are default
  6. Booted in safe mode (no Zone Alarm and no Norton)
  7. Uninstalled ZA (though there was nothing in the logs that was blocked that day) and used the Win Firewall
  8. Made a new user, same result.

If there is any spyware I sure don’t see it. Clean machine, and I can tell from the history it doesn’t really get around to anything risky. And I can’t imagine spyware keeping me from going to the web site for the county for Minneapolis.

What else could give me a “page cannot be displayed” for just one URL?

Comments

  • primesuspectprimesuspect Beepin n' Boopin Detroit, MI Icrontian
    edited July 2006
    if you go to a command prompt and ping www.co.hennepin.mn.us, what do you get? Does it resolve the IP or does it say "unknown host"?

    This will help determine whether its a transport problem or a name resolution problem.
  • edcentricedcentric near Milwaukee, Wisconsin Icrontian
    edited July 2006
    For some reason the address isn't being resolved, turned from a URL into a numeric address. As I recall there is a way to look these up. Then you enter the numeric address.
    I have trouble with one of our servers here from time to time. These things go through a series of handoffs to get done.
    I can't think of any local action that would block a specific address.
  • mtroxmtrox Minnesota
    edited August 2006
    OK, she's across town so I'm doing a lot of this by phone. I told her to write down other sites she can't get to. Here's what I found.
    1. She pings www.co.hennepin.mn.us and it resolves 204.73.55.3
      If she plugs that address into a browser she gets "Page cannot......"
    2. She pings mvelopes.com and it resolves 68.142.133.168
      If she plugs that address into a browser she gets the site, but cannot get there by URL
    3. If she pings simpleplanning.net it resolves 205.178.145.65
      She can't get there by URL or by plugging the IP address into a browser. But then I can get there by URL but not by IP address

    I can get to all of these on a healthy computer. And again, I got to the first one, the www.co.hennepin.mn.us using her cable modem so it's something in her computer.

    Appreciate the help!

    edcentric wrote:
    As I recall there is a way to look these up. Then you enter the numeric address.

    I'm sure you're thinking of "nslookup" edcentric.
  • TroganTrogan London, UK
    edited August 2006
    Check the Hosts file.
  • RWBRWB Icrontian
    edited August 2006
    mtox already did, it's the first thing listed :P
  • TroganTrogan London, UK
    edited August 2006
    Oops...guess I missed that! :aol:
  • mtroxmtrox Minnesota
    edited August 2006
    Where else can I go on this? Here's my list of all the things that could block access to just a few sites:

    HOSTS
    LMHOSTS
    Restricted sites
    firewall

    I've checked all of those. If it was a DNS attack, it wouldn't single out those sites. Besides, when I check ipconfig or do a nslookup, it shows me the IP addresses of the RoadRunner DNS servers just like it should. Anyone else have an idea?
  • RWBRWB Icrontian
    edited August 2006
    I know you checked the firewall, but have you tried turning it off? Also, is it possibly something in the modem/router blocking this address to her computer? I know you're comp worked fine plugged in, but perhaps it's a block on a specific LAN IP or MAC address?

    Also, this is all far fetched, but have you check to be sure no proxies are running, and/or the LAN settings in IE. Have you tried using Firefox instead of IE?
  • mtroxmtrox Minnesota
    edited August 2006
    RWB wrote:
    I know you checked the firewall, but have you tried turning it off? Also, is it possibly something in the modem/router blocking this address to her computer? I know you're comp worked fine plugged in, but perhaps it's a block on a specific LAN IP or MAC address?

    Also, this is all far fetched, but have you check to be sure no proxies are running, and/or the LAN settings in IE. Have you tried using Firefox instead of IE?

    I'm open to far fetched RWB. It had Zone Alarm. Log showed nothing blocked but I still uninstalled it and turned on the XP firewall. No help.

    The modem is a standard Motorola cable modem. There is no LAN router between it and the computer so I don't know what in the Motorola Surfboard would block a specific MAC....do you? I don't think they're that sophisticated.

    I did check for proxy settings in IE....none.

    Haven't tried Firefox because she's a noob user and that will just confuse her. In the back of my mind I've thought it might at least troubleshoot it though. Haven't done that one yet though.

    One more thought, I've seen a bad NIC do some really strange things. I have a little USB Ethernet I carry around just to troubleshoot that. I should try that too.
  • --9608-Mike--9608---9608-Mike--9608-
    edited August 2006
    What about Lan Settings, and The Privacy Settings? Are they all defaults?
  • mtroxmtrox Minnesota
    edited August 2006
    █Mike&#9608 wrote:
    What about Lan Settings, and The Privacy Settings? Are they all defaults?

    yep, all of them. Proxy server unchecked and all security settings are default.
  • TroganTrogan London, UK
    edited August 2006
    Want to post a HijackThis log just to make sure?
  • mtroxmtrox Minnesota
    edited August 2006
    Trogan_1000 wrote:
    Want to post a HijackThis log just to make sure?

    Yea that wouldn't hurt. I'm going to go over there today and try a different NIC. If that doesn't do it'll I'll bring back a log to post. The sites that are blocked don't seem like the types that malware would care about, but it's all so weird I'll look at anything.
  • mtroxmtrox Minnesota
    edited August 2006
    Alright. Just got back and here's the deal. Suddenly it can get to the other two sites (simpleplanning.net and mvelopes.com) with no problem. Still can't get to www.co.hennepin.mn.us. Put my USB Ethernet card on it and ran through that. No help. Same exact symptoms.

    If I bring up a cmd window, nslookup will resolve the IP address just fine (204.73.55.3) just fine. If I plug that IP into the browser address window I don't get there.

    I downloaded FireFox and that works fine so its an IE problem.

    Here's the HJT log. Looks clean to me. As you can see I even added www.co.hennepin.mn.us to the trusted zone. No help there. Woudl love some new ideas:

    Logfile of HijackThis v1.99.1
    Scan saved at 11:11:43 AM, on 8/3/2006
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Canon\MultiPASS4\MPSERVIC.EXE
    C:\Program Files\Norton AntiVirus\navapsvc.exe
    C:\WINDOWS\System32\dllhost.exe
    C:\WINDOWS\System32\dllhost.exe
    C:\HiJackThis\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://finance.yahoo.com/
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
    O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton AntiVirus\NavShExt.dll
    O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton AntiVirus\NavShExt.dll
    O4 - HKLM\..\Run: [monitr32] C:\Program Files\Canon\MultiPASS4\monitr32.exe
    O4 - HKLM\..\Run: [Dell|Alert] C:\Program Files\Dell\Support\Alert\bin\DAMon.exe
    O4 - HKLM\..\Run: [MPTBOX] C:\PROGRA~1\Canon\MULTIP~1\MPTBOX.EXE
    O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O15 - Trusted Zone: http://www.co.hennepin.mn.us
    O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - https://www-secure.symantec.com/techsupp/asa/ctrl/LSSupCtl.cab
    O16 - DPF: {3451DEDE-631F-421C-8127-FD793AFC6CC8} (ActiveDataInfo Class) - https://www-secure.symantec.com/techsupp/asa/ctrl/SymAData.cab
    O16 - DPF: {44990200-3C9D-426D-81DF-AAB636FA4345} (Symantec SmartIssue) - https://www-secure.symantec.com/techsupp/asa/ctrl/tgctlsi.cab
    O16 - DPF: {44990301-3C9D-426D-81DF-AAB636FA4345} (Symantec Script Runner Class) - https://www-secure.symantec.com/techsupp/asa/ctrl/tgctlsr.cab
    O16 - DPF: {CC05BC12-2AA2-4AC7-AC81-0E40F83B1ADF} (Live365Player Class) - http://www.live365.com/players/play365.cab
    O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
    O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    O23 - Service: Gear Security Service (GEARSecurity) - GEAR Software - C:\WINDOWS\System32\gearsec.exe
    O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
    O23 - Service: MpService - Canon Inc - C:\Program Files\Canon\MultiPASS4\MPSERVIC.EXE
    O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
    O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
    O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
    O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
    O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    O23 - Service: SPBBCSvc - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
    O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
Sign In or Register to comment.