Can't access some websites

[bielo]

Hi guys. I'm really annoyed with this. Let me explain.

I have a lan, 17 computers. I have a permanent internet connection in the main computer which is shared among the others via ICS. Firewall is up on the main computer. All computers run windows XP professional.

Now, the real problem is I can surf the web, most of it at least, but I can't access some websites:

Hotmail. I get to the login page fine, but once I've entered username and password the page will never load.
Same thing happens with my bank webpage, both of them.
Paypal is the same.

So it seems to be something with secure sites, but I can access the admin page of my website, so I'm not sure.

This happens in all computers, including the main one.

I've read a lot around these forums, and I don't know what else to do, so I'm ready to post my hijackthis log, but I have a question: should I run hijackthis on a client computer or the main one? Will it make any difference?

Any help would be really appreciated. I have Spywareblaster and Spybot installed on every computer and I try to keep'em updated all the time.

Could it have something to do with my ISP?

Thanks in advance for your time and kind help.

[DMR]

should I run hijackthis on a client computer or the main one? Will it make any difference?

HijackThis can only interrogate and fix the computer that it is running on (and in the case of multi-boot systems, it only works within the currently-booted environment). Given that, and the fact that you said the problem was network-wide, I'd run HJT on the ICS computer first.

Give us more history on the problem, though:

- When did it start?

- Had you made any software adds/removes/changes at around that time?

- Did all of the machines start exhibiting the problem at the same time, or was it something that seemed to propagate through the network over a period of time?

- What are the steps you've taken so far to try to rectify the problem?

There are a few things that can cause problems with secure sites; not all of them are related to malicious programs, and not all of them will be indicated in a HijackThis log. The threads in the following link have many suggestions and possible fixes for secure-site related problems. Give the suggestions a try and let us know the results:

http://www.daniweb.com/techtalkforums/search.php?searchid=333240

[bielo]

Hi DMR

Thanks a lot for answering back. I'll answer your questions first.

- It started yesterday, everything was ok before.

- As far as I know, and I've confirmed this, no software was added, installed or changed the last few days. I wish I could be more specific but I don't usually work on the main computer, I asked the guy who uses it all the time and he said nothing has been changed. In my machine nothing has been changed, it is one of the client computers.

- All the machines have showed the problem at the same time. It didn't propagate itself.

- So far I've tried updating Spywareblaster, Spybot search and destroy and Adaware. I've run all of them and erased anything that was found as a problem. I also updated my Norton Antivirus 2004 and run it, to no avail.

- And I've read almost all of the threads you suggested prior to posting this thread, as well as threads on other forums and websites. So I'll try a couple things and let you know the results, any suggestions would be appreciated.

1) I will take my machine and connect to the internet through a dial up connection. If the problems are solved I suppose it will be safe to say that the problem is not related to the software I have installed and running.

If that's the case, then the problem might be (correct me if I'm wrong) related to the firewall running in my lan, or the internet connection shared among all the computers, right?

2) In some threads it has been suggested that the problems could be related to IE. So I'm willing to try and download Mozilla to see if that helps me out. That would suggest a problem with IE.

3) In some other threads people have suggested a problem with the MTU settings, which I really don't understand and wouldn't like to deal with those yet. That would be the last I try.

So, I'll let you know the results. In the meantime, if you have any more suggestions, they are more than welcome.

This could be a long shot but I think it might be good to tell you. As I said before, I can surf the web normally, I get to the Hotmail login page, but when I try to actually login, after a little while, I get the Page cannot be displayed error.

Now, when I try to access my bank accounts I don't even see the login page, I see other pages within the same websites, but not the login pages. Pages are:

https://www.bcointernacional.com/baninter/index1.html
https://pichincha.olb.todo1.com/servlet/msfv/B2000/Login/login.htm

Both those pages are https. So I think it safe to say my problem is with secure websites right? The odd thing, the admin page of my website is https also and not only can I view it, but I can login also...

https://66.49.148.93:19638/webhost/services/virtualhosting/siteadmin?ocw_login_domain=gocomputer.com.ec

Really don't know what to do...

Thanks again, hope to hear from you soon.

[DMR]

As the problem has effected all of your LAN machines at the same time, I would first have a good look at the common elements upstream- the ICS machine, any hardware firewall/router, etc.

Does the ICS machine itself also exhibit the same problems?

[bielo]

Does the ICS machine itself also exhibit the same problems?

Yes DMR, the ICS machine also has the same problems.

Now a couple of developments. As I said I took my machine and connected through a different dial up connection, everything worked fine. So, not the machine, maybe the connection or ICS machine.

I connected my internet service to another computer on the network, changed IP addresses and everything as needed, couldn't access the secure websites either. So not the ICS machine either.

So, at last I started checking my ports, and I found out I have no activity on the 443 port, which is usually used for https. So, at this point, it seems that my ISP did some bizarre thing with the ports assigned to my IP address. I'll get to them as soon as I can and see if this is, indeed, the problem.

Thanks for all your suggestions, they've been more than helpful and I'm really grateful for your time. Hope to solve this, it seems to be out of my hands now.

I'll let you know.

[DMR]

I have to log off for the night now, but please do check with your ISP in the mean time and see if that yields anything usefull.

I do have more questions, but as I said- I really do have to call it quits for the night; I'll be back online at some point tomorrow,

[bielo]

So, I finally solved it. Turned out to be my ISP after all.

I still wanted to thank DMR for helping out, it's good to know there's someone out there to ask for help when needed...

See ya

[DMR]

Glad you finally got it sorted. :)

Isn't it a wonderful thing to spend days troubleshooting your network only to find that it was the ISPs fault? I love it when they muck about and make changes without notifying their customers... Grrr!!

[rmarcial]

Bielo...how did you resolve your problem with your ISP? I'm having the same problem you had.

Thanks...