At Wit's End: Some Webpages Don't Load; Can Ping Some Sites, Not Others

Question

jalioto 0 Newbie Poster

20 Years Ago

I am a first time poster, cross-posting this thread on and daniweb.com. I appreciate your time and any help you may be able to provide.

BACKGROUD: I am running XP. Network contains a wireless Netgear router, its firewall is disabled. ISP is SBC in San Francisco. Browsers are IE and Firefox. Mcafee Internet Security suite 6.0.

ISSUE: I am unable to load certain websites. Some sites load incompletely. For instance, I can access google, bankofamerica.com, and daniweb.com. I cannot access mcafee.com or wellsfargo.com. Similarly, I am able to ping google, bankofamerica, and daniweb; pinging mcafee or wellsfargo times out. Attempts to load pages in browser and ping by command prompt by IP address ( for wellsfargo.com and for mcafee.com) have failed.

OTHER SYMPTOMS, (not necessarily unrelated) to main problem: (1) computer is generally slow; (2) there is intermittent churning in background, like the computer’s working hard on something, but nothing suspicious shows up on Task Manager; (3) on occasion, IE will suddenly begin rapidly opening iterations (sometimes as many as 70 open IE windows) of itself until machine crashes; (4) in IE: Internet options>Security>Restricted Sites there is a list of more than 100 restricted sites, for example: *..00hq.com; *..75tz.com. I did not add these to the restricted sites zone. When they are removed, click OK, and exit window, on reopening window they are all there again.

WHAT I’VE DONE: (1) disabled all firewalls; (2) deleted contents of windows/temp; (3) searched for and deleted all *.tmp files; (4) deleted user’s contents of cookies; (5) in IE cleared History, Cookies, Deleted files (including offline files); (6) ran Cleanmgr from command prompt, deleted everything; (7) deleted Prefetch; (8) Ran updated Spybot, AdAware, TrojanHunter, Ewido; (9) Scanned using Housecall and Bitdefender. I have not been able to update and run my Mcafee antivirus, as am unable to access the site for updates. Was unable to run CounterSpy for same reason; (10) uninstalled and reinstalled IE to deal with symptom no. 4 above, but could not wipe out the list of restricted sites. (But, I am still unable to access certain websites from Firefox; neither could I ping certain sites, so this list of restricted sites does not seem to be the cause.); (11) Googled “cannot load some websites and related terms; revealed my problem is shared, but could not find applicable solutions; (12) on advise from (), ran ipconfig /flush dns, and regsvr32 softpub.dll; finally, (13) HijackThis was run from its own folder with all browsers closed. The log is below.

Your time and help are very greatly appreciated. Thank you.

Logfile of HijackThis v1.99.1
Scan saved at 2:25:37 PM, on 9/21/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\McAfee\McAfee Privacy Service\GUARDDOG.EXE
C:\Program Files\McAfee\McAfee Privacy Service\GUARDDOG.EXE
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\ewido\security suite\ewidoguard.exe
C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe
C:\Program Files\McAfee\McAfee Shared Components\Guardian\CMGrdian.exe
C:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\WINDOWS\System32\ezSP_Px.exe
c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
C:\Program Files\TrojanHunter 4.2\THGuard.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\NETGEAR\WG511U Configuration Utility\wlancfgu.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hposol08.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
C:\WINDOWS\System32\tcpsvcs.exe
C:\WINDOWS\System32\svchost.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
c:\program files\mcafee.com\agent\mcagent.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: McAfee Privacy Service - {cc4b2ee5-4803-11d7-8a38-00b0d0c6b814} - C:\Program Files\McAfee\McAfee Privacy Service\GDIEHELP.DLL
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [MCUpdateExe] c:\PROGRA~1\mcafee.com\agent\McUpdate.exe
O4 - HKLM\..\Run: [MSKAGENTEXE] C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe
O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [McAfee Guardian] C:\Program Files\McAfee\McAfee Shared Components\Guardian\CMGrdian.exe /SU
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [VirusScan Online] c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
O4 - HKLM\..\Run: [MSKDetectorExe] C:\PROGRA~1\McAfee\SPAMKI~1\MSKDetct.exe /startup
O4 - HKLM\..\Run: [MPFTray] C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
O4 - HKLM\..\Run: [ezShieldProtector for Px] C:\WINDOWS\System32\ezSP_Px.exe
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [THGuard] "C:\Program Files\TrojanHunter 4.2\THGuard.exe"
O4 - Global Startup: hpoddt01.exe.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: NETGEAR WG511U Smart Wizard.lnk = ?
O4 - Global Startup: officejet 6100.lnk = ?
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Privacy Bar - {cc4b2ee5-4803-11d7-8a38-00b0d0c6b814} - C:\Program Files\McAfee\McAfee Privacy Service\GDIEHELP.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O15 - Trusted Zone: www.gmail.com
O15 - Trusted Zone: www.wellsfargo.com
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
O16 - DPF: {15E31F81-702C-48F8-97B1-75AE9155B5E3} (TSWebCtl.UCTSWeb) -
O16 - DPF: {30439117-02CA-4FBA-ADAF-84C2D8E2004D} -
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} -
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) -
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/mcinsctl/en-us/4,0,0,83/mcinsctl.cab
O16 - DPF: {54823A9D-6BAE-11D5-B519-0050BA2413EB} (ChkDVDCtl Class) -
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.com/scan8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) -
O16 - DPF: {7584C670-2274-4EFB-B00B-D6AABA6D3850} (Microsoft RDP Client Control (redist)) -
O16 - DPF: {BAC01377-73DD-4796-854D-2A8997E3D68A} (Yahoo! Photos Easy Upload Tool Class) -
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/shared/mcgdmgr/en-us/1,0,0,20/mcgdmgr.cab
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: McAfee Privacy Service (GuardDogEXE) - Unknown owner - C:\Program Files\McAfee\McAfee Privacy Service\GUARDDOG.EXE" /SERVICE (file missing)
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: McAfee.com McShield (McShield) - Unknown owner - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - Networks Associates Technology, Inc - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
O23 - Service: McAfee SpamKiller Server (MskService) - Networks Associates Technology. Inc. - C:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe

microsoft:windows-nt-2000-xp virus-malware wifi

1 Contributor
1 Reply
287 Views
1 Day Discussion Span
Latest Post 20 Years Ago Latest Post by jalioto

Dani AI

Generated 9 Months Ago

This type of selective-site failure combined with persistent, unwanted browser changes most commonly falls into three buckets: local OS/browser hijacking (malware that redirects or blocks AV/bank sites), local network/router DNS or proxy tampering, or an ISP/route-level block. Priority is to isolate where the problem lives and to gather simple, diagnostic evidence before attempting removals. later noted outside help was being used; the short checklist below preserves a safe, ordered workflow for anyone who finds a similar problem later.

Start by isolating the scope: confirm whether other devices on the same LAN see the same failures, and whether the affected PC behaves differently when connected directly to the modem (bypassing the router) or when put on a different network. Boot the PC into Safe Mode with Networking and retest — reachability in Safe Mode usually points at a loaded filter/proxy/startup component. Check for any proxy configured in Internet Options and inspect the system hosts file for unexpected entries; also temporarily point the adapter to a known public DNS to rule out DNS tampering.

Run straightforward diagnostics to localize the failure, then act on results:

nslookup <problem-domain>
tracert <problem-domain>
netstat -ano
netsh winsock reset

Use the nslookup/tracert output to see whether name resolution fails or the route drops; netstat identifies suspicious listeners; winsock reset can clear malicious LSPs (requires restart).

If evidence points to malware: obtain up-to-date scanners from a clean machine, create bootable rescue media and run offline scans, and use a trusted autorun/startup viewer (Sysinternals Autoruns) to inspect and remove suspicious autostart entries. If the router shows unexpected DNS/server settings or port forwards, factory-reset it and reflash/update firmware. Always back up configuration/important data and the registry before manual edits; if a rootkit is confirmed or stability cannot be restored, plan a clean OS installation as the last resort.

Reply to this topic

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.

jalioto 0 Newbie Poster · Answer 1 · 2005-09-25T06:19:57+00:00

Moderator, please remove this thread, with my apologies. I am being assisted by Dwight at . Thank you for your assistance and for your invaluable service.