Can't Display One Web Page

[LouAtoms]

A few months ago, I suddenly found that I can no longer connect to the Consumer Reports web site (www.ConsumerReports.org), although I had been doing so for years using the same OS and PC: Microsoft Millennium Edition on a Dell Dimension XPS B733r. As far as I know, this is the only web page affected, and it does not matter whether I use the Microsoft Internet Explorer or the Mozilla Firefox web browsers. In IE the error message is "Cannot find server or DNS Error", and in Firefox the error is "The document contains no data."

I've run several utilities to clean up the Windows Registry, and delete the unmovable Index.dat files. The problem persists when I unload all of my security software (ZoneAlarm, Norton AntiVirus, CounterSpy). However, if I use a cloaking service to hide my identity (http://www.the-cloak.com), then IE displays the web page!

My high-speed cable ISP can display the web page on their PCs. Their tests have not discovered why I cannot. Technical people at Consumer Reports have also run tests, to no avail. They both say that I am not intentionally being denied access, and that no one else has reported a similar problem. Also, Consumer Reports gave me the address of their secondary server, and I had no problem displaying a web page on that server in IE.

I don't own another computer to try to duplicate the problem. The only way I can think of to further investigate the problem is to pay my ISP to send a technician with a PC to see if they can reproduce the problem on my network segment. I have a paid subscription to access material on the Consumer Reports web site.

Comments or suggestions?


Lou

 

[bigk]

Try:
1.) Make sure your browsers are not blocking the address.
2.) Scan for spyware/adaware
3.) Scan for viruses
4.) Click up you chache, history, cookies ect.

One or all those things might do the trick, if not......well, its always good to do that once and a while any ways.

I hope that helped,

big k

 

[Topazz]

Check your Hosts file to ensure that the website address has not somehow been added to it.

 

[LouAtoms]

bigk:

I have already repeatedly scanned for viruses and spyware (using four different spyware programs!), and deleted caches, history, cookies, temporary files, etc., to no avail.

Neither Internet Explorer nor Firefox display the web page. How do I find out whether each of these browsers block the address?


Topazz:

The Consumer Reports web site is not listed in the Hosts file.


Thanks,

Lou

 

[bigk]

I dont think Fire fox has a option allow or not allow certin web sites. (Or I just cant find it)

But I do know Internet explorer does, its in the options/perferences area.

Big k

 

[LouAtoms]

bigk:

I find no addresses listed under "Tools / Internet Options / Security / Restricted Sites" in IE. If there is some other place to check in IE, please let me know: I do not see anything called "options / preferences" in IE 6.0 that you mention. Am I missing something?


Lou

 

[bigk]

Try doing a disk clean up to your hard drive(s). There are some times temperatory files with in the windows system folder that you can clean up along with other non-needed files with the disk clean up. So to do this.....

1.) Double click on "My computer"
2.) Right click on the hard drive(s) and select "propertys"
3.) Click on "disk clean up"
4.) Click through all the check mark and select "ok"

Try that,

Big k

 

[LouAtoms]

bigk:

I've already done that. Doesn't help.

Thanks,


Lou

 

[Rollin' Rog]

http://216.35.74.198

Can you get there by clicking the above IP or entering it in the address bar?

If you can, and there are no entries in the HOSTS fille for their domain (you should really try renaming it "ghosts" for a test, then post a HijackThis Scanlog.

Download and install HijackThis using the "self extractor". Run it and select "do a system scan and save the log file". Then copy/paste the contents of the log to a reply

http://www.thespykiller.co.uk/files/hijackthis_sfx.exe

It may show some issue with a corrupted "prefix" setting in the registry.

 

[LouAtoms]

Rollin' Rog:

No, I cannot display the Consumer Reports web page using their IP address either, regardless of browser (IE & Firefox). That was something both my ISP and Consumer Reports had already asked me to test.

Nonetheless, here is the log file created by Hijack. Charter is my ISP.

Logfile of HijackThis v1.99.1
Scan saved at 12:32:18 PM, on 7/22/2005
Platform: Windows ME (Win9x 4.90.3000)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
c:\windows\SYSTEM\KB891711\KB891711.EXE
C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\SYMTRAY.EXE
C:\WINDOWS\EXPLORER.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCEVTMGR.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCSETMGR.EXE
C:\PROGRAM FILES\NORTON SYSTEMWORKS\NORTON UTILITIES\NPROTECT.EXE
C:\PROGRAM FILES\NORTON SYSTEMWORKS\NORTON CLEANSWEEP\CSINJECT.EXE
C:\WINDOWS\SYSTEM\RESTORE\STMGR.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\PROGRAM FILES\ADAPTEC\EASY CD CREATOR 5\DIRECTCD\DIRECTCD.EXE
C:\PROGRAM FILES\SUNBELT SOFTWARE\COUNTERSPY CLIENT\SUNASDTSERV.EXE
C:\PROGRAM FILES\SUNBELT SOFTWARE\COUNTERSPY CLIENT\SUNASSERV.EXE
C:\PROGRAM FILES\ZONE LABS\ZONEALARM\ZLCLIENT.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCPD-LC\SYMLCSVC.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCAPP.EXE
C:\PROGRAM FILES\INTERMUTE\ADSUBTRACT\ADSUB.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\PROGRAM FILES\HIJACKTHIS\HIJACKTHIS.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.charter.msn.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://charter.msn.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=localhost:1034
O2 - BHO: BrowserHelper Class - {EBCDDA60-2A68-11D3-8A43-0060083CFB9C} - C:\WINDOWS\SYSTEM\NZDD.DLL
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 6.0\READER\ACTIVEX\ACROIEHELPER.DLL
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - c:\Program Files\Norton SystemWorks\Norton Antivirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - c:\Program Files\Norton SystemWorks\Norton Antivirus\NavShExt.dll
O4 - HKLM\..\Run: [ScanRegistry] c:\windows\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] c:\windows\taskmon.exe
O4 - HKLM\..\Run: [PCHealth] c:\windows\PCHealth\Support\PCHSchd.exe -s
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [AdaptecDirectCD] "c:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [Tweak UI] RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp
O4 - HKLM\..\Run: [SUNASDTSERV] C:\PROGRAM FILES\SUNBELT SOFTWARE\COUNTERSPY CLIENT\SUNASDTSERV.exe
O4 - HKLM\..\Run: [sunasServ] C:\Program Files\Sunbelt Software\CounterSpy Client\sunasServ.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKLM\..\Run: [Symantec Core LC] C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe start
O4 - HKLM\..\Run: [ccApp] "c:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [NPROTECT] c:\Program Files\Norton SystemWorks\Norton Utilities\nprotect.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMON.EXE /Consumer
O4 - HKLM\..\RunServices: [*StateMgr] C:\WINDOWS\System\Restore\StateMgr.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [KB891711] c:\windows\SYSTEM\KB891711\KB891711.EXE
O4 - HKLM\..\RunServices: [TrueVector] C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE -service
O4 - HKLM\..\RunServices: [SymTray - Norton SystemWorks] c:\Program Files\Common Files\Symantec Shared\SymTray.exe "Norton SystemWorks"
O4 - HKLM\..\RunServices: [ScriptBlocking] "C:\Program Files\Common Files\Symantec Shared\Script Blocking\SBServ.exe" -reg
O4 - HKLM\..\RunServices: [ccEvtMgr] "c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe"
O4 - HKLM\..\RunServices: [ccSetMgr] "c:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe"
O4 - HKLM\..\RunServices: [NPROTECT] c:\Program Files\Norton SystemWorks\Norton Utilities\nprotect.exe
O4 - HKLM\..\RunServices: [CSINJECT.EXE] c:\Program Files\Norton SystemWorks\Norton CleanSweep\csinject.exe
O4 - Startup: AdSubtract.lnk = C:\Program Files\interMute\AdSubtract\AdSub.exe
O4 - Startup: Sync-It.lnk = C:\Program Files\Sync-It\syncit.exe
O8 - Extra context menu item: &WordWeb... - res://C:\WINDOWS\wweb32.dll/lookup.html
O8 - Extra context menu item: AdSubtract: Cloak Image - res://C:\Program Files\interMute\AdSubtract\AdSub.exe/361
O8 - Extra context menu item: AdSubtract: Report Site - res://C:\Program Files\interMute\AdSubtract\AdSub.exe/359
O8 - Extra context menu item: AdSubtract: Bypass Site - res://C:\Program Files\interMute\AdSubtract\AdSub.exe/360
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\SYSTEM\MSJAVA.DLL
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\SYSTEM\MSJAVA.DLL
O9 - Extra button: Dell Home - {738A93E0-E537-11D3-8E29-40CD71C10000} - C:\WINDOWS\SYSTEM\SHDOCVW.DLL (HKCU)
O9 - Extra button: Netnews - {857D9140-E9F3-11D3-8E29-A06472C10000} - news:worldnet.help.new-users (file missing) (HKCU)
O12 - Plugin for .pdf: C:\PROGRA~1\INTERN~1\PLUGINS\nppdf32.dll
O15 - Trusted Zone: http://charter.msn.com
O15 - Trusted Zone: http://www.msnbc.msn.com
O15 - Trusted Zone: http://video.msn.com
O15 - Trusted Zone: http://support.msn.com
O15 - Trusted Zone: http://entertainment.msn.com
O15 - Trusted Zone: http://www.w3.weather.com
O15 - Trusted Zone: http://www.weather.com
O15 - Trusted Zone: http://www.amazon.com
O15 - Trusted Zone: http://*.skyandtelescope.com
O15 - Trusted Zone: http://www.gretagmacbeth.com
O15 - Trusted Zone: http://www.cis.rit.edu
O15 - Trusted Zone: http://www.delphion.com
O15 - Trusted Zone: http://www.lowes.com
O15 - Trusted Zone: http://www.sears.com
O15 - Trusted Zone: http://www.sfbc.com
O15 - Trusted Zone: http://www.fordcredit.com
O15 - Trusted Zone: http://*.postsnet.com
O15 - Trusted Zone: http://www.lordabbett.com
O15 - Trusted Zone: http://www.adobe.com
O15 - Trusted Zone: http://www.southcarolinablues.com
O15 - Trusted Zone: http://rps.troweprice.com
O15 - Trusted Zone: www3.troweprice.com
O15 - Trusted Zone: http://forums.techguy.org
O15 - Trusted Zone: http://www.franklintempleton.com
O15 - Trusted Zone: http://support.turbotax.com
O15 - Trusted Zone: http://charterzone.charter.com
O15 - Trusted Zone: http://weather.noaa.gov
O15 - Trusted Zone: http://www.chartercom.com
O16 - DPF: {03F998B2-0E00-11D3-A498-00104B6EB52E} - https://components.viewpoint.com/MTSInstallers/MetaStream3.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52...le.com/samantha/us/win/QuickTimeInstaller.exe
O16 - DPF: {1552B1CD-8CB7-4776-B6CB-16EA461928E5} (Cpuid Control) - http://powe45.vwh.net/downloads/upgradefinder.cab
O16 - DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} (QDiagHUpdateObj Class) - http://h30043.www3.hp.com/dj/qdiagh.cab?306
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://www-secure.symantec.com/techsupp/asa/SymAData.cab
O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - https://www-secure.symantec.com/techsupp/asa/LSSupCtl.cab
O17 - HKLM\System\CCS\Services\VxD\MSTCP: Domain = Charter.net
O17 - HKLM\System\CCS\Services\VxD\MSTCP: NameServer = 209.225.8.42
O20 - AppInit_DLLs: apitrap.dll;

If something in this log explains my problem, I'd be grateful for any help you can give.

Thanks,


Lou

 

[Rollin' Rog]

Well I don't see any "malware" or obvious issues in the scanlog.

However it might help if you can clarify the purpose of this line in the scanlog:

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=localhost:1034

Typically such lines are used to direct an address search to a "localhost" (in this case a specific port) when a proxy server is in use.

Now some ISPs actually use proxy servers without telling you. So I don't know if there is some conflict here.

This entry is specific to Internet Explorer; however if you had similar configurations in the other browsers, it could be a problem there as well.

The only time I have seen problems similar to yours, when the HOSTS file has been ruled out, and even direct IPs, but connecting through a Proxy does -- have sometimes cleared up spontaneously, sometimes not.

How assured are you that Consumer Reports is not blocking your IP? This would be server specific in most cases, so one might block you and another pass you. And have you prodded your ISP to give you another one?

 

[LouAtoms]

Rollin' Rog:

To answer your last question first, Consumer Reports technical people say that they are not blocking my access. I've spoken to them more than once by phone and by e-mail about this issue, and they have checked their system more than once (they say). They feel my ISP might have a cable problem on my "network segment" (?). However, remember that I can display the web page by using a cloaking service, which would seem to imply that Consumer Reports is blocking access. That is what I finally concluded, without being able to prove it.

My ISP, Charter Communications (high-speed cable), has also ran tests on their end, without finding any explanation. I can't tell you what those tests were. My IP address is not fixed, and among other things that my ISP tried was to reset my cable modem. This forces their system to assign me a new IP address. That doesn't eliminate the problem: Even though my IP address changes, my problem with the Consumer Reports web site does not!

During experiments conducted with my ISP, we tried enabling DNS using a fixed address for the DNS server -- by default DNS is disabled. The way it was explained to me, this change made sure that I was not somehow being redirected from Charter's proxy (but I'm not knowlegable enough about this stuff to have fully followed the explanation). This had no effect on my problem, but it is still enabled and this might correspond to the line in the log that you are curious about. Or, the line could be due to my cookie manager, AdSubtract, which removes web page ads after redirecting my web access through their server. The only item in my Hosts file is due to AdSubtract, as follows:

127.0.0.1 AdSubtract # Added by AdSubtract for auto-dial.

Note that the comment was inserted by AdSubtract, and it appears that it is only relevant for dial-up service. My problem persists even when I disable AdSubract (and all of my other security software too), so I would think that an AdSubtract server wasn't related to the problem.

Does this I answer your questions? Now what?


Lou

 

[dugq]

I think the problem is with your ISPs proxy. When you use the cloak, you are put onto a different proxy therefore solving the problem. The problem is quite common when running through a transparent proxy.

It also sounds to me like your ISP ain't got much of a clue. Changing the DNS is not going to have any effect on the proxy you are running through, the two are quite different.

The solution is to use a different proxy than your ISPs. You could carry on using the cloak, or use a public proxy that doesn't hide your IP address. First, search google for a public proxy, theres loads out there, but note down a few since speed can vary and its best to experiment. Once you have found some addresses, go to IE, then tools and internet options, and connection, click on lan settings, then tick use a proxy server, type in one of the addresses you found and use port 80 or 8080. , then click ok twice, and try again. Someone with a similar problem on the forum had success with usiing address 217.17.233.132 on port 80.

However, if you do this you won't be using adsubtract. However, you should be able to add the proxy settings in adsubtract itself (sorry don't know how).

To add a proxy in firefox, go to options and then connection settings

 

[Rollin' Rog]

Well that certainly shoots down my main theory, since you are not using a fixed IP; while it is possible to block a range of IPs, and we sometimes do that here as a last resort, it seems unlikely that Consumer Reports would not be able to verify this, and that your ISP would reassign you IPs in the same block.

They have certainly gone to some lengths to troubleshoot the problem, and that does explain exactly what that entry is doing in the Scanlog.

As I said, I have seen this problem a couple of times previously where it seemed the ISPs domain caching servers were not properly updated. But given the lengths to which you have involved Comcast in this, I would expect that to have been ruled out by their tests, and even when that is the case the IP should get you there.

The fact that you can get there with an anomizer is probably not so much due to the fact that your IP is cloaked as that they are accessing the page through a different route and relaying it back to you.

Something in Comcasts routing to the Consumer Reports IP is broken or not handling the timing of some intermediate router properly.

I have tried running a few traces to 216.35.74.198 using both the Windows XP tracert utlity, and some others.

It seems this IP times out at certain places (try it yourself: start > run cmd and enter:

tracert 216.35.74.198

Same using PcPitstop's online TraceRoute tool (their offline one never gets me anything):

http://www.pcpitstop.com/internet/default.asp

Here's what I get:

Your results will appear below: (Please be patient - it may take a minute for the results to start appearing.)


Tracing route to www.consumerreports.org (216.35.74.198):
Hop
# Avg
ms Loss
% Graph Address
1 * 100 0.0.0.0
2 165 207.217.56.1
3 164 209.165.111.1 (cor01-vl-40.ca-pasadena0.ne.earthlink.net)
4 165 209.165.101.1 (bor01-ge-1-2.ca-pasadena0.ne.earthlink.net)
5 169 209.165.109.157 (bor02-so-3-1.ca-sanfranc0.ne.earthlink.net)
6 187 209.165.108.182 (peering-cogent.ca-sanfranc0.ne.earthlink.net)
7 173 154.54.1.62 (p6-0.core02.sjc04.atlas.cogentco.com)
8 169 154.54.1.201 (p5-0.core01.sjc04.atlas.cogentco.com)
9 177 206.24.241.81 (bpr1-so-4-1-0.PaloAltoPaix.savvis.net)
10 180 206.24.211.73 (dcr1-so-3-3-0.SanFranciscosfo.savvis.net)
11 260 204.70.192.10 (bcs1-so-4-1-0.NewYork.savvis.net)
12 249 204.70.1.2 (ahr2-pos-10-0.Weehawkennj2.savvis.net)
13 249 216.35.65.211 (csr2-ve241.Weehawkennj2.savvis.net)
14 247 216.35.78.14
15 * 100 0.0.0.0
16 * 100 0.0.0.0
17 * 100 0.0.0.0
18 * 100 Unable to reach 216.35.74.198 (www.consumerreports.org)

 

[wyrmmage]

that website did not exist when I clicked on it.....