McAfee & Microsoft pages inaccessible... 1

[Oldfart3]

Hello all,

New member here, I hope to contribute but am first hoping to obtain some input as I'm at wit's end!

My wife's computer ('99 trouble-free e-machine, Win98, IE6, 128MB mem, McAfee VirusScan8 with no firewall, 128MB mem) is home-networked with mine that I built last year (WinXP Home Ed, IE6, 512MB mem, Norton Internet Security with NAV 2004.) About a month ago I noticed her McAfee VS8 program had not updated and I had trouble getting the update to download manually, but after I 'tested' various configurations with VS8 and Internet Options, communication with the update site was finally somehow made and the update downloaded and installed ok. A few days ago the same thing occurred but I am unable to find any configuration that will allow VS8 to be updated. I also now find that no web site can be accessed that has 'mcafee' in the URL -- PLUS, I find that no 'microsoft' web sites can be accessed either. (Her Windows98 and my WinXP has routinely been kept up-to-date, the last for hers being a month ago also, all up-to-date at that time.) All other web sites that I have tested can be accessed ok, including Symantec and Network Associates (McAfee parent.) Everything works fine with my machine.

This of course sounds like a virus or worm somehow found its way onto my wife's machine; however, I find 'no' virus, worm, etc from using 'on-line' Symantec, RAV or Panda virus checks. I manually updated her VS8 program by downloading McAfee's VS8 Update with 'my' computer and transferring the zipped file to my wife's computer via our network -- the update then installed ok on her machine and VS8 subsequently found no virus, worm, etc. I find no files in Explorer, nor registry entries, that are common to today's viruses, trojan horses, or worms. The only 'host' or 'hosts' file to be found is a hosts.sam (sample) file installed by original Windows98, having only 'example' entries and nothing pertaining to mcafee or microsoft. I have been unable to find any combination of AV or IE configurations that will help, and have found no entries anywhere on her machine or mine that would restrict or block access to 'mcafee' or 'microsoft' sites.

We live in a rural area where copper phone lines limit us to a 31.2Kbps dial-up connection...yeau, it's really slow. But the slow connection does allow me to watch communication of wife's computer (blinking lights) on the network hub, which along with IE URL descriptions, show that a communication attempt is made when the VS8 or Win98 Update 'link' is clicked, or when an attempt to open a web site is made. However, after identifying the IP Address of the intended site, and indicating 'Site Found' and 'Waiting for Reply,' and sometimes 'Opening Page,' the communication (blinking lights) stops, and of course it ultimately times out. A Selective Startup with 'all' entries unchecked has no affect on the problem of accessing the mcafee and microsoft web sites. Disabling VS8 has no effect either. An investigation 'of' and with Spybot reveals nothing of consequence.

Space and considerations for your time prevent me from explaining even further, but the above tells most of the story. Can anyone provide a hand with this....even a thoughtful lead....? I'd greatly appreciate 'any' helpful input.

Mac

 

[FaiTHLeSS]

Sounds like you might have something such as goabot heres info on lastest version of it

http://securityresponse.symantec.com/avcenter/venc/data/w32.gaobot.alo.html

 

[Oldfart3]

Thanks for your input.

I'm sorry to say that no files or registry entries described for W32.Gaobot.ALO can be found. There also are no activities or events as described for this virus. I have no 'host' or 'hosts' file in Windows Root or System folders, or anywhere in C:\ for that matter -- except for the hosts.sam (sample) file installed by Win98 (and with no blocking entries anyway.) No processes have been shut down or programs terminated, or even affected, that I can find so far. The computer seems to act and respond ok in all respects, except for the problem I have described.

It's strange though that I don't recall Microsoft Windows Update pages being inaccessible at first; I only noticed that the McAfee updates and web pages were affected -- the microsoft inaccessibility came a day or so later. And awhile ago, after reviewing and checking a number of things, the Windows98 Update link in 'Start' indeed worked this time -- confirming that all critical items have previously been installed.

However, McAfee VirusScan 8.0 will not update and I still cannot access web pages having 'mcafee' in the URL.

Any more ideas? I'm greatful for your input.

Mac

 

[FaiTHLeSS]

What happens when you goto:

Start > Run > Command > ping

http://www.mcafee.com

What IP address it give you back? Does it give you an IP like 216.49.88.12 which is the IP i get. But note it wont respond to ping requests but it should still give you the IP.

If it returns 127.0.0.1 as the IP then someone has edited the host file.

Also try:

Start > Run > Command > Netstat -an << Think it works on Win98 been a while since i used it.

Does it show any unusauly connections ie to IRC servers these connections will be in the port range of 6667,6668.

Check for any strange programs running, run some sort of spyware/adware tool such as spybot can be found here:

http://www.spybot.info/

Also try an online scanner such as housecall from trendmicro.

http://housecall.trendmicro.com

see if that picks up any virus's

 

[Oldfart3]

Thanks again, FaiTHLeSS,

I get the same address as you when pinging

http://www.mcafee.com.

I have no 'host' or 'hosts' file anywhere on C:\ except for the hosts.sam (sample) file installed by Win98 in C:\windows (installed in 1998). It has only two 'example' entries and nothing concerning mcafee or microsoft, plus "127.0.0.1 localhost" as it should.

'Netstat -an' returns no unusual addresses, most being for this computer's local-network IP address.

I've had Spybot for a long time (updated) and have found nothing pertinent to the problem.

Housecall found only clean files, same as previously with 'on-line' virus checks provided by Symantec, RAV and Panda.

I've tried clearing all temp files, temp Internet files, history, cookies, etc and have 'accept all cookies' set for now. I've also checked Internet Options configuration for any possibly 'wrong' settings, and have set many mcafee and microsoft web sites as 'trusted sites.'

I'm wondering if this problem is somehow associated with the McAfee VirusScan 8.0 program, although the inability to access 'mcafee' web sites is not affected by first running a Selective Startup with 'everything' cleared. Disabling McAfee VS8 also has no effect. Maybe the cause is a corrupted Win98 file? Maybe something in browser IE6.0.2800.1106, 128-bit? Maybe something in my network adapter? But this computer seems to be running without any problems except the one I have described, and I'm just tossing out thoughts to see if anything strikes you as potentially pertinent....???

Thanks again, any more thoughts?

Mac

 

[Oldfart3]

A run of bad luck here -- 'my' computer came up lame yesterday afternoon and when rebooting, the startup window tells me "Pri Master Hard Disk: S.M.A.R.T. Status BAD, Backup and Replace." From what I read, SMART is not usually wrong in its advance notice of a disk problem, and that a person should indeed backup and obtain a new hard drive. In 'Recovery' mode, Chkdsk quickly found no problem, but when forcing a 'Chkdsk /p' check, it shows unrecoverable problems after checking only 35% of the disk. What irks me is this WD800JB 80GB 7200RPM drive is only 13 months old while my wife's little e-machine has chugged along for 4-1/2 years needing only a memory module replacement during all of that time, oh, and some cleaning and silicone spray of a fan. I don't recall even reloading Windows98 more than once.

Back to problem with my wife's machine, I tried to access a large number of web sites and found three others that were inaccessible as well (while I previously thought the problem was limited to only one or possibly two sites.) The problem seems to have been caused by mis-configuration of IE6 (or, primarily 'file-type' erroneous paths to IE for HTTP Protocols, and several more helpful items found from searching and finding posts at the software-browser forum here at Tech-Tips.) I can't say with certainty but I strongly suspect a fairly recent installation of a Mozilla beta-version 1.2.1 contributed to or caused the misconfiguration. I'm not sure how this old beta version of Mozilla became downloaded, it was either done surreptitiously or possibly by a visitor to our home.

Thanks for a great site, and a 'big' thanks to 'FaiTHLeSS' for his efforts to help one in need -- here's a feather for your cap and a star in your crown. I greatly appreciate your efforts.

Mac

 

[Floribunda]

I had a problem accessing WUpdate and mcafee sites too with one of our computers at work. It was driving me crazy.

Finally, ran msconfig and disabled all the mcafee files (I think it was the instant updater at fault) from loading at startup and BINGO! - immediate access to wupdate and mcafee web sites.

HTH