Restricted Sites

[SysRed]

I have a client who has an issue not being able to access three particular sites..

Windows XP Home edition SP2

1. Browser independent (IE, Firefox, Safari, chrome)
2. Running Norton AV security suite (turned off)
3. Flushed the DNS ' ipconfig /flushdns ' from cmd prompt
4. Changed DNS servers from dynamic to known working servers
5. MS Security settings & firewall disabled (By Norton)
6. hosts file returned to standard settings 'c:\WINDOWS\system32\drivers\etc'
7. EVERYTHING WORKS FINE IN SAFE MODE

Any clues as to where to go next, is there a registry setting which holds restricted sites and if so where, not forgetting the problem is not browser specific.

Many thanks

Rich

 

[NortonES2]

Which sites can't they access, are the AV sites ie McAfee etc?

-------------------------------

If it doesn't leak oil it must be empty!!

 

[SysRed]

Hi,

No the sites are not AV sites they are;

http://www.bookdepository.com

http://www.webspawner.com

http://www.fincaanna.co.uk

Many thanks Rich

 

[noveyron]

Can he access by ip address?

 

[SysRed]

Not sure, may need help. I know that i can look up one of my own websites

http://81.34.198.29/

(riovine.org) but that is because i have allowed it. If i type in the IP address of fincaann.co.uk (

http://208.90.69.202)

or bookdepository.com (

http://64.202.189.170)

nothing.

I assume there is a method by which to do this, please advise.

 

[SysRed]

Interesting

http://www.webspawner.com

works with

http://208.90.69.199/

but not the others. This is from my own machine which has no problems looking up the domain names, will get back to you re the clients findings.

 

[BadBigBen]

[ignore]fincaann.co.uk opens up but the

http://208.90.69.202

returns a "No web site is configured at this address." and the bookdepository.com opens up (but gives me a different IP 67.225.182.148 and this one opens up), but the

http://64.202.189.170

you gave returns a "This website is temporarily unavailable, please try again later. "

the other opens up both with the domain name and IP...

judging from my attempts, I would almost say that 1. they are redirects and 2. they may be blocked by the ISP...

to see if they are being blocked by the ISP, use a proxy, such as

http://www.freeproxyserver.ca

[/ignore]

Ben

"If it works don't fix it! If it doesn't use a sledgehammer..."

How to ask a question, when posting them to a professional forum.

 

[SysRed]

Hi Ben, yes all sites work via the proxyserver, which i guess is no suprise. Therefore it must be a DNS problem? Where to next do you think?

 

[noveyron]

It could be worth trying the opendns servers on the properties of the NIC:

https://www.opendns.com/start/

I had a similar problem in the past, the thread that I started on the issue has some good pointers :

http://www.tek-tips.com/viewthread.cfm?qid=1511671&page=1

)

 

[SysRed]

Hi Noveyron,

I have tried opendns plus three other sets of DNS servers, same results. Re reference to your previous post, I do not have personal access to the problem PC I am having to talk the end user through each scenario, therefore will do my best and get back to you with the results.

Given that I have tried four sets of DNS servers and it works via a proxy server and in safe mode am I barking up the wrong tree?

 

[BadBigBen]

Good suggestion there, noveyron...


Ben

"If it works don't fix it! If it doesn't use a sledgehammer..."

How to ask a question, when posting them to a professional forum.

 

[noveyron]

Hi SysRed

Given the fact that it works ok in safe mode (sorry, I missed that point earlier) I would suggest that it may not be a DNS issue, other than the PC has some software running that is either preventing the name resolution or preventing the page from loading in good time.

May be worth a run of malwarebytes as a precaution prior to troublehooting via selective startup / msconfig

I would also tend to take advice from some of the more experienced regulars on this forum rather than from me, it is not my main area of expertise, I am just trying to help.

@Ben - I am not sure if it was a good suggestion now, probably not!

 

[SysRed]

Hi Noveyron,

Thanks, your post is helpful as I forgot to mention at the beginning that I have already tried to run various selective start-ups and Diagnostic start-up, none of which made any difference. NAV has scanned and returned no infections and prior to that Spybot had been run it found and removed a number of malware issues. It has subsequently been disabled as the client runs NAV and the two conflict.

Thanks again

Rich

 

[BadBigBen]

I think, the problem lies with Norton...

reasons: regular DNS and other known DNS servers do not work, Proxy works, everything works fine in SafeMode...

to test this, Norton must be removed totally from the affected PC, just turning it off is not good enough, as the service and some of the DLLs are still running in the background...

best way to deinstall Norton, is to use the following tool:

Norton Removal Tool

http://service1.symantec.com/Support/tsgeninfo.nsf/docid/2005033108162039

just so that the person is not surfing the net unprotected, have them download either AVG or AVIRA (both good AV's) and/or COMODO Internet Suite (good free Firewall with an optional AV build in)...

or he can try the following:

Allowing access to specific Web sites or newsgroups blocked through Parental Control or Productivity Control

http://service1.symantec.com/SUPPORT/nip.nsf/docid/2004060710581736

Here is some info on Norton Blocking stuff, searching the NET will lead you to more:

Is Norton Blocking Your Internet Marketing Efforts?

http://marketing.about.com/cs/internetmarketing/a/norton2004.htm

Norton blocking server IP address?

http://www.milonic.com/mfa/2007-November/norton-blocking-server-ip-address.html

they may be old posts, but still reflect the years that Norton has messed with stuff...



Ben

"If it works don't fix it! If it doesn't use a sledgehammer..."

How to ask a question, when posting them to a professional forum.

 

[SysRed]

Thanks guys sorted.

I'm a little annoyed with myself as although I did not uninstall Norton I did remove every reference to it via MSCONFIG and restarted, obviously this was not enough. As soon as NAV was uninstalled it all worked, thank you Symantec for ruining what was once a great product.

Anyhow, thanks again.

 

[BadBigBen]

Glad you got it to work...



Ben

"If it works don't fix it! If it doesn't use a sledgehammer..."

How to ask a question, when posting them to a professional forum.