What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Certain Web-sites Blocked

4 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
I have recurrence of a previous issue. Is this the right forum? I can't access google, yahoo, hotmail, symantec and others. A page comes up saying ".can't access Google/Yahoo etc…" The title bar of the page is More Useful Everyday.

Can you help with this? Many thanks. If it helps, here's my current log.

Logfile of HijackThis v1.98.2
Scan saved at 10:14:01 PM, on 8/24/2004
Platform: Windows 2000 SP2 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\VetMsgNT.exe
C:\WINNT\system32\ZoneLabs\vsmon.exe
C:\WINNT\System32\WDNPSVC.EXE
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\PROGRA~1\CA\ETRUST~1\ETRUST~1\VetTray.exe
C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe
C:\Program Files\D-Link AirPlus G\AirPlus.exe
C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Firewall\ca.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINNT\explorer.exe
C:\HJT\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://mlb.mlb.com/NASApp/mlb/index.jsp
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [VetTray] C:\PROGRA~1\CA\ETRUST~1\ETRUST~1\VetTray.exe
O4 - HKCU\..\Run: [PopUpStopperFreeEdition] "C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe"
O4 - HKCU\..\Run: [AIM] C:\PROGRA~1\AIM\aim.exe -cnetwait.odl
O4 - Global Startup: D-Link AirPlus G Configuration Utility.lnk = C:\Program Files\D-Link AirPlus G\AirPlus.exe
O4 - Global Startup: EZ Firewall.lnk = C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Firewall\ca.exe
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRA~1\AIM\aim.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: ConferenceRoom Java Client - http://204.244.102.48:8000/java/cr.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www3.ca.com/securityadvisor/virusinfo/webscan.cab
O16 - DPF: {7EB15626-CB8E-4174-8A72-C055B12B4310} (CQD2Loader Object) - http://smartdownloader.com/installer.dll
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = CABLEREP.COX.COM
O17 - HKLM\System\CCS\Services\Tcpip\..\{26AB4F56-756D-447C-B841-CBD55CD20CBF}: NameServer = 209.47.15.118,64.157.143.38,192.168.0.1,4.2.2.2
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = cmi.cox.com
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = CABLEREP.COX.COM
O17 - HKLM\System\CS3\Services\Tcpip\Parameters: Domain = CABLEREP.COX.COM
Post #2
Fix these:

O16 - DPF: ConferenceRoom Java Client - http://204.244.102.48:8000/java/cr.cab

O16 - DPF: {7EB15626-CB8E-4174-8A72-C055B12B4310} (CQD2Loader Object) - http://smartdownloader.com/installer.dll

Then reboot.

Go to your control panel and open your network connections.
Select the first network adaptor listed.
Right Click on it, and select Properties.
On the "general" Tab, highlight Internet Protocol (TCP/IP)
Select "Properties"

See what it listed in the Use the following DNS server addresses as the Preferred and Alternate DNS Servers.

Post back the results.

Also Click the Advanced Tab
Then click on the DNS Tab
Look at DNS Server Addresses, in order of use.

Post the names of the DNS servers in the order of use box.
Post #3
Micah – Ok, here you go.. PREFERRED dns server [removed] Alternate DNS server [removed] DNS server addresses, in order of use; 209.47.15.118 64.157.143.38 192.168.0.1 4.2.2.2 Thanks
Post #4
Go to your control panel and open your network connections.
Select the first network adaptor listed.
Right Click on it, and select Properties.
On the "general" Tab, highlight Internet Protocol (TCP/IP)
Select "Properties"

Please write down the current settings in case you should want to change them back.

On the General Tab select "Obtain DNS server address automatically".

The DNS Server list is the list of servers in which the domain you are requesting is matched to the IP address. This DNS server can direct you to the correct page or if they are underhanded can direct you to the IP address they wish to direct you to. I believe that is what is happening to you.

When you are in the general tab check to see if you are obtaining an IP address automatically or have an IP address assigned.

Those IP addresses trace here:
======================================
Search results for: [removed]

UUNET Technologies, Inc. UUNETCA4-A (NET-209-47-0-0-1)
[removed] - [removed]
Colosseum Online COLOSS-UUBLK5 (NET-209-47-15-0-1)
[removed] - [removed]
Colosseum Online Inc. COLOSS-VLAN155-BLK1 (NET-209-47-15-64-1)
[removed] - [removed]
======================================
Search results for: [removed]

OrgName: Level 3 Communications, Inc.
OrgID: LVLT
Address: 1025 Eldorado Blvd.
City: Broomfield
StateProv: CO
PostalCode: 80021
Country: US
======================================
Search results for: 192.168.0.1

OrgName: Internet Assigned Numbers Authority
OrgID: IANA
Address: 4676 Admiralty Way, Suite 330
City: Marina del Rey
StateProv: CA
PostalCode: 90292-6695
Country: US
======================================
Search results for: 4.2.2.2

OrgName: Level 3 Communications, Inc.
OrgID: LVLT
Address: 1025 Eldorado Blvd.
City: Broomfield
StateProv: CO
PostalCode: 80021
Country: US
======================================

Any of those look familiar? :unsure:
Post #5
Micah I checked all these, and wrote them down. I selected the "select IP address automatically" and the "select DNS address automatically". I clicked ok and the system rebooted itself. Immediately, the websites were accessible. I rebooted and they were gone again. The IP addresses don't look familiar at all. Do you have any thoughts? Thanks again
Post #6 last edited
Ok… Let's try this….

First, go here:

Hijack This! Tutorial

And read the tutorial on:

How to restore items mistakenly deleted

Once you understand and feel you are capable of doing that, close all other programs, run Hijack This! and fix this one entry:

O17 - HKLM\System\CCS\Services\Tcpip\..\{26AB4F56-756D-447C-B841-CBD55CD20CBF}: NameServer = 209.47.15.118,64.157.143.38,192.168.0.1,4.2.2.2

Then, reboot.

Try the web sites you have not been able to access.

If you cannot get online, run Hijack This! and RESTORE that item we just fixed, then reboot.

Post back and let me know how things are going.

If things seem to be back to "normal", I suggest rebooting and surfing for a while (do this several times) to be sure that the fix is "permanant". :)
Post #7
Hi Micah I followed your instructions. No luck I'm afraid. I fixed the item and rebooted but then couldn't access the internet at all. So I restored from back-up. The internet is accessible again but I can't access Google, Symantec, Hotmail. Any further thoughts? Many thanks
Post #8
After consulting with some of our experts, they suggested changing your "Preferred" and "Alternate" DNS servers:

Preferred: 167.206.3.179

Alterante: 167.206.3.245

Please write down the current settings in case you need to change them back.

Post back, and let me know how things go. :)
Post #9
Micah - your advice seems to have worked. I made the changes and I could immediately access all the sites. I rebooted and tried again, successfully. It looks like you did it again. Thanks. I'm very grateful. However, I'll keep watching it and will post again if it returns. Thanks
Post #10
Glad we could be of assistance. This topic is now closed. If you wish it
reopened, please send us an email (Click here to email) with a link to your thread.

Donations in support of this Web Site are always appreciated

Do not bother contacting us if you are not the topic starter. A valid,
working link to the closed topic is required along with the user name used.
If the user name does not match the one in the thread linked, the email will be deleted.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI