Seeing the desired website for a second, then going to "Page can not be displayed"...

[LABachlr]

I have a possible client who is set up on a network with a Linksys router and a hub, who is having a problem that comes and goes. When the problem is acting up, they will go to a website, any website, will see the page for a split second, and then it will go to "This page can not be displayed".

Is this a possible network issue? Don't think it's an ISP issue, as they said that this has been going on since it was set up.

Or could this be a spyware/malware issue?

Again, this problem comes and goes. Sometimes it works, and sometimes it doesn't.

 

[vi edit]

Sounds like a spyware redirect. Does the router have a log function available? If so, look at the logs and see what it says. Many times the logs will tell you right there that it's a redirect.

Also check the hosts file -

windows (or winnt in win2k)/system32/drivers/etc/hosts

Open it in notepad, see if there is anything under the local host line.

 

[LABachlr]

OK. Thanks. I figured it might be a spyware issue.

Is it definitely not a network issue (i.e. the way the network is set up), or could that still be a possibility as well? If it could be a network issue, what would be some possible solutions?

 

[LABachlr]

The thing is, if it were a redirect, wouldn't it always redirect the browser instead of now and then?

 

[vi edit]

Originally posted by: LABachlr
The thing is, if it were a redirect, wouldn't it always redirect the browser instead of now and then?

Depends on the redirect in question. Some of them have a listing of a couple hundred sites (mostly to big name security/software/antivirus companies) that they will redirect. The ones I've seen always show up under the hostfile.

 

[vi edit]

Is it definitely not a network issue (i.e. the way the network is set up), or could that still be a possibility as well? If it could be a network issue, what would be some possible solutions?

Could try bypassing the DNS and plugging in the IP address of the website instead of the domain name. Other option is to bring in a known clean machine (laptop) and plug it in to the router and test sites that are known to act up.

 

[LABachlr]

Originally posted by: vi_edit

Originally posted by: LABachlr
The thing is, if it were a redirect, wouldn't it always redirect the browser instead of now and then?

Depends on the redirect in question. Some of them have a listing of a couple hundred sites (mostly to big name security/software/antivirus companies) that they will redirect. The ones I've seen always show up under the hostfile.

Even if the problem is sporadic with the same website?

So some redirects redirect the browser to "This page can not be displayed"? Usually redirects are used to make money by redirecting the browser to a certain website. Can't imagine the motive behind making a redirect go to no website at all, unless the programmer just has it out for Corporate America. :roll:

 

[LABachlr]

Originally posted by: vi_edit

Is it definitely not a network issue (i.e. the way the network is set up), or could that still be a possibility as well? If it could be a network issue, what would be some possible solutions?

Could try bypassing the DNS and plugging in the IP address of the website instead of the domain name. Other option is to bring in a known clean machine (laptop) and plug it in to the router and test sites that are known to act up.

Good idea. And if a clean machine doesn't work, what would be a solution to the network problem?

 

[vi edit]

How many PC's are there in this office? If there is more than one, are any others having issues? If they aren't, or if the clean PC works fine, I would assume it's safe to say it's not a networking issue. It's more than likely a problem with that PC's host file or some sort of malware installed on that PC.

I'd run -

Adaware
Spybot S&D
Hijack this

And see what they turn up. I'd also make sure all my AV definitions were up to date and make sure there aren't any trojans lurking around on the machine.

What could be happening is antivirus is deleting the virus but the system restore in windows is bringing it back and it just keeps reinfecting itself. The qhost virus will raise hell on your host file and kill your ability to web browse.

 

[LABachlr]

OK. If it's spyware, then that's a no brainer. Just run the programs that you suggested. I always use those programs as well. Btw, can I post the log from Hijackthis here so you guys can tell me what's wrong? If not, where do you suggest I post it?

And I've heard about System Restore actually doing more harm than good. Do you suggest having System Restore disabled on all systems?

And just for the sake of argument, let's say they have three computers on the network, all are having issues, and the clean laptop that I bring in has the same issue. What would be possible solutions to the problem?

 

[Sideswipe001]

I'd start to believe the router was flaky in that case and try updating the firmware first, while looking around at testing another router.

 

[LABachlr]

Originally posted by: Sideswipe001
I'd start to believe the router was flaky in that case and try updating the firmware first, while looking around at testing another router.

OK. Thanks. What about the hub? Could that be an issue?

 

[vi edit]

And just for the sake of argument, let's say they have three computers on the network, all are having issues, and the clean laptop that I bring in has the same issue. What would be possible solutions to the problem?

Could be any number of possible problems.

The first thing I'd consider would be some sort of DDOS against your public IP bringing your router to it's knees.

Second thing would be doing virus scans on the PC's inside the company. Some of the worms going around try to open up so many outbound connections on the routers that it chokes the routers up.

Other than those, it could be anyones guess. Maybe double check with your ISP one what DNS servers you should be using.

Check to see if the router is rebooting at random.

Have the ISP check the lines to see if it's going in and out of synch frequently if it's a DSL line.

Maybe the DSL or Cable modem is going out and is the cause of the problems. Are they having any internal problems such as randomly losing mapped drives or disconnected from shared resources?

 

[LABachlr]

Originally posted by: vi_edit

And just for the sake of argument, let's say they have three computers on the network, all are having issues, and the clean laptop that I bring in has the same issue. What would be possible solutions to the problem?

Could be any number of possible problems.

The first thing I'd consider would be some sort of DDOS against your public IP bringing your router to it's knees.

Second thing would be doing virus scans on the PC's inside the company. Some of the worms going around try to open up so many outbound connections on the routers that it chokes the routers up.

Other than those, it could be anyones guess. Maybe double check with your ISP one what DNS servers you should be using.

Check to see if the router is rebooting at random.

Have the ISP check the lines to see if it's going in and out of synch frequently if it's a DSL line.

Maybe the DSL or Cable modem is going out and is the cause of the problems. Are they having any internal problems such as randomly losing mapped drives or disconnected from shared resources?

Great. Thanks for all of the possible solutions. Not sure if I'll get the gig. Said she would call back. Just wanted to do research before I took the project on. Haven't had much experience with office networks, just with home networks. So, I wanted to make sure that I would be able to handle the job.

Btw, do you know of any links where I could learn about office networks?

 

[Garion]

If all else fails, download and install Ethereal on the box and run a capture. That should tell you EXACTLY what is going on. Just look for the HTTP GETs and see which one is resulting in an error.

- G

 

[LABachlr]

OK. Thanks, G. Will it show the redirects?