id="info"

Question

Locked

Can't access HTTP, Can access HTTPS--What's wrong here?

By planetearth ·
Hello, all! I sure hope someone can help with this.

One of my client's PCs started having a problem last week. Long story short, the user can't acces HTTP sites using IE 7 or Chrome after the PC has been on for 5 minutes, but she CAN access HTTPS sites as well as use FTP, e-mail and other Internet-related apps. If she reboots, she can access HTTP sites again, but only for a few minutes. Then she gets the "Page cannot be displayed" error.

I connect to the PC via TeamViewer, LogMeIn and/or GoToMeeting, which work fine. The client has no XP installation CD or backup, so I'm limited as to what I can try. I also can't run the Windows System File Checker because she has no disc.

There is no proxy server showing in IE 7 on her Windows XP SP3 PC. I suspect it's a proxy server issue, but even if I force IE to use a proxy server, she can't access HTTP sites. Nothing is selected/ticked/checked in IE for proxy server use or "automatically detect settings", and enabling any of that stuff doesn't help. I'm assuming there could be a file or Registry corruption, though I can't confirm it since I can't run SFC.

This was probably caused by virus/Trojan infections (Trojan.Tracur, specifically), but I've removed all traces of the virus with AVG Internet Security and Malwarebytes.

I've done everything I could try, including:
-Reset IE 7/Disable add-ons
-Windows XP Network Diagnostics returned Error 12029
-Reset TCP/IP stack
-Reset Winsock
-Remove/re-install Intel NIC in Device Manager; Update NIC driver
-Reset Windows Firewall

I've reset everything I can except for the core Windows system files because she doesn't have her XP disc or a backup. There are no System Restore points before the virus infection date (even though System Restore is enabled), so I can't revert to that.

She's going to try "Safe Mode with Networking" to see if she can access HTTP sites for longer than 5 minutes; I'll let you know how that goes.

Does anyone have any idea what else I can do here?

Thanks in advance!

Steve

UPDATE: The PC works just fine in Safe Mode. The user has no problems accessing HTTP sites for as long as she wants to in Safe Mode. I found no entries in the Registry as to what might be running on startup. CHKDSK found some 1408 index-related disk errors and fixed them, but nothing serious. Fixing those errors didn't help.

This conversation is currently closed to new comments.

41 total posts (Page 3 of 5)   Prev   01 | 02 | 03 | 04 | 05   Next
| Thread display: Collapse - | Expand +

All Answers

Collapse -

Try Combofix?

by Too-Tired Techie In reply to Can't access HTTP, Can ac ...

I've seen this utility from Bleeping Computer clean up a system that nothing else would clean. Be sure to only download it from www.bleepingcomputer.com and run it under safe mode. And you have to disable any running AV software...

The five minute thing sure sounds like a trojan/virus phoning home etc.

http://www.bleepingcomputer.com/download/anti-virus/combofix

Collapse -

Reponse To Answer

by planetearth In reply to Try Combofix?

That was the first thing I used, actually. ComboFix said it fixed everything it found, and it found a few infections.

Collapse -

Several things to try

by TomRobinson In reply to Can't access HTTP, Can ac ...

1. Does HTTP start working again after logging off and on again, without rebooting?
2. Does HTTP work when logged on as Guest?
3. Try "telnet google.com 80" and see if the connection fails.
4. If connection works, enter "GET /" in uppercase. You should get some kind of response.
5. Install Fiddler, then try the browsers again. Fiddler acts as a proxy, and if it cannot connect to the server, the browser shouold display a useful error message. Fiddler is a great tool for HTTP debugging.

Collapse -

Reponse To Answer

by planetearth In reply to Several things to try

HTTP won't start working again without a reboot.
I haven't tried as Guest, but I will.
Telnet didn't work once HTTP stopped working.
Fiddler give me a LOT of information, but just installing it didn't help. It's showing me what's happening when IE or Chrome can't access a Website, but not specifically why. I used it to "Clear WinINET" cache and cookies.
Fiddler also shows me Chrome is trying to connect to some randomly named hosts when it starts. I renamed/recreated the HOSTS file, rebooted, and Chrome still wants to connect to randomly named hosts that Fiddler can't resolve using DNS searches.
Unfortunately, since I've never used Fiddler before, I don't know if this is legitimate. It appears not, but I'm not sure.

Collapse -

winsock fix xp

by peary In reply to Can't access HTTP, Can ac ...

Have you tried winsock fix xp? you can download it here http://majorgeeks.com/WinSock_XP_Fix_d4372.html.

It can fix winsock problems that occur after removeing malware

Collapse -

Reponse To Answer

by planetearth In reply to winsock fix xp

Tried that three times. No help unfortunately, but thanks!

Collapse -

Try creating a new user profile

by cpguru21 In reply to Can't access HTTP, Can ac ...

I have often seen user profiles that are left corrupted after a virus attack. In a situation without backups/install media, I have used this to success after removing infections.

HTH

Collapse -

Reponse To Answer

by guillermogarciajr In reply to Try creating a new user p ...

I second this. It's worked for me many times in the past.

I had a similar situation a few years back and this is how i got around it.

I still recommended reloading the PC but the customer didn't want to. To this day, he is still running on that same load.

I hope this helps you.

Collapse -

How do you bill for this

by tomi01 In reply to Can't access HTTP, Can ac ...

I've gone through this several times with clients and in the end I just cap the amount to charge and put the hours in just for the challenge to figure it out and fix it.
But check for Rapport software having been installed and removed. It has been the culprit on several occassions. Also I agree with all the excellent suggestions above, it about covers the base of everything I could think of and so much more. A great thread!

Collapse -

Reponse To Answer

by planetearth In reply to How do you bill for this

I usually cap the bill, too. Unfortunately, I've never had to spend this much time on something like this!
Thanks for the suggestion on "Rapport". I'll look into it.

Back to Networks Forum
41 total posts (Page 3 of 5)   Prev   01 | 02 | 03 | 04 | 05   Next

Hardware Forums