October 24th, 2004 07:27 PM
valhallen - That is Altavista.
I think I've found the problem as you've mentioned it: AltaVista Transversal. Why Norton blocks it makes absolutely no sense to me; the vuln doesn't apparently affect you or anyone who uses Altavista. It seems to affect Altavista only, but I don't understand it. The only web server I know that had a form of unauthorized directory transversal was IIS4, so this "patch" is completely useless today IMHO.
What you need to do is disable the signature for this. I'm not 100% sure how to do it, but apparently you go to "Intrusion Detection", click "Signatures" so "Intrusion Detection Signatures" pops up, click "AltaVista Transversal" signature, and hit "Exclude". That should let you browse AltaVista again. Good luck.
(BTW, your ping results mean that DNS was successful at resolving the name to the IP. But the no response part or timed out part meant that something was blocking you from connecting to that IP, or they don't respond to pings. We know that they do infact respond to ping queries, so it meant that something else was blocking it - probably Norton.)
October 24th, 2004 08:23 PM
Thanx for the info on pinging.
Yeah, as I said at the start of this thread, I really have this gut feeling this thing is related to AltaVista traversal.
I've gone into Norton "Intrusion Detection", Configure, Instrusion Dectection tab, Advanced and uncecked the altavista traversal box. It says "uncheck signatures Intrusion Detection should not monitor" BUT surprise, surprise, I still cannot access altavista. Have I done all I should?
I am wondering if Windows XP could be blocking this thing? I doubt it cos I do not have the Windows firewall activiated, only Norton but who knows?
Does anyone at all know?
I've emailed Symantec. I can't beleive that I have to wait 5 days to get a reply from them after havng spent $70US on the 2005 Internet Security software. I wonder what they will come up with.
October 25th, 2004 02:14 AM
in this case not getting a reply doesn't mean anything because 126.96.36.199 doesn't return a ping. its not DNS its the server itself.
can i suggest that your turn on the XP firewall to protect your computer from worms and turn off symantec to see if in fact it is symantec blocking it.
Bukhari:V3B48N826 “The Prophet said, ‘Isn’t the witness of a woman equal to half of that of a man?’ The women said, ‘Yes.’ He said, ‘This is because of the deficiency of a woman’s mind.’”
October 25th, 2004 07:47 AM
Tedob1 - We were trying to ping an AltaVista Search server to see if something was blocking his packets. Since ping resolves a hostname to an IP via his ISP's DNS server, we know that he isn't having DNS issues. Since his packets were dropped for some reason on a computer that is known to respond to pings (I've double checked the AltaVista owned IP he listed - 188.8.131.52 does return a ping) we know DNS works but something else doesn't. Just trying to clarify what may have been misleading in the text above.
Carla - Do you use Internet Explorer or FireFox/Mozilla? I've been reading ( http://www.marketingblog.com/archives/2004/03/ ) stuff that says Norton has been blocking a ton of things for Internet Explorer users. If you install and use FireFox/Mozilla, maybe you can access AltaVista again? I'm not entirely sure if it will work though, since even you ability to ping www.altavista.com is blocked...so it could be somewhat of an even lower level issue...
Give Tedob1's suggestion a try if you feel like you are up to it. Make sure Windows XP Firewall is blocking all incomming packets before connecting to the Internet though. Good luck and hopefully Symantec will reply to your e-mail soon with something helpful...
October 25th, 2004 10:48 AM
I started with Internet Explorer but when I first started having trouble I downloaded Netscape (YUKK!) and Mozilla which is what I now use. None of these Browser can access altavista.
I will try the suggestion about turning off Symantec to see if I can access altavista later. Gone to school now - have a full day ahead.
October 25th, 2004 11:37 AM
If you have activated the SpyBot immunisation, you will have the "Resident Shield" running.........it is a little icon of a page with a padlock on it in your system tray. Right mouseclick on it and exit it. I have heard of conflicts between it and some Norton products.
You might consider getting Zone Alarm free edition. Set it up so that it DOES NOT start on boot up. Then start it manually with Norton and the Windows firewall OFF and BEFORE connecting to your ISP. It will protect you from worms whilst you run that test.
If you cannot do someone any good: don't do them any harm....
As long as you did this to one of these, the least of my little ones............you did it unto Me.
What profiteth a man if he gains the entire World at the expense of his immortal soul?
October 25th, 2004 03:14 PM
Hmm... your hosts file is perfectly normal. And as other people have already stated, altavista.com resolves, but is blocked somewhere else. There is one more thing I'd like you to do, run the following command at the command prompt and post the response here:
C:\> tracert altavista.com
October 26th, 2004 01:30 AM
Remember I am not just a newbie but totally clueless as well!
To enter this command you suggested at the C propmt do I jsut enter it as the computer is booting up and I see the c prompt flash? Is that it? How do I get to enter this command? C:\> tracert altavista.com
October 26th, 2004 01:47 AM
The IT desk at school suggested that I get altavista from this site.
I am also going to try that
October 27th, 2004 02:16 AM
I've tried everything. No go.
I notice that when I set Norton to alert me if an unknown program is trying to launch using another program I get a whole ton of repeated alerts. I have no idea which program is doing this. The only information that I figure might be useful is that Norton consistenly indicates that the remote address is 184.108.40.206:53
Is this significant? The local address varies somewhat.