I am having a problem...with 'www.citicards.com'. I have done all the cleaning/scanning/etc, and I disabled all the spyware and AV programs.
I am connected online via a home network (wireless). I have 3 computers connected through this router. I can connect with two of the computers, but not the main one.

I have installed a new browser (Netscape) and still I cannot connect.

I checked the Host file (C;\Windows\Host and it is empty. I checked the Registry and I found 'citicards.com' and it had a value of "2".

I have had no problem with this site for years, but all of a sudden, 2 weeks ago, it shut down for me.

Can you save me?

george

Is this the only site you are having trouble with??

Rebuild your Winsock Stack.
http://www.cexx.org/lspfix.htm

Set your Security Settings to Default.
Open Browser>Tools>Internet Options

Let us know if it works and we will go from there.

Yes...this is the ONLY site to which I cannot connect. The message is, something to the effect, the 'Page Cannot be found'

I cannot find any DEFAULT choice under the Security tab (Internet Options).

I ran the WinSock2 repair facility, actually, I ran 2 of them...the one you recommended and the 3rd Party utility from the UK. Both found no problems....i.e, there was nothing found to remove.

I am assuming you are running Win98SE right.
What version of IE??
Are you fully up-to-date with Windows Updates??

I'm sorry, I should have provided that information sooner. Win 98 SE; IE 6 SP1. I ran the updates earlier.

What is strange is that I have been accessing this URL for several years now, 2-3X/week. Only in the last few weeks has it 'died' on me. The only thing I remember doing is trying to install the Nero software so that I could burn CDs on a CD burner. The original CD player could not burn CDs. As it turns out, the Nero software overwhelmed the memory (194 MB), so I uninstalled it and installed the Roxio Fast/Easy/Simple software.

I have tried to uninstall Norton System Works 2001, but I get an error telling me that the Uninstall log cannot be found. Maybe something to do with Norton Clean Sweep in Norton Utilities.

OK
It is totally possible the Norton stuff has something to do with the problem.
It is not uncommon for Norton users to have trouble uninstalling.
Norton Removal Tools:
http://service1.symantec.com/support/nav.n...06?OpenDocument

When entering the Security Tab in Internet Tools & Highlight Internet you do not see a Custom & Default Button towards the bottom???

Delete your Cookies and do some Taking out the Trash & see if will let you on.

See this article:
Taking out the trash

See this article:
The Parasite Fight

There are 5 full pages of instructions for removing Norton System Works from my Win 98 OS. Is that realistic? Is tyhere a less protracted way of doing this?

Did you see this:

http://service1.symantec.com/SUPPORT/nip.n...=&osv_lvl=&seg=

It appears that your reference is to removing the Norton Internet Security and Norton Firewall. I don't think I have either. I have Norton System Works, and SAV8-Corporate version.

Should I use this utility to remove Norton System Works 2001?

Ya I forgot & am getting into to big a rush.

Hold on
Don't use it.

The 'Default' option under the Security tab, is 'greyed' out. I cannot select it.

That means it is already set to default.
Click on Intranet, Trusted Sites, Restricted Sites & make sure they are set to default too.


Here use this SYMClean utility to rid yourself of Norton System works.
http://service1.symantec.com/SUPPORT/nsw.n...001101612274407

Go to Add & Remove Programs and Uninstall anything that has to do with the Norton System Works that will remove then use the SYMClean utility.


Never heard of this one.

Sure it isn't Corporate Edition 8.x
How to manually uninstall the Symantec AntiVirus Corporate Edition 8.x for Windows 98*Grinler client
http://service1.symantec.com/SUPPORT/ent-s...=&osv_lvl=&seg=

Trying to remove NSW 2001 gives me the following error:

161: Uninstall log folder not found.
HKEY_Local_Machine\Software\Netscape\Netscape\8.1.0.0(en-US)\Uninstall\Uninstall Log Folder.

SAV 8+ is: 8.1.1.319

Do you still use and keep updated System Works??
When we get done this may or may not fix the problem.

See if you can open this page.
http://www.citibank.com/us/cards/cardserv/...protect.htm#128

I am puzzled at why you can open all other sites but this one.

For the link you suggested...."Page Cannot be Displayed"

For your information, I could not also connect to www. ('citigroup', 'citimortgage', 'citibank').com. But I can connect to 'www.citifinancial.com'.

I am still trying to 'clean NSW 2001 from my computer.

Yes, I have been keeping up with the updates.

And, I have been accessing this site almost every other day, for over 5 years.

I tried to connect to the URL you recommended and I get "Page Cannot be Displayed".

I thought I responded to the previous message.

Just a shot in the dark here.

Have you tried adding it to "Trusted Sites"?
Internet Options > Security Tab > Trusted Sites

As coincidence has it I just got back from a customers home that has the same problem.
3 computers 2 wireless 1 wired, he can not connect to his banks home page (not secure) but can connect to the sign-on page (secure page). I wired direct from the modem to 1 computer and bam connected. So we narrowed it down to router confi. problem. He has a Linksys router, reset the defaults called Linksys, tried a different Linksys router, same problem.

This probably does not have anything to do with your problem since you can connect with 2 computers just not the problem 1. Just thought I would mention this problem has come up 2 times in 1 week...

To add to what Scarlett has suggested also dump your cookies if you haven't already.

How is the uninstall of Norton coming any problems??

Good suggestion.

I have/had added 'https://www.citicards.com' to my trusted sites and it makes no difference.

When I check the Registry for 'citicards.com', I show it has a value of 2 (4=blacked).

I, too, have a Linksys Router. I am going to disconnect the power and power it up again.

I dumped all the cookies; also, I emptied the Temp Internet Files and cleared the History.

I have to leave for a business trip tomorrow afternoon and won't be back until Mar 19....but I will be in touch since I will be taking my laptop.

Thanks guys.

polaris6

Good luck and safe trip.
And yes please do keep in touch.

I am doing some checking into the www.citibank.com in the registry.
Tell me what key & path it is listed under.
I am wondering if for some reason it got added to a block list.
Do you run Spyware Blaster, SpyBot S&D, SpyAd or anything that adds to your restricted sites.

If we don't solve this problem before you leave, it will be a good test to see if you can get on using a different connection while you are gone.

Here is the key info: HKEY_Current_User?Software/Microsoft/Windows/Current User/Internet Settings/Zone Map/Domains...citicards.com...default (value not set)....https 0x00000002(2)

I do have SpyBlaster, SpyBot and Ad-Aware. I checked the restricted sites on SpyBlaster and Spybot and found nothing.

I tried to run TrendMicro and it ran the spyware program, but required Java to run the 'House Call'. I could not get the computer to d/l the java software, so I have not been able to complete the TrendMicro scan (House Call).

I know you guys are trying and so am I. I really appreciate all the effort.

polaris6

OK
That is what I was thinking.
This is the Host computer on your network right.

Fix:
Navigate to the Citibank.com key in the reg. click on it>Export it to a safe place>File>Export
Right Click it and Delete>Click Find Next to see if there is any more in ZoneMap/Domains
Do not delete the ones found in the Right Pane.

Close the Reg.>Restart>Let me know if it worked.

Sorry about the quick and short post, I was in a bit of a rush.

Let me know if there is something you don't understand.

This registry key ZoneMap/Domains is where your restricted sites reside so you don't want to delete anything you don't want blocked.

It appears that some real time spyware programs that add sites to the restricted sites will on occasions add sites that trigger them to think they need to be blocked.
They say Spyware Blaster will do this rarely.

Sorry I didn't find this out earlier.
Hope that solves your problem.

It solved the problem on the one I was working on earlier.

<<Edit>>
Thanks Scarlett for removing that double post.
Not sure how it happen, just hit the button once...

I have a wireless router to which there are 3 computers 'routing' through it. One desktop and 2 laptops. The laptops are in and out. I don't know if there is any Host computer since the router treats all computer connected to/through it the same way.

However, I did delete 'www.citicards.com' from the Registry (after exporting it); I tried to find more but didn't. I restarted the computer and tried to connect to that URL and got the same results as before: "Page Cannot be Displayed".

I imported the exported file (www.citicards.com) into the Registry and tried again....same result.

This has really puzzled me.

Did you leave it deleted??
If so restart again, this has to be the problem.
Did you search the whole registry and that is the only place you found it.
When searching just type Citi then it should find everything with Citi in it.

I don't think it is a spyware or malware problem.
What was the error message when trying to d/l Java??

I found 2 'citi' sites, 'citicards' and 'citibank'. I exported, then deleted both. Restarted and tried again. Same result.

I tried this morning to install the Java software again. I can d/l the file and save it, but when I try to open it I get a message that it (the file) is not properly archived, or something like that.

I am off this morning doing something with the grandchild. I should be back at the computer after 1:00 TODAY.

Thanks again.

polaris6

How did the Norton uninstall go??
Did you reinstall it??

Go to Control Panel>Internet Options>Advanced>Reset Defaults

I am researching the Java problem.
Catch the exact error message.
Installation Instructions
http://www.java.com/en/download/help/index_installing.xml

Switching between the Microsoft VM and the Sun Java Runtime Environment (JRE)
http://www.java.com/en/download/help/5000020100.xml

Configuration:
http://www.java.com/en/download/help/index_configuration.xml


Enjoy the day with your grandchild, they are only young once.

More information I run across:

Description of Internet Explorer security zones registry entries.
http://support.microsoft.com/?kbid=182569

Certain Web sites and HTML Help features may not work after you install security update 896358 or security update 890175.
http://support.microsoft.com/kb/892675

I have not uninstalled Norton yet because the computer is used quite heavily during the day and to be without virus protection might be worse that the problem we are having not being able to connect to a single site.

I tried to run TrendMicro again and it gets hung up just initializing. I think it thinks that the jave plug-in is already installed and it keeps chasing its tail and not getting anywhere (45 min...so I cut it off).

I could not get the d/l from 'java.com to work...more on that below. I was able to find several place by Googling that state that they had the freee d/l. One was FreeJava1.01_T2004.08.20.zip (80.9 KB). When I tried to open/unzip this file I get the following message:

Winzip Wizard cannot open this file; it doesn't appear to be a valid archive. If you d/l this file, try d/l again. If you want to add the file to an archive, first create or open the archive, then drop this file again (I have no idea how to do that).

Now, if I go to 'java.com' and try to d/l the free java stuff, I get the 'Page cannot be displayed' message again. It is trying to connect to one of the following 2 urls:

http://jdl.sun.com/Webapps/downloads/AutoDL?Bundled=10243

or,

http://......../Webapps/getjave/BrowserRedirect?locale=en&host=www.java.com


Thanks for all your help.

Polaris6

I wouldn't trust downloading any Java from any site other then Sun Microsystems.
http://www.java.com/en/

You have probably got Microsofts VM. If not look in Add & Remove Programs for a Java instalation.
Go to Control Panel>Internet Options>Advanced Tab>Set Defaults

As for Norton, if you still use it and keep you subscription up-to-date I wouldn't remove it for it is probably not the problem.
Here are some free utilities you can use to check for spyware & malware.

Show all Files & Folders
http://www.bleepingcomputer.com/forums/ind...showtutorial=62

Panda Online Scanner
http://www.pandasoftware.com/activescan/ac....asp?Language=2

Bitdefender Online Scanner
http://www.bitdefender.com/scan8/ie.html

McAfee AVERT Stinger
http://vil.nai.com/vil/stinger/

Ewido (free Trojan Scan)
http://www.ewido.net/en/download/

Post back what you find if any.

I learned that I will be here for another day. So if you have anything, send it on.

polaris6

Did you run any of the online scanners to see if by chance it turned up anything??

Disable any real time protection running in the background except the firewall and try to connect.

Hook the computer directly to the modem via Cat5 cable (bypass the router) try to connect.

Did you find any Java instalation in Add & Remove Programs??

Post the exact error message you get when trying to d/l Java.

1. When attempting to d/l jave from java.com, I receive the 'Page Cannot be Displayed ' message, the same message I get when trying to connect to 'www.citicards.com'.

2. I tried to use the Panda link, but when I click on the 'moving' icon in the middle of the page, the system 'locks', and nothing happens.

3. I tried the next link (BitDefender)in line and it is working now. It will take some time to finish.

4. Connecting the computer to the modem is impractical because the modem and computer are in diffferent parts of the house. The desktop in the 'office' and the modem in the central part of the house.

5. I did not find and java stuff in the Add/Remove Program section of the Control Pane

Found 1 virus so far (Minibug).

I ran the BitDefender and McAfee scans (I couldn't get the Panda Scan to work...message ...like an error has been encountered...tried 3X).

Found 5 viruses; cleaned/deleted 4. It said the computer was still infected. I don't really know what to do about that.

I ran the Windows update and it found 2 items that needed updated.

The Ewido link is for Win 2K and later.

After each of these operations, I restarted the computer and tried to log on to the citicards url with no success.

We may have been approching this problem from the wrong angle.
It is concerning me that you are unable to connect to these online scanners.
That is the most common practice of spyware & malware, block the scanners from loading & running.

Run these, if possible: (links in my previous post)
McAfee AVERT Stinger
Ewido (download the trial version) (update & run)

Let me know what they find.

Our next step will be to get you to post a HJT Log (in the HJT Forum).

Be sure to read the Preparation Guide for use before posting a HijackThis Log and submit it to the appropriate forum. HJT Forum links provided below.

Preparation Guide for use before posting a HijackThis Log
http://www.bleepingcomputer.com/forums/topic34773.html

HJT Forum
http://www.bleepingcomputer.com/forums/Hij...alysis-f22.html

This will tell us if you are clean.

OK
I should have checked on Ewido compatability.

Try to connect to Trendmicro & Panda now that 4 viruses have been removed.
or
Go onto the posting a HJT log on the HJT Forum.

I sent the HJT log to the other forum.

I tried TrendMicro again and it has 2 kernels. I could get neither one to work. One requires the Java1.5 plug-in and when I try to get that installed I get the message:

'The Installer cannot proceed with the current Internet Connection Proxy settings. Please check the Installation Notes for more information'

I don't know where to look/find the Installation Notes. Security is set to 'Medium'.

When I try to install the Java software from the Jave.com site, I get the following message:

'Page Cannot be Displayed'

They stay pretty busy in the HJT Forum, lets sit tight till someone takes a look...

While you are waiting, take a look in Add & Remove Programs and see if you see anything like My Search, Myway Search or something similar and remove them.

Well I see you got a clean bill of health from the HJT Log.

I think pskelley is on the same page with it has to be some problem with the security settings.

Can you offer an update??
I am not one to give up.

I have returned 'home'.

I checked the Security settings and that cookie is not blocked, I should say that a cookie with the name 'citicards.com' is not shown to be blocked in the Privacy section.

I disconnected and reconnected the power to the Router and the Modem for a few minutes and rebooted, with you change in the status of this illusive issue.

george (polaris6)

I have reinstalled IE6 SP1. No change.

Should I import' those two URLs back into the Registry that I exported over a week ago?

Don't mean to interupt...

Can you try to access 192.193.217.120

That is the ip address of citibank. Does that work? Can you take a look at c:\windows\hosts in notepad and see if citibank is listed?

rigel

Thanks for the 'butt in'. I need all the help I can muster.

I tried connecting via the IP address with the same result 'Page Cannot be Displayed'.

The Hosts file is empty.