[CLOSED] Trouble at the library

Container for RESOLVED incidents, queries SOLVED by the experts, EXPIRED topics or those that have been CLOSED by the users.
kwyjibo
Registered user
Registered user
Posts: 6
Joined: Thu, 05 Nov 2015, 01:53

[CLOSED] Trouble at the library

Post by kwyjibo » Thu, 05 Nov 2015, 02:15

Starting a couple of days ago, I have been unable to use the web at my local library. I don't know if it's a Panda issue or some other problem, but others don't seem to have the same problem. Also, the redirect I get has some panda in the URL, which makes me suspicious.

Whenever I open a web page, I get redirected to a "Not Found" page. For example, when I try to access developer.android.com, I get redirected to:
The page I see shows:
Not Found
The requested URL /yhs/errorhandler was not found on this server.
In troubleshooting the problem, I found that my DNS server list was set to:
66.28.0.14
66.28.0.61
8.8.8.8
8.8.4.4
I did an nslookup, and found that no matter what hostname I looked up, the address came back as 173.45.161.113.

As a workaround, I set my DNS servers to the static addresses of 8.8.8.8 and 8.8.4.4, and it started working. I'd prefer not to override DHCP in general, so I don't see this as a permanent solution. Do you have any other suggestions?

User avatar
VirusBuster
Official moderator
Official moderator
Posts: 7595
Joined: Mon, 02 Apr 2012, 18:53
Location: Panda HQ - Bilbao

Re: Trouble at the library

Post by VirusBuster » Thu, 05 Nov 2015, 11:02

It seems that the primary or secondary DNS servers are not properly resolving

How did you check the DNS? through ipconfig command? or through the network connection properties?
Can you check the DNS settings in your router and leave only the Google ones (8.8.8.8 and 8.8.4.4)?
Regards,

Image
Jorge Torre
TechSupport Department - Panda Security

I don't reply to private messages unless I have previously requested them

kwyjibo
Registered user
Registered user
Posts: 6
Joined: Thu, 05 Nov 2015, 01:53

Re: Trouble at the library

Post by kwyjibo » Thu, 05 Nov 2015, 18:01

Yes, I checked my DNS settings through ipconfig, and changed them with the IPv4 connection properties. As for the router config, that belongs to the library, and I have no way of verifying their configuration.

But as I mentioned in the original post, when I overrode the servers received from DHCP, and explicitly added just the Google servers, it worked correctly.

My suspicion, and I've seen configurations like this before, is that the primary DNS servers always return the address of some kind of kludgy firewall. When the firewall receives a request for some other host, it pulls the intended address from the request, runs it through access filters (or whatever), and then either fixes up the layer-3 address or does some kind of redirect.

Obviously, on my laptop, it's not working correctly. Everyone around me seems to be working just fine. Given the strange URL that I'm redirected to, I'm wondering if Panda is somehow involved. I'm definitely not accusing Panda of causing any problem; it's more likely that Panda is doing something valid but unusual and the firewall-or-whatever isn't robust enough to handle it. But we have to start somewhere.

User avatar
VirusBuster
Official moderator
Official moderator
Posts: 7595
Joined: Mon, 02 Apr 2012, 18:53
Location: Panda HQ - Bilbao

Re: Trouble at the library

Post by VirusBuster » Thu, 05 Nov 2015, 18:24

What Panda product and version are you using? You can check the version in the version.ini file located in the antivirus installation folder

Try uninstalling Panda Security Toolbar and let us know the results
Regards,

Image
Jorge Torre
TechSupport Department - Panda Security

I don't reply to private messages unless I have previously requested them

kwyjibo
Registered user
Registered user
Posts: 6
Joined: Thu, 05 Nov 2015, 01:53

Re: Trouble at the library

Post by kwyjibo » Fri, 06 Nov 2015, 00:31

Okay, I'm a bit confused now. I uninstalled Panda Security Toolbar via the "Programs and Features" control panel and things work fine. I did an nslookup against 66.28.0.14, and got "Query Refused". I tried using 66.28.0.61, and got the correct address. I'm not sure what it means.

I wanted to reinstall the Toolbar, but couldn't find it. I used the original installer, which just repaired my Panda Internet Security installation, but didn't add the toolbar. I can't find a separate installer for the toolbar on the Panda website either.

At any rate, before I started, I recorded the versions. The Panda Internet security is version 15.01.00.0006. The Toolbar was version 4.3.0.3. I hope that gives you something to go on.

User avatar
VirusBuster
Official moderator
Official moderator
Posts: 7595
Joined: Mon, 02 Apr 2012, 18:53
Location: Panda HQ - Bilbao

Re: Trouble at the library

Post by VirusBuster » Fri, 06 Nov 2015, 09:51

You should find the toolbar installed inside the tools folder in the antivirus installation folder
Regards,

Image
Jorge Torre
TechSupport Department - Panda Security

I don't reply to private messages unless I have previously requested them

kwyjibo
Registered user
Registered user
Posts: 6
Joined: Thu, 05 Nov 2015, 01:53

Re: Trouble at the library

Post by kwyjibo » Sun, 08 Nov 2015, 00:40

Ah, thanks. I've just reinstalled the toolbar. I'll try to get to the library on Monday and try it out again, to see if something has changed and things magically start working. I'll follow up again once I've tried it.

Oh, and if I haven't said so already, thanks for all your quick responses and insightful help! This seems to have been one of the most useful message boards I've seen in a while.

kwyjibo
Registered user
Registered user
Posts: 6
Joined: Thu, 05 Nov 2015, 01:53

Re: Trouble at the library

Post by kwyjibo » Sun, 08 Nov 2015, 20:47

One more point of data. I haven't been to the library yet, but I've tried doing an nslookup from home since reinstalling the toolbar. My DNS server list is just 192.168.0.1 (which, of course, is my home WiFi hot spot). Again, no matter what address I look up, I get back 173.45.161.113. In this case, the hostname for developer.android.com gets returned as developer.android.com.hsd1.ca.comcast.net.

At home, I am still able to access various web sites as if the address returned were correct. I suspect that once I go back to the library, I'll see the same failures that I saw before, but I'll still try it and let you know.

So going on that assumption, my guess is that some firewall in the library is doing some "innocent" URL mangling or other request modification that my home router isn't doing, and the server at 173.45.161.113 can't handle it. If that's the case, is there any further debugging that I can do which would help track down the problem? In the worst case, I do have Wireshark installed on my laptop, and can extract the raw request. It won't tell me what the library is doing to the request, but it's a start.

User avatar
VirusBuster
Official moderator
Official moderator
Posts: 7595
Joined: Mon, 02 Apr 2012, 18:53
Location: Panda HQ - Bilbao

Re: Trouble at the library

Post by VirusBuster » Wed, 11 Nov 2015, 12:13

Just been re-reading all the topic
If you are using Panda Internet Security 2015, you don't need the Panda URL Filtering included with Panda Security Toolbar as the SafeBrowing protection included in the antivirus itself does just the same, so you may be double filtering by having Panda URL Filtering also installed

Uninstall Panda URL Filtering and let us know the results
You can keep Panda Security Toolbar if you want
Regards,

Image
Jorge Torre
TechSupport Department - Panda Security

I don't reply to private messages unless I have previously requested them

kwyjibo
Registered user
Registered user
Posts: 6
Joined: Thu, 05 Nov 2015, 01:53

Re: Trouble at the library

Post by kwyjibo » Wed, 11 Nov 2015, 19:52

How do I uninstall Panda URL filtering? The only way I found to do that was to uninstall the toolbar itself, and then select uninstall URL filtering from the uninstaller.

But if I understand correctly, I don't need the toolbar at all if safe browsing is turned on. If that's the case, I'd just as soon remove the toolbar and be done with it. Is that correct?

Locked

Return to “Consumer 2015 + Gold Protection + Internet Protection - Archive Issues”