Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Can't browse but the internet is working


  • This topic is locked This topic is locked
2 replies to this topic

#1 rumburak

rumburak

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:03:19 AM

Posted 12 September 2009 - 01:27 PM

Hello all,

I have a very strange problem on my Windows XP Media Center (with all updates installed, including IE8): after the boot I can browse internet for a short time (around 5-10 minutes) but after that it is no longer possible to use any browser (tryed IE, Google Chrome e Firefox). I tryed to use other programs and it seems that no program can use the HTTP protocol, although other protocols are working just fine (I still can use skype for video, audio and chat, and can connect with ssh to external servers). It seemed to me that probably some firewall or internet inspection program was blocking the HTTP protocol.
The strangest part is that by using wireshark I found out that each time I try to browse internet there are some IP packets going to the network (as expected) but having as source address strange IP addresses (different IPs changing often and having nothing to do with my network). Those packets have as destination the correct IP address of the website I try to navigate to. This seems quite strange to me, since an web inspector would eventually block access and should not send packets with wrong IP address as source...
Anyone has an idea of what the problem might be?

I am using a wireless link for internet connection (shouldn't matter, since the connection is ok and i can use other protocole) and have Symantec Internet Security installed on the PC. I tried to completelly disable the antivirus and internet security of Symantec but still could not browse internet.
Could it be some strange malware or spyware? Or maybe some system driver corupted???


Thank you for any help.

Rumburak.

BC AdBot (Login to Remove)

 


#2 rumburak

rumburak
  • Topic Starter

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:03:19 AM

Posted 12 September 2009 - 01:44 PM

I studied a little more the wireshark trace and found out that each time I try to browse internet the computer sends out an SYN packet having as SOURCE IP the ip address of the website i requested and as destination address the IP of 209.87.208.60 (a search on whois showed that the IP belongs to Zone Labs - zonelabs.com). Possibly some kind ot Distributed Denial of Service based on SYN flood???? I think this could be some rootkit malware, but have no idea which one and how to get rid of it...

#3 rumburak

rumburak
  • Topic Starter

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:03:19 AM

Posted 12 September 2009 - 02:33 PM

Problem solved. Seems that some zone alarm firewall made it into my pc (included into Cisco VPN client) and for some strange reason stopped working corectlly. I used the instructions at http://lockup.zonelabs.com/CiscoVPN.html and http://lockup.zonelabs.com/8083.html to completely remove vsdatant.sys and everything is back to normal.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users