Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Connections good but no pages load


  • Please log in to reply
9 replies to this topic

#1 dcook22

dcook22

  • Members
  • 13 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:05:55 PM

Posted 26 September 2009 - 07:56 PM

Hi all,

I posted this in the Web Browsing/Email and Other Internet Applications forum and it was suggested that I post it here. Here's what's been said so far:

**********original post*************

Hi all,

I have a friend's laptop here that's having some issues. He brought it to me infected with Windows Police Pro virus/malware. I found a fix here at bleepingcomputer.com. I DL'd some registry fixes and was able to access the task manager to stop the necessary processes thus allowing me to access the internet and run programs. I DL'd Malwarebytes and ran it. The virus seemed to be successfully removed along with many other cookies and other adware.

The problem now is that when I try to access the internet, the computer can't download pages. I have tried wireless (both from a broadcasting network as well as manually creating access to a non-broadcasting network). I have tried a direct connection. I have tried letting windows control his wirelessnetwork card, as well as allowing the Intel software to run the card.

NOTHING.

It's really weird because when i was fixing the laptop, I had internet access. After Malwarebytes ran, I rebooted and still had connectivity. It wasn't until he brought the laptop home and tried to use wireless networking that he had the first problems. He brought the PC back to work and now it won't work on the office wireless, nor when I plug a cat-5 right into the back of the machine.

Another strange thing is that when I view his network connections in My Network Places, the connections show as enabled and connected at 54 mbps.

For all intents and purposes I should be accessing websites, but I get nothing.

We're running windows XP Home (don't know the service pack, but I can find out), and Internet Explorer 8.

I installed Firefox and still could not connect so it doesn't seem to be an IE issue. I also disabled the firewall so that shouldn't be in the way.

All I'm thinking is that maybe one of the automated registry fixes did something I'm not aware of, however, I did access the internet after a reboot once the computer was "fixed". It's very strange.

The only thing I can think of that I haven't done is uninstall the network card and reinstall because I don't have the drivers. I can find them if need be, but if I don't need to do that I'd rather not.

Thanks in advance for your help with this non-connective mystery.

Dan

**********end original post**********

First reply:

Try running "netsh winsock reset catalog" from the CMD prompt and then "netsh int ip reset reset.log"
(Don't use the quotes)

This will reset the network sockets in Windows. Sometimes they get screwy. These two commands fix a "no internet but connected to the network" issue maybe 25% of the time for me. It's almost always a setting somewhere that's preventing internet access.



My reply:

Thanks for the reply possum.

Unfortunately it had no effect. I did notice something, though. Microsoft messenger attempts to connect when the PC boots up. It isn't able to connect to the internet either, so I'm pretty sure this is not a browser setting issue. I'm thinking there might be a registry tweak that needs to be done. Any other thoughts? Any help is appreciated as I have no idea what needs to be done.

Thanks.

Dan


2nd reply:

Well, unfortunately, this type of issue is common. I see it a lot from customers and it seems to be a different solution every time. More than once, I've had to do a full recovery to get the computer back online. Hope its not the case for you though.

Have you tried turning off all the automatic TCP/IP settings and manually setting the IP address, subnet, and gateway?

Also, you may want to post this in the Networking forum. You might get more help there. And, don't stop googling the issue because there are tons of topics in hundreds of forums with this same problem. You might come across the answer.


My final reply before posting here:

OK, some new information:

I tried forcing a connect to Windows Live Messenger. When it didn't work, it offered to troubleshoot. I rant the troubleshooting wizard and I got a warning icon for a test referring to ports.

Is it possible that port 80 is somehow not functioning? My router is fine as three other PC's in my home can access the internet. Can a computer or NIC be shutting down port 80? Since neither the wireless nor the wired NIC are accessing the internet, again I think it's something in the OS. Is there something in the registry that allows ports to open or close?

I'm sure I sound like a dunce here, but I'm grasping at straws.

Thanks.

Dan


That's it so far.

Any help is appreciated.

Dan

BC AdBot (Login to Remove)

 


#2 dcook22

dcook22
  • Topic Starter

  • Members
  • 13 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:05:55 PM

Posted 28 September 2009 - 10:33 AM

Helloooo? Anyone?

#3 CaveDweller2

CaveDweller2

  • Members
  • 2,629 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:05:55 PM

Posted 28 September 2009 - 04:15 PM

Sometimes cleaning a virus off a PC is worse than just formatting and installing fresh. Because there is never any way you can be 100% sure you've gotten it all.

When its connected via cat5, can you ping websites? have you done an ipconfig /release and then ipconfig /renew, if not try that is it getting an IP address? What firewall is on the machine? Make sure its not blocking something. Most firewalls will lock down the internet if something goes wrong with them. Have you tried booting to safe mode and see if you can surf?

Hope this helps thumbup.gif

Associate in Applied Science - Network Systems Management - Trident Technical College


#4 syscorpsecure

syscorpsecure

  • Members
  • 118 posts
  • OFFLINE
  •  
  • Local time:04:55 PM

Posted 28 September 2009 - 04:43 PM

Try this to make sure you don't need to uninstall and reinstall the drivers for the networking card:

From a command prompt, type: ping 127.0.0.1

This checks to see if TCP/IP is installed properly and is the same thing as typing ping localhost from the command prompt.

The reason you want to do this is twofold. First, you want to see if the network driver has the TCP/IP protocol bound to it (i.e.: TCP/IP can talk to this device). Second, if something is wrong and TCP/IP is screwed up on this connection, this will immediately tell you.

In order to tell if it was successful, look for the following:

Reply from 127.0.0.1: bytes=32 time<1ms TTL=128

You should see 4 lines (called echo replies) and at the bottom you'll see:

Ping statistics for 127.0.0.1:
Packets: Sent = 4, Received = 4, Lost = 0 (0% Loss),
Approximate round trip times in milliseconds:
Minimum = 0ms, Maximum = 0ms, Average = 0ms

If you get anything other than Sent = 4, Received = 4 you might have a problem with the TCP/IP installation. If it says Sent = 0, Received = 0 you need to uninstall and reinstall the network adapter. To be safe, if you have a wired and a wireless network adapter, do the same for both.

If you get 4 packets sent and received, you need to move up the TCP/IP food chain. Now that you've verified you can ping your installed adapters and TCP/IP is bound correctly, you need to verify that the computer can resolve hostnames (i.e.: translate an IP address to a computer name via DNS).

If step one is successful, type ping localhost - note the name and not the IP address.

If you get the same feedback as in step 1, then DNS is working and the problem is in your Winsock (TCP/IP) software and not the network adapter. If could very well be that you have what is known as an LSP (Layered Socket Provider) that is intercepting all of your TCP/IP traffic. It happens a lot when spyware is installed. It's pretty much the same as someone wiretapping your computer and intercepting all of your network traffic bound to and from the Internet.

Try the steps above and post back with the results. I'll try to help you as much as I can, but DO NOT wipe your hard drive just yet. There may be an easier solution.

#5 dcook22

dcook22
  • Topic Starter

  • Members
  • 13 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:05:55 PM

Posted 28 September 2009 - 09:10 PM

Sometimes cleaning a virus off a PC is worse than just formatting and installing fresh. Because there is never any way you can be 100% sure you've gotten it all.

When its connected via cat5, can you ping websites? have you done an ipconfig /release and then ipconfig /renew, if not try that is it getting an IP address? What firewall is on the machine? Make sure its not blocking something. Most firewalls will lock down the internet if something goes wrong with them. Have you tried booting to safe mode and see if you can surf?


Hi Cavedweller,

The maching releases and renews IP addresses wirelessly (haven't tried wired). Only firewall is wondows firewall and that is disabled. Have not tried safe mode, but I can try that next.

#6 dcook22

dcook22
  • Topic Starter

  • Members
  • 13 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:05:55 PM

Posted 28 September 2009 - 09:11 PM

Try this to make sure you don't need to uninstall and reinstall the drivers for the networking card:

From a command prompt, type: ping 127.0.0.1

This checks to see if TCP/IP

[SNIP]


Try the steps above and post back with the results. I'll try to help you as much as I can, but DO NOT wipe your hard drive just yet. There may be an easier solution.


Hey Syscorp,

Great reply, thanks. I've tried the two recommendations and successfully pinged both the home IP address and the localhost from the command prompt.

What next?

#7 CaveDweller2

CaveDweller2

  • Members
  • 2,629 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:05:55 PM

Posted 28 September 2009 - 09:42 PM

Try pinging www.google.com or 74.125.45.100 see if you can reach them.

Hope this helps thumbup.gif

Associate in Applied Science - Network Systems Management - Trident Technical College


#8 syscorpsecure

syscorpsecure

  • Members
  • 118 posts
  • OFFLINE
  •  
  • Local time:04:55 PM

Posted 29 September 2009 - 12:00 AM

So far so good...

Now we move further up the TCP/IP food chain.

You now know from our first two exercises that TCP/IP is installed and can talk to the network adapter in question. You also know that DNS is working on your computer, because it can take an IP address and match it up to a hostname. The thing we need to do now is find out what the IP address is for the network adapter in question.

At a command prompt, type: ipconfig /all - note the space between the letter "g" in ipconfig and the forward slash "/". This is important, because if you don't type it right, it will not work.

Once you type the command, you want to note information for the following entries:

DHCP Enabled: Should be set to YES if you are not using a static IP address (you didn't type it in yourself).
Should be set to NO if you typed in the IP address you want the network adapter to use.

IPv4 Address: Should be anything other than a number beginning with 169.xxx.xxx.xxx. If your IP address begins with 169.xxx.xxx.xxx, you will never connect to the Internet. The 169 IP block is an internal IP address Microsoft uses to tell you your network adapter is talking but no one is listening because your network traffic is not going anywhere.

If you see an entry here that begins with 169.xxx.xxx.xxx, you have two options:

- at a command prompt, type: ipconfig /release followed by ipconfig /renew to reset your IP address, or
- if you type ipconfig /release and ipconfig /renew and still get an IP address that begins with 169.xxx.xxx.xxx, you will have to manually specify an IP address in the IPv4 settings for that adapter.


Default Gateway - should be the IP address of whatever device you use to connect to the Internet and must be on the same network ID as your computer. You CANNOT get on the Internet if your computer's IP address begins with 192.168.2.xxx and your default gateway is 66.12.83.xxx. Wrong Network ID (wrong area code).


If you are using a router or a hub to connect to the internet you will have two IP addresses to watch. The LAN IP address should have the same Network ID as your computer's IP Address (i.e.: 192.168.2.1 [router] to 192.168.2.15 [computer]). Your WAN IP is the IP address exposed to the world and how you make your connection to the Internet. This should be similar to the IP address of your Internet Service Provider


DNS Server: This CAN be different from your network ID and should be if you are getting an IP address automatically assigned by your ISP.


Once you get the IP Address information for the DNS Server entry (if present), at the command line type:

ping (DNS Server IP Address)

If you get the response "Request Timed Out" - this is good, it means that DNS is working and now WINS is the problem. The short answer is you need to enable WINS in your TCP/IP settings for the network adapter in question because you can contact the Internet but your traffic is "dying on the line" before it can reach its destination.

If you get the response "Reply from..." like before when you tested your network adapters, then you most likely still have a spyware or virus infection blocking your network traffic from getting back to the browser.

Two final tests for TCP/IP:

From a command prompt, type:

Tracert www.yahoo.com - you should be able to see a list of computers and IP addresses which detail the route that information from your computer takes to get to yahoo.com

If this works, then most likely spyware or a virus is the problem because the Tracert (Trace Route) command works at the lowest level of TCP/IP communication and indicates that you can communicate with the Internet.


netstat -a - shows all of the active TCP/IP and UDP connections between your computer and any remote device. If someone is connected to your computer via the Internet and you don't know or are not sure, this will smoke them out and display not only the remote IP address or hostname, but the port number they are using to connect to your computer as well. If this works and you see remote IP addresses or hostnames in the output but still cant browse websites, you need to get help from the malware removal forum.

Try this and post back with the results. If something confuses you or I did not explain something clearly, ask questions.

#9 dcook22

dcook22
  • Topic Starter

  • Members
  • 13 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:05:55 PM

Posted 29 September 2009 - 03:08 PM

Hey folks, thanks for all the replies.

To answer your recommendation cavedeweller, the system pinged google.

Syscorp, I ran all the tests you mentioned. Thanks for the truly in-depth reply. I learned a lot from it. The system passed every test so I figured I was on my way to the malware forum. I went to control panel > Add/Remove programs to see if there was anything I should uninstall before running the HijackThis program. It was there that I noticed Some Norton/Symantec stuff so I started uninstalling it. The security center gave a pop-up that I needed to log in as a supervisor to uninstall. So I did that and started turning off the services from within the program GUI. I saw something that referred to a firewall. When I disabled it, it asked me if I wanted tore-enable the default windows firewall. I said no and the system disabled its own firewall. I uninstalled the program, and guess what? I could access the internet. Apparently the Norton program was denying the machine access to web pages. All seems to be working now, at least on a wireless connection here at the office. My friend will try it at home this evening. But you were right. There was no need to wipe the hard drive.

Thanks for all your help. It seems the problem is solved.

Dan

#10 CaveDweller2

CaveDweller2

  • Members
  • 2,629 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:05:55 PM

Posted 29 September 2009 - 03:23 PM

hehe...never assume when it comes to firewalls. =)

Hope this helps thumbup.gif

Associate in Applied Science - Network Systems Management - Trident Technical College





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users