Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Why am I losing my wired connection to the Internet?


  • Please log in to reply
3 replies to this topic

#1 ImBubba

ImBubba

  • Members
  • 20 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Kissimmee, FL, USA
  • Local time:08:31 AM

Posted 11 July 2011 - 09:41 PM

My home LAN consists of two WIN-XP/SP3 desktop computers (TILLIE and ACHOO), one Win 7 Home Premium laptop (HORSE), and one Brother Laser Printer, all cabled to a Linksys 8-port router. The router provides DHCP address services to the LAN and gets its own IP address from the cable modem on the Brighthouse (Roadrunner) network.

I have a recent and urgent problem ... TILLIE has lost the ability to resolve names to IP addresses. That is, its browser (IE-7) cannot bring up my home page (or any home page). It just gives a message that IE-7 cannot display the page. In diagnosing the problem with a RoadRunner tech, I reset the link adapter (disable/enable), used 'ipconfig' to flush the DNS cache, and used 'netsh' to reset the winsock. Nothing would make TILLIE find Google or Yahoo by name, though it has no problem pinging addresses inside the LAN or even Google and Yahoo (by IP address NOT by name) out on the WAN. It appears that something is forcing the use of a DNS server and that Internet Explorer's calls for the 'home' page are being redirected to somewhere else.

This problem has been on-going with TILLIE for several days now, and just yesterday the same problem appeared on the laptop (HORSE) but is not consistant (yet) on HORSE. I mean that HORSE seems to also have the 'bug'. It also loses Internet connectivity (apparently randomly) with the same symptoms. However, unlike TILLIE which seems to be permanently out to lunch, HORSE can be powered off for a long while and when powered up again behaves properly (for awhile).

I would like to address the TILLIE problem in this forum, and get help cleaning out whatever is causing the problem. This sounds like a trojan or virus to me (the RoadRunner tech gave up after the winsock reset failed to fix the problem) not a LAN configuration problem.

Since TILLIE cannot connect to the Internet, I cannot download Malwarebytes and other programs directly ... but I can 'sneaker-net' it over on a flash-drive. Likewise, posting the results back on Bleeping Computer might be cumbersom, but if I can get whatever programs I need to use to write their output to a file on a flash drive I can upload it from another computer.

Thanks in advance for considering this problem.

Edited by hamluis, 12 July 2011 - 12:40 PM.
Moved from Networking to Am I Infected.


BC AdBot (Login to Remove)

 


#2 techextreme

techextreme

    Bleepin Tech


  • BC Advisor
  • 2,125 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Pittsburgh, PA
  • Local time:09:31 AM

Posted 13 July 2011 - 02:31 PM

Hi ImBubba,

Let's start with Tillie.

Although Bright.net had you reset winsock, it sounds like they did not have you reset TCP/IP also.

So, You may want to try resetting both TCP/IP and Winsock on your computer to help with your troubles.
To successfully complete this, you will need to be at a command prompt.
Click on Start then Run. In the Run box type CMD and press enter.
You will now see a black window with one line of text and a blinking cursor.

You will next type:

  • netsh int ip reset tcp.log

This will reset your TCP/IP settings.

Next you will reset Winsock:

You will type:

  • netsh winsock reset sock.log

When the Winsock is finished you will be directed to restart your computer. Type exit in the window and press enter.

From here you will do a normal restart on your computer and retest your network connection.

If you can once again get on the internet, we are doing good. If you cannot, I'd also like you to look at your proxy settings.

Check your Proxy settings in Internet Explorer to make sure malware did not alter them. If so, that can affect your ability to browse or download tools required for disinfection:

* Open Internet Explorer > click Tools > Internet Options > Connections tab.
* Click the LAN Settings... button and uncheck Use a proxy server for your LAN
or change the settings to the proxy you normally use if you previously reconfigured it.
* Remove any unknown addresses from the Address box. 80 is the default Port so it does not have to be changed.
* Click Ok and then click Ok again.
* Close Internet Explorer and restart the computer.
* An example of how to do this with screenshots can be found in steps 3-7 under the section Automated Removal Instructions... in this guide..

Check your Proxy settings in Firefox to make sure malware did not alter them:

* Open Firefox, click Tools > Options > Advanced and click the Network Tab.
* Under the Connection section click on the Settings... button.
* Under Configure Proxies to Access the Internet, check No proxy. This is the default option if you don't use a proxy.
* Click Ok and then click OK again.
* Close Firefox and restart the computer.

For other browsers, please refer to How to configure browser proxy settings.

Please try both of these on your Windows XP (Tillie) computer only. Let's see if we can get this one going first. We'll tackle the "Horse" later.

Techextreme

"Admire those who attempt great things, even though they fail."

-- Seneca

 


#3 ImBubba

ImBubba
  • Topic Starter

  • Members
  • 20 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Kissimmee, FL, USA
  • Local time:08:31 AM

Posted 13 July 2011 - 10:56 PM

Firstly, "Thank you!" to hamluis for moving my question to somewhere that someone like Bleepin Tech could find it!!

After posting the question I continued reading various Bleeping Computer fora and came across a posting that mentioned that NetBIOS over TCP/IP should be enabled. I checked in with TILLIE and found that the box for NetBIOS over TCP/IP was NOT ticked. Further there was somethig that WAS ticked that I thought didn't look right so I disabled LMHOSTS which was enabled. I saved everything, backed out, and just for grins rebooted. TILLIE came up and IE-7 found the desired home page and every thing seems fine. (I made the same NetBIOS over TCP/IP change on HORSE and its problem seems to be gone also.) I ran Malwarebytes on both machines and they both came up clean.

I read your posting this afternoon but have not had access to TILLIE (my busy wife's computer) to flush the TCP/IP and Winsock caches. I'm thinking that it may not be necessary now, as things seem to be working fine, but I am game to do them anyway if you think there may yet be a reason to do it.

I DO think that some sort of Trojan was responsible for mucking up my IP addresses, but I can't point to anything, really, that they have in common with the exception of using the same starting home page from their respective versions of Internet Explorer. And they both seem to be okay now.

Thank you, Bleepin Tech, for your rapid response and I will keep the 'netsh' commands you proposed close at hand.

Oh, one other thing ... where should I ask a question about printer sharing within my network. All my computers used to be able to get stuff printed on the network-attached laser printer, but lately HORSE cannot. Anything HORSE sends to the laser printer just waits patiently in the printer queue for the printer to be attached (but everything else can use that printer ... and HORSE can ping the printer's IP address.) I suspect that I have done something with naming my home network on my various devices that has left HORSE (my only Win7 machne) out in the cold with regard to printing on the network printer. Where in these fora would this question be best addressed?

Thanks again for your helpfulness!

Bubba

Edited by ImBubba, 13 July 2011 - 11:21 PM.


#4 techextreme

techextreme

    Bleepin Tech


  • BC Advisor
  • 2,125 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Pittsburgh, PA
  • Local time:09:31 AM

Posted 14 July 2011 - 06:43 AM

Hi ImBubba,

I glad you got your XP machines talking again. It's always good to hear things are working again.

As far as your printer is concerned, can you tell me what all Roadrunner had you do on your Windows 7 computer if anything? Also, can you give me the model number of your Brother Printer?

Techextreme

"Admire those who attempt great things, even though they fail."

-- Seneca

 





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users