Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Network works only in safe mode


  • Please log in to reply
9 replies to this topic

#1 TushKal

TushKal

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Local time:03:49 AM

Posted 24 July 2013 - 06:28 AM

Hello, I am using a HP-XW4600 workstation with 64bit Windows XP professional SP2. since yesterday, I could not connect to network. I am not able to access internet, the network drive, network printer. I cannot ping my DNS server, google.com, any other PC in network. We do not use DHCP, we have given static IP to every computer. I have Trend micro antivirus and firewall. I started the PC in safe mode with networking, and i could access internet, network drive, (Printer didnt work in safe mode), I could ping DNS and google.com. I changed the IP Address, still no good. I first tried disabling and then uninstalling the antivirus. I also tried MSCONFIG clean boot -> diagnostic startup. Then I selected normal startup and disabled all services (Except Microsoft services) and disabled all startup entries in MSCONFIG. It didnot work. I uninstalled the driver in device manager, and then reinstalled the device. Reading a post somewhere, I ran this in CMD -> netsh winsock reset. Nothing of these seems to help resolve this problem. Yet, the computer still can access network in safe mode with networking. Any suggestions..?

BC AdBot (Login to Remove)

 


#2 hamluis

hamluis

    Moderator


  • Moderator
  • 56,381 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:04:19 PM

Posted 24 July 2013 - 07:04 AM

IMO...since you have connectivity when in safe mode...that seemingly points to something that is not a default Windows setting.  When in safe mode, installed drivers do not load and only the Windows default drivers are employed.  Thus, having network connectivity without all normal installed items loading...says to me that something is interfering with connectivity.  Installed firewall/AV drivers do not load in safe mode, but the Windows firewall does...so it could be your Trend Micro program, among other things.

 

What Loads In Safe Mode

 

We need more data, IMO.  Do the following in safe mode.

 

Please download MiniToolBox  , save it to your desktop and run it.

 

Checkmark the following checkboxes:

  List last 10 Event Viewer log

  List Installed Programs

  List Users, Partitions and Memory size.

 

Click Go and paste the content into your next post.

 

Also...please Publish a Snapshot using Speccy - http://www.bleepingcomputer.com/forums/topic323892.html/page__p__1797792#entry1797792 , taking care to post the link.

 

Louis



#3 TushKal

TushKal
  • Topic Starter

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Local time:03:49 AM

Posted 25 July 2013 - 11:27 PM

Hi Hamluis..

 

my apologies for delay.

I ran speccy but couldnot publish in normal mode as network is not working. and in "safe mode with networking", Speccy didnt work.

So I am putting only Mini Tool Box result:as you mendtioned:

 

 Checkmark the following checkboxes:

  List last 10 Event Viewer log

  List Installed Programs

  List Users, Partitions and Memory size.

 

 

 

MiniToolBox by Farbar  Version: 13-07-2013
Ran by PUN1 (administrator) on 26-07-2013 at 08:53:03
Running from "C:\Documents and Settings\Administrator\Desktop"
Microsoft® Windows® XP Professional x64 Edition Service Pack 2 (X64)
Boot Mode: Normal
***************************************************************************
 
========================= Event log errors: ===============================
 
Application errors:
==================
Error: (07/26/2013 08:52:36 AM) (Source: OCS Inventory Service) (User: )
Description: Service encounter error <OCS Inventory NG Agent encounter an error (exit code is 4 => Failed to talk with Communication Server)>.
 
Error: (07/26/2013 08:50:35 AM) (Source: OCS Inventory Service) (User: )
Description: Service encounter error <OCS Inventory NG Agent encounter an error (exit code is 4 => Failed to talk with Communication Server)>.
 
Error: (07/26/2013 08:48:27 AM) (Source: OCS Inventory Service) (User: )
Description: Service encounter error <OCS Inventory NG Agent encounter an error (exit code is 4 => Failed to talk with Communication Server)>.
 
Error: (07/26/2013 08:47:58 AM) (Source: OCS Inventory Service) (User: )
Description: Service encounter error <OCS Inventory NG Agent encounter an error (exit code is 4 => Failed to talk with Communication Server)>.
 
Error: (07/26/2013 08:47:45 AM) (Source: Userenv) (User: NT AUTHORITY)
Description: Windows cannot determine the user or computer name. (The specified domain either does not exist or could not be contacted. ). Group Policy processing aborted.
 
Error: (07/26/2013 08:47:17 AM) (Source: OCS Inventory Service) (User: )
Description: Service encounter error <OCS Inventory NG Agent encounter an error (exit code is 4 => Failed to talk with Communication Server)>.
 
Error: (07/26/2013 08:45:14 AM) (Source: Userenv) (User: NT AUTHORITY)
Description: Windows cannot determine the user or computer name. (Access is denied. ). Group Policy processing aborted.
 
Error: (07/26/2013 08:44:24 AM) (Source: VSS) (User: )
Description: WMI Writer{a6ad56c2-b509-4e6c-bb19-49d8f43532f0}
 
Error: (07/26/2013 08:06:30 AM) (Source: Userenv) (User: NT AUTHORITY)
Description: Windows cannot determine the user or computer name. (The specified domain either does not exist or could not be contacted. ). Group Policy processing aborted.
 
Error: (07/26/2013 06:36:14 AM) (Source: Userenv) (User: NT AUTHORITY)
Description: Windows cannot determine the user or computer name. (The specified domain either does not exist or could not be contacted. ). Group Policy processing aborted.
 
 
System errors:
=============
Error: (07/26/2013 08:51:35 AM) (Source: NETLOGON) (User: )
Description: This computer was not able to set up a secure session with a domain
controller in domain VNET due to the following: 
%%1311
 
This may lead to authentication problems. Make sure that this
computer is connected to the network. If the problem persists,
please contact your domain administrator.
 
 
 
ADDITIONAL INFO
 
If this computer is a domain controller for the specified domain, it
sets up the secure session to the primary domain controller emulator in the specified
domain. Otherwise, this computer sets up the secure session to any domain controller
in the specified domain.
 
Error: (07/26/2013 08:48:22 AM) (Source: Service Control Manager) (User: )
Description: The CATIA Monitor service terminated unexpectedly.  It has done this 1 time(s).
 
Error: (07/26/2013 08:47:10 AM) (Source: 0) (User: )
Description: 
 
Error: (07/26/2013 08:47:05 AM) (Source: Service Control Manager) (User: )
Description: The IPSEC Services service terminated with the following error: 
%%2
 
Error: (07/26/2013 08:47:03 AM) (Source: W32Time) (User: )
Description: The time provider NtpClient is configured to acquire time from one or more
time sources, however none of the sources are currently accessible. 
No attempt to contact a source will be made for 15 minutes.
NtpClient has no source of accurate time.
 
Error: (07/26/2013 08:47:00 AM) (Source: SideBySide) (User: )
Description: Generate Activation Context failed for C:\Program Files (x86)\Google\Update\1.3.21.135\GoogleCrashHandler64.exe.
Reference error message: The referenced assembly is not installed on your system.
.
 
Error: (07/26/2013 08:47:00 AM) (Source: SideBySide) (User: )
Description: Resolve Partial Assembly failed for Microsoft.Windows.Common-Controls.
Reference error message: The referenced assembly is not installed on your system.
.
 
Error: (07/26/2013 08:47:00 AM) (Source: SideBySide) (User: )
Description: Dependent Assembly Microsoft.Windows.Common-Controls could not be found and Last Error was The referenced assembly is not installed on your system.
 
Error: (07/26/2013 08:46:59 AM) (Source: NETLOGON) (User: )
Description: This computer could not authenticate with \\PUN1-SVDC01.vnet.valeo.com, a Windows domain controller
for domain VNET, and therefore this computer might deny logon requests.
This inability to authenticate might be caused by another computer on the
same network using the same name or the password for this computer account
is not recognized. If this message appears again, contact your system
administrator.
 
Error: (07/26/2013 08:46:02 AM) (Source: Service Control Manager) (User: )
Description: The following boot-start or system-start driver(s) failed to load: 
AW_HOST
Fips
i8042prt
 
 
Microsoft Office Sessions:
=========================
Error: (04/30/2013 00:32:45 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 1, Application Name: Microsoft Office Excel, Application Version: 12.0.6665.5003, Microsoft Office Version: 12.0.6425.1000. This session lasted 4 seconds with 0 seconds of active time.  This session ended with a crash.
 
Error: (04/30/2013 00:32:38 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 1, Application Name: Microsoft Office Excel, Application Version: 12.0.6665.5003, Microsoft Office Version: 12.0.6425.1000. This session lasted 0 seconds with 0 seconds of active time.  This session ended with a crash.
 
Error: (04/30/2013 00:32:28 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 1, Application Name: Microsoft Office Excel, Application Version: 12.0.6665.5003, Microsoft Office Version: 12.0.6425.1000. This session lasted 1 seconds with 0 seconds of active time.  This session ended with a crash.
 
Error: (04/30/2013 00:32:23 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 1, Application Name: Microsoft Office Excel, Application Version: 12.0.6665.5003, Microsoft Office Version: 12.0.6425.1000. This session lasted 0 seconds with 0 seconds of active time.  This session ended with a crash.
 
 
=========================== Installed Programs ============================
 
7-Zip 9.20 (x64 edition) (Version: 9.20.00.0)
Broadcom NetXtreme Ethernet Controller (Version: 14.2.6.2)
Dassault Systemes Software Prerequisites x86-x64 (Version: 8.1.3)
Deployment Solution Agent (Version: 7.1.2316.0)
Java™ 6 Update 39 (64-bit) (Version: 6.0.390)
Microsoft .NET Framework 2.0 (x64)
Microsoft .NET Framework 2.0 (x64) (Version: 2.0.50727)
Microsoft Office Office 64-bit Components 2007 (Version: 12.0.6425.1000)
Microsoft Office Shared 64-bit MUI (English) 2007 (Version: 12.0.6425.1000)
Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2007 (Version: 12.0.6425.1000)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161)
NVIDIA Display Control Panel (Version: 6.14.11.9754)
NVIDIA Drivers (Version: 1.10.59.37)
NVIDIA nView Desktop Manager (Version: 6.14.10.12563)
NVIDIA Performance Drivers (Version: 2.1.0.0)
Patch Management Agent (Version: 7.1.7580.0)
Software Management Solution Plugin (Version: 7.1.7580.0)
Symantec Management Agent (Version: 7.1.8350.15350)
Symantec_pcAnywhere_plugin_installer_x64 (Version: 12.6.1.0)
Update for Windows Server 2003 (KB943729)
Update for Windows XP (KB2345886) (Version: 1)
Update for Windows XP (KB2467659) (Version: 1)
Update for Windows XP (KB2661254) (Version: 1)
Update for Windows XP (KB2718704) (Version: 1)
Update for Windows XP (KB2748349) (Version: 1)
Update for Windows XP (KB2749655) (Version: 1)
Update for Windows XP (KB927891) (Version: 5)
Update for Windows XP (KB936357) (Version: 1)
Update for Windows XP (KB955759) (Version: 1)
Update for Windows XP (KB967715) (Version: 1)
Update for Windows XP (KB968389) (Version: 1)
Update for Windows XP (KB971029) (Version: 1)
Update for Windows XP (KB973815) (Version: 1)
Windows XP Service Pack 2 (Version: 20070217.000042)
 
========================= Memory info: ===================================
 
Percentage of memory in use: 10%
Total physical RAM: 8175.06 MB
Available physical RAM: 7345.28 MB
Total Pagefile: 9791.88 MB
Available Pagefile: 9400.71 MB
Total Virtual: 4095.88 MB
Available Virtual: 3995.85 MB
 
========================= Partitions: =====================================
 
1 Drive c: () (Fixed) (Total:29.29 GB) (Free:13.27 GB) NTFS
2 Drive d: () (Fixed) (Total:109.74 GB) (Free:92.17 GB) NTFS
3 Drive e: (HP_RECOVERY) (Fixed) (Total:10 GB) (Free:7.47 GB) NTFS
 
========================= Users: ========================================
 
User accounts for \\PUN1-W01002
 
Guest                    PUN1                     SUPPORT_388945a0         
 
 
**** End of log ****


#4 hamluis

hamluis

    Moderator


  • Moderator
  • 56,381 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:04:19 PM

Posted 26 July 2013 - 10:04 AM

You are running a system sans SP3...which I consider a serious malware vulnerability (in my little world). 

 

You reflect...a number of Symantec applications that are possibly creating your problem.  I don't really see any evidence that this is so...but the data you presented doesn't really tell me much of anyhing, other than the system has a connectivity problem.

 

I suggest uninstalling:

Deployment Solution Agent (Version: 7.1.2316.0)

Software Management Solution Plugin (Version: 7.1.7580.0)

Symantec Management Agent (Version: 7.1.8350.15350)
Symantec_pcAnywhere_plugin_installer_x64 (Version: 12.6.1.0)
 
The fact that you assert that you have Trend Micro products installed...yet that is not refelected in the MiniToolbox data...has me puzzled.
 
To be honest, I would be highly concerned with the possibility of malware infection.
 
Louis

 



#5 TushKal

TushKal
  • Topic Starter

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Local time:03:49 AM

Posted 28 July 2013 - 11:09 PM

Dear hamluis..

 

I had Trend installed. But uninstalled to check if that was blocking point. So it is not reflected here.

The symantec products are installed on all 200 systems in my network.

 

This is Windows XP Professional 64-bit, hence dont have SP3. Max SP available for 64 bit XP is SP2 (which is same service pack of Server 2003).

I scanned with Trend housecall, malware bytes. Could not scan with combofix as it doesnt support XP-64.



#6 hamluis

hamluis

    Moderator


  • Moderator
  • 56,381 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:04:19 PM

Posted 29 July 2013 - 10:15 AM

Apologies...I didn't know that SP3 doesn't apply to XP 64-bit.

 

With that clarified...I don't have any suspects re your networking problem...other than your security software or possible malware.  It's clear that the device functions normally and it's clear that whatever prevents connectivity in normal mode...is something that loads in nomal mode.  Aside from that, I see no clues at all.

 

Perhaps others here can see more than I or offer suggestions.

 

You also reflect errors for OCS Inventory..and I don't see OCS Inventory on your list of installed programs.  Using Google, the errors appear to be a software problem...but I see no listing of said software on your system.  You might take a look at processes/services which are active on your system.

 

Louis



#7 TushKal

TushKal
  • Topic Starter

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Local time:03:49 AM

Posted 29 July 2013 - 10:33 PM

Thanks Hamluis..

That was valuable. But to save time on trouble shooting this, I am going to reformat this system now.

 

Thank you for your help.



#8 hamluis

hamluis

    Moderator


  • Moderator
  • 56,381 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:04:19 PM

Posted 30 July 2013 - 09:23 AM

You are welcome, although I wans't much help :).

 

Happy computing :).

 

Louis



#9 dc3

dc3

    Bleeping Treehugger


  • Members
  • 30,752 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Sierra Foothills of Northern Ca.
  • Local time:02:19 PM

Posted 30 July 2013 - 09:33 AM

As Hamluis pointed out, the drivers used in Safe Mode are limited and native to the operating system.  This points to the possibility that a non-microsoft Service could be at fault.  To test this perform a Clean Boot.

 

How to perform a clean boot
 
***This is a diagnotic tool for Windows Vista, Windows 7, and Windows 8.  This will not repair your computer, but it may point to where the problem lies so that a repair can be made.***
 
Warning:  Disabling items in Services or Startup may leave your anitivius disabled until the process is ended.  For this reason I would suggest that you perform this process off line.
 
(1)  Click on the Start orb startorb_zps06e1f985.png, then type msconfig.exe in the Search programs and files box.  
 
(2)  When msconfig is seen in Programs, right click on it, then click on Run as administrator.
 
msconfig2_zps2e854ee3.png
 
If you are prompted for an administrator password or for confirmation, you should enter the password or provide confirmation. 
 
(1)  Click on the General tab.   
 
(2)  Click the Selective startup option. 
 
(3)  Remove the check mark in the Load startup items  check box. 
 
Cleanboot_zps3b042516.png
 
(1)  Click on the Services tab. 
 
(2)  Place a check mark in the Hide all Microsoft services check box, this will remove the Microsoft Services from the list but will still be running. 
 
(3)  Click Disable all, this will remove all of the check marks in the Services list, then click on Restart
 
Caution:  By disabling the Services your antivirus will not be active, for this reason I suggest that this process not be run while online.
 
cleanboot16_zps67072642.png
 
**The following is a process of elimination to find the Service or Startup item that is causing your problem**.  
 
To make this process quicker the Services or Startup items will initially be devided in half by adding check marks to one half of the Services and restarting the computer to see if the problem resumes.  If the problem isn't found in that half, the check marks will be removed and the other half of the boxes will be checked and the computer restarted again.  If the problem is found in one of these halves, that half will have the check marks removed one at a time until the Service or Startup item is found.  This process will begin with Services, if no porblem is found there the process will be continued in Startup
 
*  If the problem does not continue after the restart go back to Services and place check marks in half of the boxes and restart the computer.  
 
*  If the problem still does not continue return to Services and remove the check marks that were added, then place check marks in the remaining half of the boxes and restart the computer.
 
If the problem resumes after a restart in one of these halves, you will procede with this process in the half where the problem occurs.  If this does not continue in either half you should repeat this process in Sartup
 
*  In the half of the Services that the problem is found, remove one check mark at a time and restart the computer to see if that  is the Service causing the problem.  Continue to do this with the Services untill the service causing this problem is  found.
 
If the problem is not found in Services, remove all of the check marks, click on the Startup tab and repeat the search process there.
 
Caution:  If this is a laptop, make sure, you do NOT disable any keyboard, or touchpad entries.
 
If this problem is found, run the System Configuration Utility, then click on the check box to clear the item.
 
To open the System Configuration Utility:
 
(1) Click on the Start orb startorb_zps06e1f985.png.
 
(2)  Click on Control Panel
 
(3)  Click on Administrative Tools.  
 
(4)  Double click on System Configuration.
 
If the Service or Startup item is identified please include it in your next post. 
 
 
When you are finished, click on the General tab in System Configuration, then click on Normal Startup, click on OK, then restart your computer.

Family and loved ones will always be a priority in my daily life.  You never know when one will leave you.

 

 

 

 


#10 TushKal

TushKal
  • Topic Starter

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Local time:03:49 AM

Posted 30 July 2013 - 10:40 PM

DC3...

Thank you.

I have mentioned in my thread that I have tried clean boot and boot with all non-Microsoft services disabled.






1 user(s) are reading this topic

0 members, 1 guests, 0 anonymous users