Lost http connection after June Security update?

[SecurityGirl]

I'm at the end of my rope. I've been using my Dell Inspiron 9300 (XPSP2) for
nearly 3 years without incident. The only change ever made to the laptop is
that which autoupdate delivers- as I call, the "monthly visitor".
After the June Security updates, I lose HTTP connections after about 10 mins
(rebooting brings it back)
Https and FTP still work.
I can ping external- such as www.hotmail.com
MSN Messenger still works.
Network Monitor shows only that the remote server "resets" or refuses the
connection.

I am running over a HNS Directway satellite connection. If I dial up over my
modem to PeoplePC, AND vpn into my corp network, then the problem does not
display itself. (Cisco Vpn Client)

It does not make a difference if I run over my wireless router, or plug the
cable into my laptop. It also doesn't make a difference if I drive to
starbucks, and attempt to get online via their TMobile hotspot. Same results.

Running in Safe Mode w/Networking does not display the problem.
System restore to checkpoint earlier than updates fails.

Have run every scan known to mankind- turned off Windows Firewall, Disabled
my Symantec Antivirus and nothing helps.

I've also reset the tcp/ip stack using netsh winsock reset- twice.

The problem began after the first automatic download of June updates. I
suspected KB951376 to be the problem, as it was the only patch (BlueTooth)
that seemed like it could affect my networking. I removed this update, and
eventually ALL of the June updates. The problem went away, then returned.
I went away for the weekend, came back- and autoupdate had lovingly
reinstalled all of the updates for me. My computer restarted on its own
accord, and I was working fine for the rest of the week. Not one to dismiss a
stroke of good luck, I went merrily on my way.
The problem returned on Friday. A check of installed updates showed that the
KB in question was back- only in a V2.
Removed V2, but the problem persisted.
Checked the registry, and found the KB was still installed- Looked again,
and noticed that V2 didn't replace the original KP951376, and it was
installed as well.
Removed it.
The problem still exists.

In summary- No http. Yes https. Yes FTP. Yes Ping. Yes Telnet.

Can anyone offer some advice?

 

[nass]

I'm at the end of my rope. I've been using my Dell Inspiron 9300 (XPSP2) for
nearly 3 years without incident. The only change ever made to the laptop is
that which autoupdate delivers- as I call, the "monthly visitor".
After the June Security updates, I lose HTTP connections after about 10 mins
(rebooting brings it back)
Https and FTP still work.
I can ping external- such as www.hotmail.com
MSN Messenger still works.
Network Monitor shows only that the remote server "resets" or refuses the
connection.

I am running over a HNS Directway satellite connection. If I dial up over my
modem to PeoplePC, AND vpn into my corp network, then the problem does not
display itself. (Cisco Vpn Client)

It does not make a difference if I run over my wireless router, or plug the
cable into my laptop. It also doesn't make a difference if I drive to
starbucks, and attempt to get online via their TMobile hotspot. Same results.

Running in Safe Mode w/Networking does not display the problem.
System restore to checkpoint earlier than updates fails.

Have run every scan known to mankind- turned off Windows Firewall, Disabled
my Symantec Antivirus and nothing helps.

I've also reset the tcp/ip stack using netsh winsock reset- twice.

The problem began after the first automatic download of June updates. I
suspected KB951376 to be the problem, as it was the only patch (BlueTooth)
that seemed like it could affect my networking. I removed this update, and
eventually ALL of the June updates. The problem went away, then returned.
I went away for the weekend, came back- and autoupdate had lovingly
reinstalled all of the updates for me. My computer restarted on its own
accord, and I was working fine for the rest of the week. Not one to dismiss a
stroke of good luck, I went merrily on my way.
The problem returned on Friday. A check of installed updates showed that the
KB in question was back- only in a V2.
Removed V2, but the problem persisted.
Checked the registry, and found the KB was still installed- Looked again,
and noticed that V2 didn't replace the original KP951376, and it was
installed as well.
Removed it.
The problem still exists.

In summary- No http. Yes https. Yes FTP. Yes Ping. Yes Telnet.

Can anyone offer some advice?

Some users said that by enabling/checking the check box for TLS 1.0 the
problem resolved, so try this first then if it didn't help try the rest of
the steps.
Cipher strength appears as 0-bit in Internet Explorer
http://support.microsoft.com/kb/261328/en-us
"The Page Cannot Be Displayed" Error Message on a Secure Web Site
http://support.microsoft.com/?kbid=303807
How to troubleshoot problems accessing secure Web pages with Internet
Explorer 6 Service Pack 2
http://support.microsoft.com/?kbid=870700


= ... First, try to clean up your caches, Internet files and delete cookies
by doing this:
Click Start >> Control Panel >> Double click Network and Internet
Connections >> Double click Internet Options.
On the IE properties windows you will see these Taps:
General | Security | Privacy | Content | Connections | Programs |
Advanced
Under General Tab clear your History, Internet Files and Cookies.
Click Connection Tab, then Click on LAN Settings Button, on the LAN
properties make sure nothing checked (check boxes not checked)
Then click on Advanced tab and scroll down to under the Browsing Option:
[&] Browsing
[ ] Enable Third-Party browser extensions (Req Rest) uncheck this box.

[&] HTTP 1.1 Settings
[ ] Use HTTP 1.1 ,= Make sure this checked
[ ] Use HTTP 1.1 through proxy connections
If you using proxy check the proxy one if not check only the first one.

Then under Security Option:
[&] Security
[ ] Use SSL 2.0
[ ] Use SSL 3.0
[ ] Use TLS 1.0
Then click on Programs Tab and click Manage Add-Ons and Disable all non
Verified Add-Ons (You should Renable them later one-by-one and see the
culprit and update it or remove it.


= Then Open a run command and type in these DLLs to re-register them:
regsvr32 softpub.dll
regsvr32 Wintrust.dll
regsvr32 Mssip32.dll
regsvr32 Initpki.dll
regsvr32 Gpkcsp.dll
regsvr32 Sccbase.dll
regsvr32 Slbcsp.dll
regsvr32 Urlmon.dll
regsvr32 Cryptdlg.dll
regsvr32 Dssenh.dll
regsvr32 Rsaenh.dll
Note you can copy the above and paste in a Notepad and Save As on the
Desktop reg.bat file then double click the file on the desktop to run or you
can open a run command and type in:
C:\Documents and settings\user\desktop\reg.bat click [OK] and then Yes.
Again on the Run command type in:
ipconfig /flushdns click [OK]
ipconfig /renew click [OK]
netsh winsock reset click [OK]
Reboot your machine and see if you can access any website/link easily and
without the cannot connect error message.
Winsock fixer tool:
http://www.nasstec.co.uk/tools.html

= Open the Windows
Explorer and locate this path:
C:\Windows\System32\drivers\etc = look in the Right Pane/window for this
file called the HOSTS file but not the one with the extension *.SAM* leave
this as is.
If you can't see it try to click Tools >> Folder Options and select show
Hidden files and folder, then right Click the Hosts file and select open with
Notepad.
There see any reference for that site and remove it, you Hosts file will
looks like this:
# 102.54.94.97 rhino.acme.com # Source server
# 38.25.63.10 x.acme.com # Client Host
127.0.0.1 LocalHost
------------------------------------------
Remove all other References other than those above.
You can also try to assign the web address in the trusted zone on the IE
properties.

= Before we go further are you connecting by Router or Modem, in either try to
Power or unplug the Power cord for the Router/Modem for about 40 seconds or
so be generous with it <g> turn the computer OFF and wait for the time to go
by!!.
Then Turn the Router/Modem ON and wait a minute or so then Power ON the
computer and try to establish a connection and try the link, does it work?.

= If still no joy then continue with this step:
Open windows Explorer and locate the Hosts file and Rename it to Hosts.OLD
Reboot the machine and try, does it work.

= If not working still try this:
search for them by this name *index.dat* and you can delete them
then the on reboot the system will recreate them for you.
Some of them here:
C:\Documents and settings\Administrator\Cookies = index
C:\Documents and Settings\User\Cookies = index
C:\Documents and settings\User\User data = index
C:\Windows\Temp\Cookies =index
C:\Windows\Temp\History = index
C:\Windows\Temp\Temporary Internet Files\Content.IE5 = Index.dat
Reboot your machine and see if this helped.

Step2+=

Open a run command and type in:
sfc /scannow click [OK] you will need the XP CD installation media to
accomplish this operation.

= Open a run command and type in:
regsvr32 w3ssl.dll click [OK]

Open a run command and type in:
servics.msc click [OK]
On the service control panel locate this service and make sure it started
Manual:
HTTP SSL
Reboot you machine and see if you could access any http://?.

= If still no joy, try to check the Prefixes on the Registry editor as follow:
Open a run command and type in:
regedit click [OK] and locate these keys:
[-]HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\URL\DefaultPrefix =
[ab] (Default) REG_SZ http://

[-]HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\URL\Prefixes=

[ab] ftp REG_SZ ftp://
[ab] gopher REG_SZ gopher://
[ab] home REG_SZ http://
[ab] mosaic REG_SZ http://
[ab] WWW REG_SZ http://

Check the service here:
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\HTTP =
[ab](Defaul) REG_SZ
[ab]Description REG_SZ
[ab]DisplayName REG_SZ HTTP
[ON]ErrorControl REG_DWORD 0x00000001 (1)
[ab]ImagePath REG_EXPAND_SZ System32\drivers\HTTP.sys
[ON]Start REG_DWORD 0x00000003 (3)
[ON]Type REG_DWORD 0x00000001 (1)

= http.sys on my machine:
C:\Windows\$NtUninstallKB916595$
C:\Windows\Driver Cache\i386
C:\Windows\ServicePackFiles\i386
C:\Windows\System32\drivers
C:\Windows\$hf_mig\KB916595\SP2QFE
C:\Windows\Windows\ServicePackFlies\i386\sp2.cab
C:\Windows\SoftwareDistribution\SelfUpdate\16.....
C:\Windows\SoftwareDistribution\SelfUpdate\16
Update for Windows XP (KB904942)
http://www.microsoft.com/downloads/...FF-7BFE-4336-9E65-972ED21324C4&displaylang=en


= Either try to update your windows scripting engine or Java version on your
computer, try to uninstall the old Java first.
Windows Script 5.6 Documentation
http://www.microsoft.com/downloads/...48-207D-4BE1-8A76-1C4099D7BBB9&displaylang=en

HTH.
nass

 

[SecurityGirl]

Update:
After many long hours, the problem has been resolved. vsdatant.sys (which is
the "TrueVector Device Driver" from Zone Labs, Inc-- since bought by Linksys,
since bought by Cisco) was found to be the problem. This driver is a 2003
model, and while unconfirmed, the Bluetooth update most likely got it into an
odd state.

Instead of uninstalling vpn client, which I need, I booted into safe mode
with command prompt and renamed the vsdatant.sys file (even as admin, could
not rename it outside of safe mode!).

The problem is resolved, although WU is in the process of downloading XP3,
so I may be back!!!!!!