Windows XP TCP/IP breaking on wired NIC every few hours

[anon_gb]

Hello,

After scouring the web for answers and coming up short I was hoping I could find someone here who might have seen an issue similar to my own.

Brand new HP 6930p, XP SP2 with Symantec Endpoint Protection 11 on a corporate LAN. Every hour or so the network connection for the wired NIC drops. When checking the status of the NIC in Network Connections, all the fields (IP, Gateway, etc.,) are blank.

ping.exe results in an application error and so does ipconfig. Rebooting fixes it but it comes back every hour or so. Have had this occur for this same user on two totally separate HP 6930p laptops. Attempted repair of the adapter results in Failure to query TCP\IP, but it only happens for that one adapter. Other adapters can be disabled or repaired just fine.

We have a few dozen of these with no one else seeing the same issue.

Happens every hour or so and we also see a blue screen every so often from aeudio.sys, and a chuck of the minidump shows a lot of audio modules being unloaded.

Can't figure out why this user is unique aside from that he has SQL server and a few Peoplesoft enivronments installed.

Removed SEP when I saw the issue occur once and networking snapped back to life, but then realized he had this issue even before he had SEP.

Also noticed that the latest time the network adapter dropped out (when removing sep bounced it back) I couldn't launch taskmgr.exe or winword, along with a few other apps. Failed with "not enough quota to process this command", was able to use systeminfo.exe to see that virtual memory use was only 40MB and had 2 GB or RAM still available.

Latest sprint connection manager installed as well as Juniper SSL Network Connect app, but a lot of the machines in our company have this.

I'm at a loss of what to even try next.

Thanks

 

[Madxgraphics]

Hi Glombus
Welcome to the forum

Bit of a long shot here, but have you done any sort of virus scan ? I only ask because one of my computers on my home network was doing a similar sort of thing that you describe. Dropping out every hour or so, but able to connect to the network again after a re-boot. I was gettin application errors for just about anything that had to do with network connectivity. I ran Malwarebytes which picked up a whole host of nasty's. Once they were eliminated the problem stopped...

 

[anon_gb]

Thanks a lot for the quick reply. It makes sense that it could be some sort of malware. Tried Malware bytes, but no luck unfortunately. It didn't find anything malicious on the machine.

I reinstalled Symantec Endpoint Protection, which didn't find anything either. What's odd is that this particular person has the same problem on two different laptops (same model) but no-one else does.

I feel like it's either something he installed, something with his profile, or somehow both machines are being exploited i the same way.

I noticed that for some reason the blue tooth stack on his laptop as well as services.exe, lsass.exe, and an instance of svchost.exe were working together to take up 50% of the CPU. Tried to compare it to another 6930p that's working fine using process explorer. Didn't have enough time today, but I'll give that a shot and maybe log on to his laptop as another user to see if the issue re-occurs and hopefully find out what's causing those seemingly random processes to spike like that.

 

[Ian]

Have you tried removing the adapter from device manager and then let it get re-detected, recreating the TCP/IP profiles again? I know it's a basic step, but it might be worth trying that and using the latest drivers from the HP website. It may also be worth updating the audio drivers to see if that fixes the bluescreen.

Does anything else odd show up in event viewer?

 

[anon_gb]

Thanks for the tip Ian. Unfortunately, I did not get a chance to look at this laptop due to a backlog at work, and so another department is working on it. They say it's related to Symantec Endpoint Protection causing a conflict with something he's installed.

I thought I saw the problem with and without that installed, but oh well. I'll be sure to give that a go if I have a chance as I didn't think to try it earlier. I'll post any follow up information I get from them, and any fixes.

Cheers