Broken LAN - Limited or No Connectivity with XP SP2

[Dave Blake]

Trying to help a friend recover from a nasty virus/spyware attack. PC now
scans clean (using F-Prot, Ad-Aware, Spybot etc.), has a clean HijackThis
log but can not connect to the internet. They have XP (SP2) and a cable
modem broadband connection. The modem works fine when I connect another PC
to it so AKAIK there are no problems with the hardware or ISP.

Maybe the Winsock had been damaged by anti-spyware removing Webhancer? Have
tried a number of fixes:
1) netsh winsock reset
2) LSP fix utility
3) A WinsockFix utility
4) Deleted the Winsock registry entries and repeated the above.

TCP/IP might be damaged in some way (Webhancer was removed) but I can't see
how or what to do about it.

The LAN connection gives a "Limited or No Connectivity" message. Repair does
not fix anything. Properties show that a small (<100) number of packets are
initially sent and received.

Ipconfig /all output stops after Default Gateway (none shown). DHCP and
Autoconfiguration are both enabled, but it seems that it is not finding the
DHCP or DNS servers. All necessary services are running (compared to a
working PC).

Uninstalled firewall (Zonealarm) and anti-virus (Norton 2002) but did not
help. I even tried unplugging the network card, reboot without it, then plug
it back in just in case.

Now I am stuck. Any suggestions how to get this working? I wonder if SP2 is
the culpret somehow, or if the repair tools are not compatible. But LAN was
working with SP2 for some months before the attack.

Unfortunately the PC is an HP one, with no Windows CD just recovery from OEM
disk partition. I really want to avoid going down the long and painful
destructive recovery route if possible.

Hope someone can help
Dave

 

[Dave Blake]

try to reset CP/IP by following this page,
http://www.howtonetworking.com/Windows/resettcpip1.htm

Have tried netsh int ip reset [log_file_name] but still no luck.

Also tried flushing the ARP cache with
netsh interface ip delete arpcache

Found that TCP/IP packet filtering was enabled and cleared that too.

Restarted and checked everything twice. Power cycled the modem too, waited
for the DHCP server (at the ISP) to provide an address. Lots of waiting....
(This works quickly with another PC on the same cable modem).

Finally uninstalled SP2, just in case it was responsible (even though had
been working with SP2 for months before breaking)

Still nothing

Ipconfig shows:
IP address of 169.254.159.33
Sub mask 255.255.0.0
But there is no default gateway address, or DHCP or DNS server address

It can ping 127.0.0.1
It can ping localhost

It is just not seeing the DHCP server and I am out of ideas.

Dave

 

[Robert L [MS-MVP]]

try to reset CP/IP by following this page, http://www.howtonetworking.com/Windows/resettcpip1.htm

Don't send e-mail or reply to me except you need consulting services. Posting on MS newsgroup will benefit all readers and you may get more help.

Bob Lin, MS-MVP, MCSE & CNE
How to Setup Windows, Network, Remote Access on http://www.HowToNetworking.com
Networking, Internet, Routing, VPN Troubleshooting on http://www.ChicagoTech.net
This posting is provided "AS IS" with no warranties.
I recommend Brinkster for web hosting!

Trying to help a friend recover from a nasty virus/spyware attack. PC now
scans clean (using F-Prot, Ad-Aware, Spybot etc.), has a clean HijackThis
log but can not connect to the internet. They have XP (SP2) and a cable
modem broadband connection. The modem works fine when I connect another PC
to it so AKAIK there are no problems with the hardware or ISP.

Maybe the Winsock had been damaged by anti-spyware removing Webhancer? Have
tried a number of fixes:
1) netsh winsock reset
2) LSP fix utility
3) A WinsockFix utility
4) Deleted the Winsock registry entries and repeated the above.

TCP/IP might be damaged in some way (Webhancer was removed) but I can't see
how or what to do about it.

The LAN connection gives a "Limited or No Connectivity" message. Repair does
not fix anything. Properties show that a small (<100) number of packets are
initially sent and received.

Ipconfig /all output stops after Default Gateway (none shown). DHCP and
Autoconfiguration are both enabled, but it seems that it is not finding the
DHCP or DNS servers. All necessary services are running (compared to a
working PC).

Uninstalled firewall (Zonealarm) and anti-virus (Norton 2002) but did not
help. I even tried unplugging the network card, reboot without it, then plug
it back in just in case.

Now I am stuck. Any suggestions how to get this working? I wonder if SP2 is
the culpret somehow, or if the repair tools are not compatible. But LAN was
working with SP2 for some months before the attack.

Unfortunately the PC is an HP one, with no Windows CD just recovery from OEM
disk partition. I really want to avoid going down the long and painful
destructive recovery route if possible.

Hope someone can help
Dave

 

[Treeman]

Try this hotfix from Microsoft.
'KB884020' (http://tinyurl.com/56333)
Tcpip.sys
Treeman

 

[Dave Blake]

Thanks, have seen this but since I did not think we were using a "loopback
range" didn't try it. Now have uninstalled SP2 (in despiration) so can't use
this. But still no joy with the LAN. I wonder if SP2 uninstalled completely?
Worth trying to reinstall SP2?

Dave