intermittent limited or no connectivity

[Guest]

We have a user with a laptop (XP SP2) that gets an intermittent "limited or
no connectivity" error when he connects to the LAN. It will automatically
reconnect and work fine for about 45 seconds until it loses connection again.
The user does have a wireless network at home and says it connects fine to
his home wireless network. I have found temporary solutions for the problem
but nothing that will fix this for good. If I go to task manager and end the
svchost.exe process, the error stops. More specifically, I can also go to
services and stop the network connections service to prevent the error. I do
not want to permanently disable this service though.

Here are some things I have tried after looking through this forum:
1.Reinstall drivers
2.Ran winsockfix.exe
3.reset tcp/ip using the "netsh int ip reset..." command
4.tried using the xp repair disk.
5. I ran the SP2 patch that supposedly solves the limited or no connectivity
error.

Any ideas would be greatly appreciated. Thanks.

Rich

 

[Chuck]

We have a user with a laptop (XP SP2) that gets an intermittent "limited or
no connectivity" error when he connects to the LAN. It will automatically
reconnect and work fine for about 45 seconds until it loses connection again.
The user does have a wireless network at home and says it connects fine to
his home wireless network. I have found temporary solutions for the problem
but nothing that will fix this for good. If I go to task manager and end the
svchost.exe process, the error stops. More specifically, I can also go to
services and stop the network connections service to prevent the error. I do
not want to permanently disable this service though.

Here are some things I have tried after looking through this forum:
1.Reinstall drivers
2.Ran winsockfix.exe
3.reset tcp/ip using the "netsh int ip reset..." command
4.tried using the xp repair disk.
5. I ran the SP2 patch that supposedly solves the limited or no connectivity
error.

Any ideas would be greatly appreciated. Thanks.

Rich

Rich,

The "limited or no connectivity" error is a warning that the computer has not
been granted DHCP settings for some reason, and is now operating under an APIPA
address.
http://support.microsoft.com/?id=220874

Which svchost.exe are you ending? Is it for sure "svchost.exe" and not an
imposter? If you stop the network connections service (what's the exact name of
the service), is the laptop able to connect? Can he use LAN resources when he's
under "limited or no connectivity"?

Could we maybe see ipconfig from his home setting, from when he's successfully
connected to your LAN, and from when he's operating under "limited or no
connectivity"?

Provide ipconfig for each of the 3 cases (and please do NOT munge details):
1) Start - Run - "cmd".
2) Type "ipconfig /all >c:\ipconfig.txt" into the command window.
3) Open Notepad, make sure that Format - Word Wrap is NOT checked!.
4) Open file c:\ipconfig.txt from Notepad.
5) Copy and paste entire contents of the file into your next post.

--
Cheers,
Chuck
Paranoia comes from experience - and is not necessarily a bad thing.
My email is AT DOT
actual address pchuck sonic net.

 

[Guest]

I will get you the ipconfig as soon as I can. It will be impossible to do
under the "limited or no connectivity" error because that only last 1 second
before it gets reconnected.

I'm pretty sure that the svchost.exe process I end is not an imposter
because I notice that legitimate services are stopped when I end the process
(I also checked for viruses). The "network connections" service is the actual
name of the service. It should be on yours too. I can connect even with this
service started, but it will kick me off and reconnect about every minute. If
I stop the service it will no longer kick me off. The "limited or no
connectivity" warning is not a false one, as it does actually kick me off the
network for a second before reconnecting.

The user took his laptop home so I'll try to get the info tomorrow. Thanks
for looking into it.

Richard

 

[Chuck]

I will get you the ipconfig as soon as I can. It will be impossible to do
under the "limited or no connectivity" error because that only last 1 second
before it gets reconnected.

I'm pretty sure that the svchost.exe process I end is not an imposter
because I notice that legitimate services are stopped when I end the process
(I also checked for viruses). The "network connections" service is the actual
name of the service. It should be on yours too. I can connect even with this
service started, but it will kick me off and reconnect about every minute. If
I stop the service it will no longer kick me off. The "limited or no
connectivity" warning is not a false one, as it does actually kick me off the
network for a second before reconnecting.

The user took his laptop home so I'll try to get the info tomorrow. Thanks
for looking into it.

Rich,

OK, "Network Connections" aka "Netman" runs under
"C:\WINDOWS\System32\svchost.exe -k netsvcs", along with over a dozen other
services, including Browser, Scheduler, Server, Workstation... I'm surprised
that the computer would work at all if you stop that svchost.exe. How did you
identify that one as the possible cause for your symptom?

One minute online, one minute offline, alternating? How "intermittent" is it?

What virus checker did you run? How about malware / spyware? Maybe even a
rootkit search if nothing else turns up.

This sure sounds like a possible malware problem.

Try one or more of these free online virus scans, which should complement your
current protection:
<http://www.bitdefender.com/scan/license.php>
<http://www.pandasoftware.com/activescan>
<http://www.ravantivirus.com/scan/>
<http://security.symantec.com/ssc/home.asp>
<http://housecall.trendmicro.com/housecall/start_corp.asp>

Now check for, and learn to defend against, non-viral malware.

Start by downloading each of the following additional free tools - and download
each individual product from each link as listed:
AdAware <http://www.lavasoftusa.com/>
CWShredder <http://www.intermute.com/spysubtract/cwshredder_download.html>
HijackThis <http://www.tomcoyote.com/hjt/>
LSP-Fix <http://www.cexx.org/lspfix.htm>
WinsockXPFix <http://www.spychecker.com/program/winsockxpfix.html>
Spybot S&D <http://www.safer-networking.org/index.php?page=download>
Stinger <http://us.mcafee.com/virusInfo/default.asp?id=stinger>
TrendMicro Sysclean <http://www.ik-cs.com/got-a-virus.htm>

Create a separate folder for HijackThis, such as C:\HijackThis - copy the
downloaded file there. Create a separate folder for the TrendMicro files, such
as C:\TrendMicro - copy the downloaded files there (unzipped if necessary).
AdAware, CWShredder, and Spybot S&D have install routines - run them. The other
downloaded programs can be copied into, and run from, any convenient folder.

First, close all Internet Explorer and Outlook windows.

Run Stinger. Have it remove all problems found.

Run CWShredder. Have it fix all problems found.

Empty your temporary files folders:
- "C:\WINDOWS\Temp"
- "C:\Documents and Settings\(Username)\Local Settings\Temporary Internet
Files".

Next, disable System Restore.
<http://vil.nai.com/vil/SystemHelpDocs/DisableSysRestore.htm>
Boot your computer into Safe Mode.
http://support.microsoft.com/?id=315222
Download and run SysClean per instructions. Delete any infections found.
Reboot your computer, and re enable System Restore.

Next, run AdAware. First update it, configure for full scan
(<http://forums.spywareinfo.com/index.php?showtopic=11150>), then scan. When
scanning finishes, remove all Critical Objects found.

Next, run Spybot S&D. First update it, then run a scan. Trust Spybot, and
delete everything ("Fix Problems") that is displayed in Red.

Then, run HijackThis ("Scan"). Do NOT make any changes immediately. Save the
HJT Log.
<http://forums.spywareinfo.com/index.php?showtopic=227>

Finally, have your HJT log interpreted by experts at one or more of the
following security forums (and please post a link to your forum posts, here):
Aumha: <http://forum.aumha.org/index.php>
Net-Integration: <http://forums.net-integration.net/>
Spyware Info: <http://forums.spywareinfo.com/>
Spyware Warrior: <http://spywarewarrior.com/index.php>
Tom Coyote: <http://forums.tomcoyote.org/>

--
Cheers,
Chuck
Paranoia comes from experience - and is not necessarily a bad thing.
My email is AT DOT
actual address pchuck sonic net.