no port 80 communications

[jzechar]

I CANNOT open http pages in either IE or Firefox. I CAN open https
pages, email, ftp, non-standard ports via DC++, etc. I cannot access
port 80 via other applications like Exact Audio Copy (for CD lookup) or
MusicBrainz Picard.

When this problem first began, I was able to access port 80 for a few
minutes (~5) after restarting the machine, then never again until
restarting.

Same symptoms whether using wireless or ethernet, at home and at work,
with or without Windows Firewall.

I've tried Windows Defender, SpyBot Search & Destroy, Symantec scans;
nothing is found.

I can provide packet capture file obtained via Wireshark.

Any ideas?

 

[Chuck]

I CANNOT open http pages in either IE or Firefox. I CAN open https
pages, email, ftp, non-standard ports via DC++, etc. I cannot access
port 80 via other applications like Exact Audio Copy (for CD lookup) or
MusicBrainz Picard.

When this problem first began, I was able to access port 80 for a few
minutes (~5) after restarting the machine, then never again until
restarting.

Same symptoms whether using wireless or ethernet, at home and at work,
with or without Windows Firewall.

I've tried Windows Defender, SpyBot Search & Destroy, Symantec scans;
nothing is found.

I can provide packet capture file obtained via Wireshark.

Any ideas?

What condition or error are you seeing when you "CANNOT open http pages"?
<http://nitecruzr.blogspot.com/2005/06/background-information-useful-in.html>
http://nitecruzr.blogspot.com/2005/06/background-information-useful-in.html

Is Windows Firewall the only security product on your computer? Be thorough
here.
<http://nitecruzr.blogspot.com/2005/05/your-personal-firewall-can-either-help.html>
http://nitecruzr.blogspot.com/2005/05/your-personal-firewall-can-either-help.html

Anything in Event Viewer?
<http://nitecruzr.blogspot.com/2005/05/using-event-viewer-to-get-details.html>
http://nitecruzr.blogspot.com/2005/05/using-event-viewer-to-get-details.html

I'd look for LSP / Winsock corruption.
<http://nitecruzr.blogspot.com/2005/05/problems-with-lsp-winsock-layer-in.html>
http://nitecruzr.blogspot.com/2005/05/problems-with-lsp-winsock-layer-in.html

 

[jzechar]

Thanks, Chuck, for jumping in on this.


Regarding Chuck's questions:

IE7 Beta 3 gives standard "Internet Explorer cannot display the
webpage" page; Firefox
1.5.0.7 gives standard "Unable to connect" page.

Windows Firewall is the only firewall product on my system. I have
Symantec Antivirus, but no bundled firewall.

Event Viewer contains several instances of DCOM error w/ the following
description:

DCOM got error "The service cannot be started, either because it is
disabled or because it has no enabled devices associated with it. "
attempting to start the service IISADMIN with arguments "" in order to
run the server:
{A9E69610-B80D-11D0-B9B9-00A0C922E750}

However, many instances of this error occur before the port 80 problem
cropped up.

I followed each of the steps at
http://nitecruzr.blogspot.com/2005/05/problems-with-lsp-winsock-layer-in.html
and still no resolution.

Re: a packet capture, I see no outgoing http requests from my PC.
However, I do see a [RST, ACK] packet from any IP to which I try to
connect (either by IP or name) sent to me, followed immediately by a
successful packet going from that IP to a 209.x.x.x IP (owned by Zone
Labs). Is this a further clue?

Thanks for any help!

 

[Chuck]

Thanks, Chuck, for jumping in on this.


Regarding Chuck's questions:

IE7 Beta 3 gives standard "Internet Explorer cannot display the
webpage" page; Firefox
1.5.0.7 gives standard "Unable to connect" page.

Windows Firewall is the only firewall product on my system. I have
Symantec Antivirus, but no bundled firewall.

Event Viewer contains several instances of DCOM error w/ the following
description:

DCOM got error "The service cannot be started, either because it is
disabled or because it has no enabled devices associated with it. "
attempting to start the service IISADMIN with arguments "" in order to
run the server:
{A9E69610-B80D-11D0-B9B9-00A0C922E750}

However, many instances of this error occur before the port 80 problem
cropped up.

I followed each of the steps at
http://nitecruzr.blogspot.com/2005/05/problems-with-lsp-winsock-layer-in.html
and still no resolution.

Re: a packet capture, I see no outgoing http requests from my PC.
However, I do see a [RST, ACK] packet from any IP to which I try to
connect (either by IP or name) sent to me, followed immediately by a
successful packet going from that IP to a 209.x.x.x IP (owned by Zone
Labs). Is this a further clue?

Well, Zone Labs makes Zone Alarm, and we all know how intrusive and problematic
it can be. So you've got a ZA component in there somewhere, and I'd bet that
it's at least part of the problem.

And you ran each of the steps in LSP / Winsock Repair, and no problems were
suggested for repair?

 

[jzechar]

I've never had ZA installed on this system.

I tried each step in the LSP / Winsock Repair short of re-installing
the hardware. Problem happens on wireless and wired so I don't think
it's a hardware issue. No problems were suggested.

Thanks, Chuck, for jumping in on this.


Regarding Chuck's questions:

IE7 Beta 3 gives standard "Internet Explorer cannot display the
webpage" page; Firefox
1.5.0.7 gives standard "Unable to connect" page.

Windows Firewall is the only firewall product on my system. I have
Symantec Antivirus, but no bundled firewall.

Event Viewer contains several instances of DCOM error w/ the following
description:

DCOM got error "The service cannot be started, either because it is
disabled or because it has no enabled devices associated with it. "
attempting to start the service IISADMIN with arguments "" in order to
run the server:
{A9E69610-B80D-11D0-B9B9-00A0C922E750}

However, many instances of this error occur before the port 80 problem
cropped up.

I followed each of the steps at
http://nitecruzr.blogspot.com/2005/05/problems-with-lsp-winsock-layer-in.html
and still no resolution.

Re: a packet capture, I see no outgoing http requests from my PC.
However, I do see a [RST, ACK] packet from any IP to which I try to
connect (either by IP or name) sent to me, followed immediately by a
successful packet going from that IP to a 209.x.x.x IP (owned by Zone
Labs). Is this a further clue?

Well, Zone Labs makes Zone Alarm, and we all know how intrusive and problematic
it can be. So you've got a ZA component in there somewhere, and I'd bet that
it's at least part of the problem.

And you ran each of the steps in LSP / Winsock Repair, and no problems were
suggested for repair?

 

[jzechar]

RESOLUTION:
quoting from http://forums.speedguide.net/showthread.php?t=207700

"Recently my computer would lose all outgoing internet access on ONLY
port 80 exactly 10min after rebooting.

After doing a full virus scan which was clean I plugged it into a linux
firewall and sniffed all outgoing traffic to see if anything was going
out.

It had outgoing traffic to 209.87.208.60:8083 which reverses to
lockup.zonelabs.com.

Reading the page at http://lockup.zonelabs.com/8083.html (which has a
stuffed up mime type cause it displays the raw html code) and finding
the instructions at http://lockup.zonelabs.com/downloads/SafeMode.doc
seems to have fixed it.

Zone Alarm seemed to think it was broken and so was blocking all
outgoing traffic after 10 min

The only thing is, I have NEVER EVER installed ZoneAlarm on this
machine. It is behind a hardware firewall. I have installed NO
firewall products. I managed to get this working by being fairly IT
savy and having a proxy server I could use to browse the net, hence
bypassing the port 80 restriction but how on earth could Zone Alarm
have
got onto my machine? The only thing I have installed recently is the
Win32 version of Apache/PHP.

Has anyone seen this before?

cheers

Mark"

The resolution for me was:

Reboot Windows in Safe Mode.
Search for and delete files VSDATA*.*
Search for and delete folders "INTERNET LOGS"
Reboot normally.

 

[Chuck]

RESOLUTION:
quoting from http://forums.speedguide.net/showthread.php?t=207700

"Recently my computer would lose all outgoing internet access on ONLY
port 80 exactly 10min after rebooting.

After doing a full virus scan which was clean I plugged it into a linux
firewall and sniffed all outgoing traffic to see if anything was going
out.

It had outgoing traffic to 209.87.208.60:8083 which reverses to
lockup.zonelabs.com.

Reading the page at http://lockup.zonelabs.com/8083.html (which has a
stuffed up mime type cause it displays the raw html code) and finding
the instructions at http://lockup.zonelabs.com/downloads/SafeMode.doc
seems to have fixed it.

Zone Alarm seemed to think it was broken and so was blocking all
outgoing traffic after 10 min

The only thing is, I have NEVER EVER installed ZoneAlarm on this
machine. It is behind a hardware firewall. I have installed NO
firewall products. I managed to get this working by being fairly IT
savy and having a proxy server I could use to browse the net, hence
bypassing the port 80 restriction but how on earth could Zone Alarm
have
got onto my machine? The only thing I have installed recently is the
Win32 version of Apache/PHP.

Has anyone seen this before?

cheers

Mark"

The resolution for me was:

Reboot Windows in Safe Mode.
Search for and delete files VSDATA*.*
Search for and delete folders "INTERNET LOGS"
Reboot normally.

Thanks for the update. Life is full of mystery, and that's part of life.