fishingfox

After removing some viruses and trojans from a XP Pro SP3 system, the system is unable to connect to the network or internet.
The network adapter is active shows connected.

List of attempted fixes:
1. I can't ping localhost, system IP or any IP
2. Changed from Static IP to DHCP. Acquired adddress.
3. Uninstalled the network adapter in Device Manager
Shut down
Removed NIC from computer
Restarted Windows
Shut down and reinstalled NIC
` Restarted Windows
Scanned for Hardware changes and reinstalled the drivers
4. Change back to fixed IP
5. netsh int ip reset and netsh winsock reset catalog
6. Disabled XP firewall
7. Checked the Hosts file and added localhost to lmhost file
8. Switched to the onboard 10/100 network adapter.
9. Swapped patch cables
10. changed to different port on switch.
Plus several other things which I have probably forgotten.

Output from various pings, ipconfig, netstat
Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.

C:\Documents and Settings\Cecilia>ping localhost

Pinging Reception-51642 [127.0.0.1] with 32 bytes of data:

Destination host unreachable.
Destination host unreachable.
Destination host unreachable.
Destination host unreachable.

Ping statistics for 127.0.0.1:
Packets: Sent = 4, Received = 0, Lost = 4 (100% loss),

C:\Documents and Settings\Cecilia>ipconfig /all

Windows IP Configuration

Host Name . . . . . . . . . . . . : Reception-51642
Primary Dns Suffix . . . . . . . :
Node Type . . . . . . . . . . . . : Unknown
IP Routing Enabled. . . . . . . . : No
WINS Proxy Enabled. . . . . . . . : No

Ethernet adapter Local Area Connection 2:

Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Realtek RTL8169/8110 Family Gigabit
Ethernet NIC
Physical Address. . . . . . . . . : 00-06-4F-2E-E0-89
Dhcp Enabled. . . . . . . . . . . : No
IP Address. . . . . . . . . . . . : 192.168.0.6
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 192.168.0.1
DNS Servers . . . . . . . . . . . : 205.171.3.65
205.171.2.65

C:\Documents and Settings\Cecilia>ping 192.168.0.6

Pinging 192.168.0.6 with 32 bytes of data:

Destination host unreachable.
Destination host unreachable.
Destination host unreachable.
Destination host unreachable.

Ping statistics for 192.168.0.6:
Packets: Sent = 4, Received = 0, Lost = 4 (100% loss),

C:\Documents and Settings\Cecilia>ping 192.168.0.1

Pinging 192.168.0.1 with 32 bytes of data:

Destination host unreachable.
Destination host unreachable.
Destination host unreachable.
Destination host unreachable.

Ping statistics for 192.168.0.1:
Packets: Sent = 4, Received = 0, Lost = 4 (100% loss),

C:\Documents and Settings\Cecilia>netstat -n

Active Connections

Proto Local Address Foreign Address State

C:\Documents and Settings\Cecilia>

Any assistance will be GREATLY appreciated.

faradd

Hi, wow you have tried nearly everything I would suggest. But just to clarify, when you go to start then run and type devmgmt.msc
then go to network adapters is there one present, yes.

If your getting your IP from DHCP, do you have a router? check the router settings to make sure there isn't a policy, i.e. some routers will prevent you from accessing the internet certain days.

This time when your pc turns on, try pressing f8 repeatedly which will display advanced boot options, then click on safemode plus networking see if you still cannot connect.

instead of netstat -n
try netstat -e

Is there a laptop or another computer you can connec to this switch to see if the problem is with computer.

I have uploaded the file wisock.zip save to computer, run it, it might fix your problem.

Other than I can't think of anything else.

Attached Files

WinsockxpFix.zip (683.6 KB, 3 views)

fishingfox

Thank you faradd for your reply.

1. Device manager shows the network adapter is there enabled and working properly.
2. I have this computer in my network now, not where it normally is. It does not work in either network.
3. Using a static or fixed IP yields the same results
4. Booting into safe mode with networking WORKS! I can ping localhost, local IP, and the gateway.

Now what?

I will try the winsockfix program and post back.

Here are the results from ipconfig, the pings and netstat -e:

Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.

C:\Documents and Settings\Cecilia>ping localhost

Pinging Reception-51642 [127.0.0.1] with 32 bytes of data:

Reply from 127.0.0.1: bytes=32 time<1ms TTL=128
Reply from 127.0.0.1: bytes=32 time<1ms TTL=128
Reply from 127.0.0.1: bytes=32 time<1ms TTL=128
Reply from 127.0.0.1: bytes=32 time<1ms TTL=128

Ping statistics for 127.0.0.1:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 0ms, Maximum = 0ms, Average = 0ms

C:\Documents and Settings\Cecilia>ping 192.168.0.1

Pinging 192.168.0.1 with 32 bytes of data:

Reply from 192.168.0.1: bytes=32 time<1ms TTL=64
Reply from 192.168.0.1: bytes=32 time<1ms TTL=64
Reply from 192.168.0.1: bytes=32 time<1ms TTL=64
Reply from 192.168.0.1: bytes=32 time<1ms TTL=64

Ping statistics for 192.168.0.1:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 0ms, Maximum = 0ms, Average = 0ms

C:\Documents and Settings\Cecilia>netstat -e
Interface Statistics

Received Sent

Bytes 15411 11178
Unicast packets 27 25
Non-unicast packets 67 66
Discards 0 0
Errors 0 0
Unknown protocols 0

C:\Documents and Settings\Cecilia>

fishingfox

I just ran the winsockfix in safe mode. Booted back into Windows. No Joy!

Any other ideas?

faradd

Try this for now until I can think of something good

Click start then run and type msconfig
then click on start-ep and make sure all are disabled
now click the services tab, then click hide all microsoft services make sure you do this
then disable the services listed here not microsoft ones by unchecking it

restart machine and post back.

fishingfox

That worked. Now to figure out which one is causing the problem.

faradd

Hey, It can be a pain in you know where, but right down which ones you enabled and instead or restarting machine log off and then logon. Though a restart would be better.

fishingfox

faradd,

The service that was causing the problem was ipfw_helper that pointed to the file c:\windows\system32\8640.exe. That file was deleted during the malware cleanup. I disabled the service and everything is working.

Thank you again.

I will send a donation this evening.

faradd

Thanks for your reply and you are welcome.