[SOLVED] HTTP (port 80) dies 10 minutes after Reboot

[tdbs]

Hello All,

I'm new here, and looking for assistance with a very strange issue.

My main machine, running WinXP Pro SP2, has the following problem that began last week.

- Once windows boots, everything runs normally (O/S, apps, network). I can browse the net and run everything as usual.
- About 10 minutes after boot (timed with stopwatch), I can no longer browse any http sites - it just doesnt connect.
- All other functions continue to work normally - I can ping google.com, listen to streaming radio, and visit HTTPS sites.

This leads me to beleive that only HTTP connectivity (going through port 80) has been lost.

I have verified the following:

- All cache is clear
- Windows firewall is turned off and no third party firewalls are running
- Browsers have no effect on the problem (both IE and Firefox behave identically)
- No software/drivers have been installed/modified recently
- AVG and AdAware return no problems
- Rootkit Revealer returns 4 entries (all of them from registry, and look unrelated)
- The network setup (modem/routers) have no effect on the problem and are not blocking anything - plugging the computer directly into the modem does not solve the problem
- Resetting the modem/routers or the network connection, or ipconfig/release-renew, or logoff do not solve the problem - the only way to get internet back (for 10 mins) is a reboot
- The problem also occurs in Safe Mode (with Networking)
- Booting a live Linux CD and browsing for 10 minutes does not trigger the problem, so its probably not hardware related, and is Windows specific

I am seriously out of options and dont know how to proceed.

Any suggestions are welcome,
Thank you.

[kerelious]

Um, Im sorry to say that after reveiwing this and then doing some research I cannot find this problem duplicated. Im not a net tech just a person who like to help and has learned through personal research. Hopefully a real tech can help, but I will continue to look into this to the best of my ability

[johnwill]

When the problem occurs, please try these simple tests.

Hold the Windows key and press R, then type CMD to open a command prompt:

PING 216.109.112.135

PING yahoo.com

Right click in the command window and choose Select All, then hit Enter.
Paste the results in a message here.

If you are on a machine with no network connection, use a floppy, USB disk, or a CD-RW disk to transfer a text file with the information to allow pasting it here.

[tdbs]

After more experiments, I found the source of the problem - a misbehaving ZoneAlarm install.

ZoneAlarm was originally installed on the machine, but had been disabled, and the True Vector service set to manual. A run of HijackThis showed that True Vector was still running, even though the Windows Services list showed it was not, and Task Manager did not list the image name (vsmon.exe).

To completely disable True Vector, I attempted Safe Mode with the original Admin account - access was denied. Even a registry change to disable the service was not allowed.

I then attempted to start the service in Windows - it started, and apparently gave me my internet back!



Conclusion: ZoneAlarm embeds itself very deep into the system, and is painfully difficult to remove.

Thank you for your replies.

[johnwill]

I have personally experienced ZA killing networking when it was totally uninstalled, it still leaves junk behind.