WinXP SP3 killed network connection

[tbone75]

Roughly two months ago, I assummed XP SP3 was stable enough to finally install. I have four systems on my network;

• XP Pro SP3 employer-provided laptop
• Vista SP2 laptop
• XP Pro SP2 IBM R40 laptop
• XP Home SP2 Sony VAIO desktop

After installing WinXP Home SP3 on my VAIO, my network connection stopped working. I searched the forums and found numerous issues and fixes for losing network connection after the SP3 upgrade - many of which I tried...to no avail. So, I rolled back to SP2 and the system looked back to normal. Browsing with Firefox & IE were fine, Outlook connected to POP & IMAP servers with no issues. Shortly after the rollback, it died again. I didn't go through any other major software upgrades or installs - very strange. All other three systems continued to connect to the Internet, and do so today, with no problems.

Here's the network & system in question:
ISP: Cox Communications 7Mb/512Kb
LinkSys cable modem BEFCMU10 v4
Netgear 4-port, wireless-G router WGT624 v3
- FW ver: V2.0.16_1.0.1NA
- HW ver: V3H1
Sony VAIO VGC-RB40 Desktop
- Intel PRO/100 VE NIC
- WinXP Home SP2, ver 5.1.2600
- 2GB RAM
- AVG & firewall turned off for testing

Pings, NBSTAT & ipconfig:
Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.

C:\Documents and Settings\Pam>ping 206.190.60.37

Pinging 206.190.60.37 with 32 bytes of data:

Reply from 206.190.60.37: bytes=32 time=88ms TTL=54
Reply from 206.190.60.37: bytes=32 time=182ms TTL=54
Reply from 206.190.60.37: bytes=32 time=172ms TTL=54
Reply from 206.190.60.37: bytes=32 time=173ms TTL=54

Ping statistics for 206.190.60.37:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 88ms, Maximum = 182ms, Average = 153ms

C:\Documents and Settings\Pam>ping yahoo.com

Pinging yahoo.com [209.131.36.159] with 32 bytes of data:

Reply from 209.131.36.159: bytes=32 time=38ms TTL=55
Reply from 209.131.36.159: bytes=32 time=82ms TTL=55
Reply from 209.131.36.159: bytes=32 time=101ms TTL=55
Reply from 209.131.36.159: bytes=32 time=33ms TTL=55

Ping statistics for 209.131.36.159:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 33ms, Maximum = 101ms, Average = 63ms


C:\Documents and Settings\Pam>NBTSTAT -n

Local Area Connection:
Node IpAddress: [192.168.1.5] Scope Id: []

NetBIOS Local Name Table

Name Type Status
---------------------------------------------
HOME <00> UNIQUE Registered
HOME <20> UNIQUE Registered
MSHOME <00> GROUP Registered
MSHOME <1E> GROUP Registered
MSHOME <1D> UNIQUE Registered
..__MSBROWSE__.<01> GROUP Registered


C:\Documents and Settings\Pam>ipconfig/all

Windows IP Configuration

Host Name . . . . . . . . . . . . : Home
Primary Dns Suffix . . . . . . . :
Node Type . . . . . . . . . . . . : Unknown
IP Routing Enabled. . . . . . . . : No
WINS Proxy Enabled. . . . . . . . : No

Ethernet adapter Local Area Connection:

Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Intel(R) PRO/100 VE Network Connection
Physical Address. . . . . . . . . : 00-13-20-37-9B-56
Dhcp Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
IP Address. . . . . . . . . . . . : 192.168.1.5
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 192.168.1.1
DHCP Server . . . . . . . . . . . : 192.168.1.1
DNS Servers . . . . . . . . . . . : 192.168.1.1
Lease Obtained. . . . . . . . . . : Tuesday, August 04, 2009 9:10:54 PM
Lease Expires . . . . . . . . . . : Wednesday, August 05, 2009 8:35:53 PM


Add'l info:

• System is directly connected to router - have tried multiple network cables
• I enabled NetBIOS over TCP/IP from a forum post that indicated it was mandatory. Obviously not true as none of my other XP machines have it enabled.
• TCP/IP properties set for auto obtain IP and DNS
• Have tried many /rel & /renew cmds
• Have flushed the DNS cache
• Can't ping my own IP address?!?!
• Can't ping IP of system in question from any of the other 3 systems (which can all ping each other)
• Can ping the router (192.168.1.1), but cannot connect to the mgmt GUI
• Have tried multiple network cables and all four LAN ports on router
• Connected system directly to cable modem - no change. ipconfig reveals all the appropriate IP address, gw, DHCP and DNS addresses I usually see from Cox.
• Router firmware is most current on Netgear site
• Intel NIC has drivers dated 12/2007
• Deinstalled/reinstalled Intel Pro/100 NIC device - no change
• Firefox error msg: Can't establish connection to the server at en-us.start2.mozilla.com
• IE error msg: Cannot display the webpage

Sure feels like a DNS issue, as I can ping some IPs outside the network. Would love some help. Driving me crazy.

Thanks.

[Suncoast]

DNS Servers . . . . . . . . . . . : 192.168.1.1

I'm not sure this is optimal, but at least appears to be working, since you can ping some sites by name. At least I have not run across this. Usually the Router gets the DNS servers from it's DHCP lease from the ISP, then passes out the same addresses to it's clients unless the DNS IP addresses are set manually.

Anyway, all troubleshooting of physical things should be considered done and ok.
You do not need Netbios/File Sharing for this to work. OK to keep it for now.

In your browser, enter one of the following IP addresses as an address:

Address: 74.125.67.106
Address: 74.125.67.99
Address: 74.125.67.147

IF any part of the Google website opens, it's a DNS issue.

If it does not, check your Internet Explorer Proxy settings, and make sure they are all disabled. EVEN if you are connecting through a proxy. If normal browsing does not work, try to connect to your routers web interface at 192.168.1.1

[tbone75]

I've always thought that the DNS servers should show up on the client side as the ISP-provided addresses as well, but in all the many wired/wireless routers I've had, from the client side it always shows up as the router IP. If there's a more correct way to configure that, I'm all ears.

I've connected directly to the cable modem so I would get the ISP DNS servers dynamically, no change. I've configured the browser LAN settings with the static ISP DNS server IPs, rebooted...no change.

Tried each of the Google IPs, nothing connects.
Proxy server settings are disabled.
No browser autoconfiguration settings enabled.

[Suncoast]

Humph. With all you posted, it doesn't leave too many possibilities.

To answer the new question, you should be able to define your DNS servers of choice in the router setup. Then your DHCP renewals should point to the exterior IP addresses.

I say should because I would promptly return a router that forced me to use whatever DNS settings the ISP sent me in DHCP. And many locations have their own DNS servers.

I'll have to think about the original problem, I have nothing right now.

[tbone75]

Thanks for your help to this point. I feel better at least confirming that my troubleshooting methodology has been headed down the right path.

I attached the output from XP's Network Diagnostics utility in case there are any answers lurking within.

Concerning the DNS servers, do you have certain DNS machines you use in your router config that you have determined over time are more solid than default ISP-provided DNS machines? If so, would you share them? While I haven't had any problems with the Cox DNS servers that I'm aware of, if there are some generally accepted, more solid servers, I might as well use them.

[Suncoast]

That's odd, you can't ping your own IP address of 192.168.1.5? If that's true, it means you can eliminate everything external.... Except a duplicate IP address. What happens if you run "ping localhost"? And ping the 192.168.1.5 again also.

FWIW, all the settings shown in the diagnostic output looks good.

[Suncoast]

Also pull up Event Viewer to see the system messages and look for errors. Start, Run "eventvwr.msc"

I'll be working on a PC with the same symptoms this afternoon.

[tbone75]

Just as a side note, I tried an ipconfig/flushdns & /registerdns on another recommendation - no change.

Ok, on to the duplicate IP and event viewer results. I had forgotten to mention that in the past on various occassions, I did have an duplicate IP address conflict on the network. I usually noticed the message on another on of my laptops which sits right beside my work system in my home office. The situation always cleared itself up on my laptop so I never examined the system in question (the VAIO.) Searching the event viewer for the VAIO, I did find the same error message that a duplicate IP was detected on the network. I've attached a file with an extract of those error messages.

Since all the multiple releasing of IP addresses and reboots, the VAIO ended up with an IP of 192.168.1.2 and I have now done an address reservation on the router for the VAIO for this IP. Then I rebooted all machines as similtaneously as possible, multiple times, trying to recreate any dup IP isssues. It has not happened so I believe I can rule out the duplicate IP issue now?

On the localhost ping...interesting. I can ping localhost with a <1ms response but pinging my IP of 192.168.1.2 times out.

[Daakuryu]

Ahh good ol' Semaphore the error that means absolutely nothing.

Definitely a DHCP issue it seems, try assigning ip addresses to each computer and see if the problem persists.

Does your Nic card have a diagnostic software?

[Suncoast]

Tbone:75

The first error (not quoted) has to do with the DHCP renewal process. It means you were not connected to the router or your lease had already expired when you re-opened the laptop. It's more of an FYI. Not the problem.

The system detected an address conflict for IP address 192.168.1.3 
with the system having network hardware address 00:18:4D:94:3B:77. 
Network operations on this system may be disrupted as a result.

I'm thinking one of the laptops was simply turned off, and another laptop was given it's IP address in the meantime. Or the router lost power and forgot you. But not the problem. However this one:

Event Type:	Error
Event Source:	ipnathlp
Event Category:	None
Event ID:	32003
Date:		8/10/2009
Time:		3:46:55 AM
User:		N/A
Computer:	SONYVAIO-RB40
Description:
The Network Address Translator (NAT) was unable to request an operation 
of the kernel-mode translation module. This may indicate misconfiguration, 
insufficient resources, or an internal error. The data is the error code.
Data:

Means (ICS) Internet Connection Sharing is running. You should disable it. Here is a Link from University of Delaware on how to do this.


And I found the PC I mentioned earlier had a Root Virus.

edit: And make sure it's turned off on ALL network adapters, even ones that may not be in use.

[tbone75]

Hmm...I only found an Internet Sharing option on the 1394 network connection properties and it was not enabled. The wired Intel Pro/100 VE adapter connection did not have an Internet Sharing option available...seems a bit strange. All of my other computers have that option available and two of the other three computers both use the same Intel Pro/100 VE network connection driver.

I have verified ICS on all network adapters on all computers is disabled.

I did successfully download and install the most recent Microsoft XP patches released on Patch Tuesday. Must be using a different protocol and not needing/using a DNS server?

[Suncoast]

Have you considered the PC has malware of some kind? This site has a great forum and some free detection utilities you may want to consider trying. Look at this thread, except in your case you will probably need to download the utilities to a USB thumb drive on another PC first.

If you're thinking it's a DNS problem, try this from a command prompt. Everything following the > symbol is something to type in.

C:\Windows\system32>nslookup
Default Server:  dc1.flausa.loc
Address:  192.168.65.10
(Note: You will probably see 192.168.1.1)

> server 4.2.2.2
DNS request timed out.
    timeout was 2 seconds.
Default Server:  [4.2.2.2]
Address:  4.2.2.2

> www.fred.com
Server:  [4.2.2.2]
Address:  4.2.2.2

Non-authoritative answer:
Name:    www.fred.com
Address:  213.11.172.228

> server 68.11.16.30
Default Server:  ns1.no.cox.net
Address:  68.11.16.30

> www.fred.com
Server:  ns1.no.cox.net
Address:  68.11.16.30
*** Request to ns1.no.cox.net timed-out

DNS request timed out. 
       timeout was 2 seconds. 

> exit

C:\Windows\system32>

The server at 4.2.2.2 will not always work. It is a large DNS server for Verizon formerly GTE. The second server should be yours, however my attempt failed because I'm not on that network. You can double check if the DNS IP addresses are working for you at all by trying the same commands on a working laptop.

And for good measure, try this from a command prompt:
netsh winsock reset
and then reboot.

[tbone75]

Well, after much time diagnosing symptoms that seemed to lead to nowhere, my Internet browsing capability is restored. I wish that I could articulate a more plausible resolution, but here's the sequence of events.

It started with the desire to load Win7 and the last reply post asked if I had checked for malware. While I was fairly positive this was not an issue, I figured there was nothing to lose by giving it a very thorough cleaning. Since I had no way to update my AVG dat file online, I downloaded the full v9 kit and update binaries onto a flash drive to install locally.

A strange thing happened on the way to the install...the AVG installer barked that there was another anti-virus program loaded that must be removed first. You guessed it...good 'ole Norton. I had previously removed most of the Norton stuff through Add/Remove programs, but LiveUpdate was still installed. Typical of Symantec's invasive design, I couldn't remove it through Windows as this error msg enjoyed reminding me, "You can't remove LiveUpdate as there are other programs that require it..." Infuriating!

So I started with the registry, deleting every instance of Norton or Symantec I could find. The last remaining key (can't remember which section it was in) would not delete. Then I explicitly deleted all Symantec folders and common files until I was stumped by several files that I was denied access. I then remembered that Symantec publishes a Norton Removal Tool just for these occassions. I downloaded the tool, ran it, which removed all remaining traces of Norton 2005 and rebooted.

And whah-lah...full Internet browsing capability restored! I still haven't a clue what Norton process was prohibiting browsing access. Additionally confusing is the fact that the system was functioning fine, pre-WinXP SP3 install, with Norton AV deinstalled (so I thought), AVG & Windows firewall running - so why did the install of SP3 suddenly surface these anomolies? Whatever happened, something was altered to the point that the System Restore back to SP2 didn't fully clean it up.

Anyway, I'm running again and preparing to upgrade to Win7. Thanks Suncoast, for sticking with me through the process. And hats off to Tech Support Forums for the venue.

Peace!
Tommy

[Suncoast]

Norton has some infuriating quirks at times. Thanks for taking the time to post a follow-up on how you resolved it.