No Internet unless in Safe Mode.

[J741]

Windows XP Pro w/ SP2. Internet access is fine when in Windows Safe Mode. No internet access in Windows normal mode.

Can Ping a web address by name or IP without a problem.

Open Internet Explorer, status bar indicates 'accessing

http://websitename',

followed by 'accessing

http://IPaddress',

then IE displays the 'can not connect / DNS error' generic error message page.

Try the 'Opera' web browser, and get 'network error' message.

Try to update the customer's anti-virus program, and get 'can not connect to update server'.

I have tried all the common cleanup tools including anti-virs scans, AdAware SE v.12, Microsoft AntiSpyware beta1, LSPfix, IEfix, BHOdemon, Spybot S&D, HijackThis, and I even tried re-installing TCP/IP as per Microsoft knowledge base article Q299357.

Many spyware/adware/malware items were removed, but this issue still remains.

Ayone got any thoughts on this one? I'm stumped!

- James.

My memory is not as good as it should be, and neither is my memory.

I have forgotten more than I can remember

 

[J741]

For those who are interested, here is the HijackThis log file:


---------------------------------------------------------
Logfile of HijackThis v1.99.0
Scan saved at 5:17:04 PM, on 18/01/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG Free\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG Free\avgupsvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\PROGRA~1\Grisoft\AVG Free\avgemc.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\Documents and Settings\Ali\Desktop\Anti-Adware\Hijack This\HijackThis.exe

O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVG Free\avgemc.exe
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O23 - Service: AVG7 Alert Manager Server - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG Free\avgamsvr.exe
O23 - Service: AVG7 Update Service - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG Free\avgupsvc.exe
O23 - Service: Macromedia Licensing Service - Unknown - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe

----------------------------------------------------------

- James.

My memory is not as good as it should be, and neither is my memory.

I have forgotten more than I can remember

 

[J741]

Also, here is the NteDiag log file.

Note that the PC is currently located behind a router/firewall with an IP of 192.168.0.254, and that the network also has an internal Domain Name Server with an IP of 192.168.0.1

All other computers on this network have no internet access problems.


-------------- NetDiag log file -------------------------

Computer Name: DI7N7NBFG1K
DNS Host Name: di7n7nbfg1k
System info : Windows 2000 Professional (Build 2600)
Processor : x86 Family 5 Model 8 Stepping 12, AuthenticAMD
List of installed hotfixes :
KB834707
KB873339
KB885835
KB885836
KB886185
KB890175
Q147222


Netcard queries test . . . . . . . : Passed



Per interface results:

Adapter : Local Area Connection

Netcard queries test . . . : Passed

Host Name. . . . . . . . . : di7n7nbfg1k
IP Address . . . . . . . . : 192.168.0.27
Subnet Mask. . . . . . . . : 255.255.255.0
Default Gateway. . . . . . : 192.168.0.254
Primary WINS Server. . . . : 192.168.0.1
Dns Servers. . . . . . . . : 192.168.0.1
64.59.135.133
64.59.135.135


AutoConfiguration results. . . . . . : Passed

Default gateway test . . . : Passed

NetBT name test. . . . . . : Passed
[WARNING] At least one of the <00> 'WorkStation Service', <03> 'Messenger Service', <20> 'WINS' names is missing.

WINS service test. . . . . : Passed


Global results:


Domain membership test . . . . . . : Passed
Dns domain name is not specified.
Dns forest name is not specified.


NetBT transports test. . . . . . . : Passed
List of NetBt transports currently configured:
NetBT_Tcpip_{9946458E-7089-4911-BED4-208B523A4A82}
1 NetBt transport currently configured.


Autonet address test . . . . . . . : Passed


IP loopback ping test. . . . . . . : Passed


Default gateway test . . . . . . . : Passed


NetBT name test. . . . . . . . . . : Passed
[WARNING] You don't have a single interface with the <00> 'WorkStation Service', <03> 'Messenger Service', <20> 'WINS' names defined.


Winsock test . . . . . . . . . . . : Passed


DNS test . . . . . . . . . . . . . : Passed


Redir and Browser test . . . . . . : Passed
List of NetBt transports currently bound to the Redir
NetBT_Tcpip_{9946458E-7089-4911-BED4-208B523A4A82}
The redir is bound to 1 NetBt transport.

List of NetBt transports currently bound to the browser
NetBT_Tcpip_{9946458E-7089-4911-BED4-208B523A4A82}
The browser is bound to 1 NetBt transport.


DC discovery test. . . . . . . . . : Skipped


DC list test . . . . . . . . . . . : Skipped


Trust relationship test. . . . . . : Skipped


Kerberos test. . . . . . . . . . . : Skipped


LDAP test. . . . . . . . . . . . . : Skipped


Bindings test. . . . . . . . . . . : Passed


WAN configuration test . . . . . . : Skipped
No active remote access connections.


Modem diagnostics test . . . . . . : Passed

IP Security test . . . . . . . . . : Skipped
The IPSec service is not started.
Service status is: Stopped
Service startup is: Automatic

--------------------------------------------------------

- James.

My memory is not as good as it should be, and neither is my memory.

I have forgotten more than I can remember

 

[westredd]

any firewall on there, or any history of personal firewalls on that particular PC?

also, try disabling all the startup items with msconfig, reboot.. if the problem goes away you could try disabling one half of the startup items, reboot, then if still the same, then disable the other half to see if you can pin point what is causing the problem..

cheers

Mike

 

[westredd]

sorry, just read that you are on win 2k, no msconfig. you would need to use a startup tool.

 

[J741]

Thanks Mike, but I already tried a 'clean' boot with all startup items disabled, but with no luck.

As for the history of firewalls or Internet Security software, I do not have that information.

- James.

My memory is not as good as it should be, and neither is my memory.

I have forgotten more than I can remember

 

[J741]

It's not Windows 2000, it's Windows XP Professional Edition. I Don't know why the Microsoft NetDiag tool reports this incorrectly.

- James.

My memory is not as good as it should be, and neither is my memory.

I have forgotten more than I can remember

 

[Frank4d]

Default Gateway = 192.168.0.254 doesn't seem right. Try setting it to 192.168.0.1 (same as your router IP address).

 

[bcastner]

Default Gateway. . . . . . : 192.168.0.254

This is wrong, it is the broadcast address for this subnet. The gateway has to be 192.168.0.1 in your setting.

Best regards,
Bill Castner

 

[westredd]

isnt .255 the broadcast address?

 

[bcastner]

No it is not for that subnet mask.

 

[J741]

No, my router IS at 192.168.0.254. Only our DHCP server is at 192.168.0.1

The IP address, netmask, router, DNS, etc. are identical to those of other PCs on our network (but not the IP address) which do have internet access without a problem.

Also, I have confirmed that our network router is not causing the problem. The problem is definately some software or configuration problem on the computer.

And remember, internet access does work when Windows is in Safe Mode.

- James.

My memory is not as good as it should be, and neither is my memory.

I have forgotten more than I can remember

 

[bcastner]

In any case, your gateway is at 192.168.0.1, so pointing anywhere else will not let you on the internet.

Primary WINS Server. . . . : 192.168.0.1
Dns Servers. . . . . . . . : 192.168.0.1

You have a WINS server and a DNS proxy server at 192.168.0.1 and for your client to get on the internet your Default Gateway should point to that IP.

 

[bcastner]

J741,

This is a Domain, not a Workgroup.

In a workgroup you likely would use the router to provide DHCP server and a DNS proxy.

In a Domain, you let the Domain Controller provide both services, with forwarding to the external DNS servers for requests outside the network.

The client Default Gateway should point at the IP of the Domain DNS server and absolutely no where else. See faq779-4017

 

[westredd]

I strongly disagree, why are you saying that his default gateway is at 192.168.0.1, just because his WINS server and DNS server use that address? and he also actually states that his router is on 192.168.0.254.

another point is im really surprised to learn that 192.168.0.254 is a broadcast address for a class c ip address subnet. Dont understand, please explain. If Im wrong , I want to learn why!

Cheers

Mike

 

[bcastner]

Routers do not provide WINS servers, so there is an active DNS and WINS server being provided by the Domain controller in this Domain Setting. This is how it should be.

In that situation, you should not be using the router DNS proxy, and should not be using the router as the default Gateway. All addresses should point to the IP of the Domain controller.

I agree with you that this is likely being handled as a Class C subnet, and I was wrong about the broadcast address. My apologies.

But the notion of pointing to the router as the default Gateway in a Domain is flat-out wrong.

 

[westredd]

bcastner,

"The client Default Gateway should point at the IP of the Domain DNS server and absolutely no where else. See FAQ779-4017"

I read the faq you posted regarding this, I couldnt see anything about telling client PCs to use the DNS server as a default gateway? Is it there?

As far as I am aware a DNS server is a DNS server and a router is a router (which provides gateawy services), they have nothing to do with each other; Are there any articles on the web that u know of that actually support what you are saying?
cheers

Mike

 

[bcastner]

westredd,

Without knowing more about the number of routers involved, and the router discovery protocols used, my answer was too specific. My apologies. There are RIP issues under SP2, for example:

http://support.microsoft.com/?kbid=841804

The key to this issue remains: he has full network and internet access in Safe Mode with networking.

This is an antivirus, a firewall, or malware issue at its heart. Or as I suggested above, an issue with the logical network configuration.

Netdiag is not happy with your notion of the Gateway:

NetBT name test. . . . . . . . . . : Passed
[WARNING] You don't have a single interface with the <00> 'WorkStation Service', <03> 'Messenger Service', <20> 'WINS' names defined.

But I will leave it to you to sort the issue.

 

[J741]

The comments regarding the configuration of our router and DNS server are appreciated, but that aspect of our network configuration is not at fault here.

For those who want to know more about our network configuration (which is NOT part of the issue I'm trying to solve) here's what's going on:

We have a GVC Gnet model IP0006, SOHO broadband internet router. By default, it is on IP 192.168.123.254, and is useful for sharing broadband internet access at home, or at a small business. And, it works just fine.

We added a Windows 2000 server so that we could host our own website and e-mail server. To simplify the installation of the Windows 2000 server, I disabled the DHCP and DNS server services on the router. Once the Windows 2000 server was up, I simply configured the 'default gateway' entry of the Windows 2000 server's DHCP server service to point to the GVC router (and subsequently to the internet). I also configured Windows 2000's DNS server service to forward unprocessed DNS lookup requests to known root DNS servers.

Most computers on our network DO NOT log in to the domain, and act as standalone or workgroup computers.

This configuration took place over 3 years ago, and has been working fine ever since.

My memory is not as good as it should be, and neither is my memory.

I have forgotten more than I can remember

 

[J741]

Sorry, forgot to say that I also changed the router's IP from the default 192.168.123.254 to it's current 192.168.0.254

- James.

My memory is not as good as it should be, and neither is my memory.

I have forgotten more than I can remember