problem with DHCP

[q8sam]

it seems I am able to connect to internet, but I can't surf the net.....

facts:
highspeed
WIN2K PRO

when I type ipconfig /release, I get a message that no binding to DHCP ...IP is automatically assigned.

so I can't ping anything, so not sure what to do...can anyone help please?

thanks

 

[cadaveca]

your nmic is not registered to your isp acct and will not get a valid lease until then...go to the registration site and add you nic there...should solve your prob, if not...replace your driver

 

[GlenJohnson]

More info please. Has this been on going, or just started. If just started, anything in the event logs? W2K and dhcp go hand in hand, should be easy to configure. Post the results of ipconfig /all here so we can get more info. Thanks and good luck.

Glen A. Johnson
"To fear the worst oft cures the worse."
William Shakespeare (1564-1616); English dramatist, poet.

Want to get great answers to your Tek-Tips questions? Have a look at FAQ219-2884

 

[q8sam]

thanks guys....well here is what I have:

I have a laptop with 2 different hard drives. one is working fine and have connection and can surf and obtain an ip normally. but when I put the other hard drive, it has some problems..this happened a while ago but did not have time to fix it....the problem is there are some applications on this hardrive that I can't replace. so I am trying to fix it.

Here is the results when I put ipconfig / all:

Auto config ip address: 169.254.144.56
subnet mask : 255.255.0.0

here is the results when I put ipconfig /release:

all adapters bound to DHCP do not have DHCP addresses. The addresses were automatically configured and cannot be released.
Also in the even viewer, there are many time error for irpip....i am not sure what that means......I hope this info is enough to be able to help me.

Also, the Svchost.exe in the task manager is running the CPU at a 100% all the time and when you look at the performance tab you see it continupously at 100% cpu usage....I am not sure if this is also related or not.

I look forward for your reply.

Thanks

Sam

 

[ricpinto]

I'm afraid you have a computer virus because of the symptom of 100% cpu utilization on svchost.exe. This is the link:

http://www.pchell.com/virus/welchia.shtml

The 169.254.x.x range is APIPA, look at this link:

http://compnetworking.about.com/cs/protocolsdhcp/g/bldef_apipa.htm

 

[q8sam]

Hi Ricpinto,

yes I did run the stinger.exe and found few viruses on the computer..I found w32/sdbot.worm.gen and IRC/flood.b.dr and they have infected iexplorer.exe and msgold.exe and STDE9.exe but they have been deleted and there are no more viruses...what do you think I should do to fix the problem?

thanks for your help

thanks

 

[ricpinto]

I've cut and paste from the link that I've posted above so that you can read what I want you to do, Good Luck.

" Delete the infected files (for Windows ME and XP remember to turn off System Restore before searching for and deleting these files to remove infected backed up files as well)

Click Start, point to Find or Search, and then click Files or Folders.

Make sure that "Look in" is set to (C:\WINDOWS).

In the "Named" or "Search for..." box, type, or copy and paste, the file names:
svchost.exe
dllhost.exe

Click Find Now or Search Now.

Delete the svchost.exe file in the c:\windows\system32\wins directory
Delete the dllhost.exe file in the c:\windows\system32\wins directory

Empty the Recycle bin. "

 

[q8sam]

ok, I did exactly what you said.....first, there is nothing at all in the folder WINS....also I used another computer to download the Welchia removal tool...and it found nothing on my computer...there is SVCHOST.exe in the task manager under process and it is taking all the cpu usage....

I found svchost.exe in the system32 folder but I can't delete it because it is running and I can't end the process either...I am really stuck...I appreciate your continious help...what do you think I should do next?

thanks

 

[q8sam]

I am not sure if you know that I am running on WIN 2000 PRO....so there is no c:\windows....of course I am looking in the c:\WINNT\system32\WINS and again it is empty....

 

[ricpinto]

Ok I'm using win2k pro as well, I notice that the culprit is SVCHOST.exe and not the svchost.exe. Goto safe mode so that SVCHOST.exe or svchost.exe will not load and from there you can search and delete but before you do that compare to the other PC first what is the size/date of the correct svchost. Mine the correct one is 7,952 bytes and dec 7 1999.

 

[q8sam]

yes, on the other computer I have the same as yours......also the one on the computer has the problem is the same as well.............so I am not sure what else I should look at......what do you think?

cheers.

 

[q8sam]

and by the way....it is svchost.exe and not SVCHOST.exe...that was a mistake from my side..sorry.

 

[q8sam]

event viewer also registers iprip error...I am assuming that the problem of iprop is connected to the unablility to connect to the internet...

 

[GlenJohnson]

C:windows and C:winnt exist on w2k pro. I have a laptop I'm using now with w2k pro, and I find both files. I wouldn't delete anything from c:/winnt without doing a major backup first.
More info please. Has this been on going, or just started. If just started, anything in the event logs? W2K and dhcp go hand in hand, should be easy to configure. Post the results of ipconfig /all here so we can get more info. Thanks and good luck.

Here is the results when I put ipconfig / all:

Auto config ip address: 169.254.144.56
subnet mask : 255.255.0.0

here is the results when I put ipconfig /release:

all adapters bound to DHCP do not have DHCP addresses. The addresses were automatically configured and cannot be released.
This is correct. If an address is assinged by dhcp, they have a fixed address for a given period. 169.254.x.x is not dhcp. Also, 100% cpu MAY be a virus, but not always. I've seen servers with this problem without having viruses. Good luck.


Glen A. Johnson
"To fear the worst oft cures the worse."
William Shakespeare (1564-1616); English dramatist, poet.

Want to get great answers to your Tek-Tips questions? Have a look at FAQ219-2884

 

[ricpinto]

Glen is right, maybe it's not a virus afterall so if you can go to regedit and examine what are the services that svchost is processing then you can have an idea on what particular service is actually comsuming the CPU 100%.


Look in this part of the registry.

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Svchost

 

[q8sam]

ok, I am looking at where ricpinto asked, I am not sure what am I suppose to look for....anyhow, guys I do appreciate your help, I feel we are really close to get this bastard going....I have extracted the list in event viewer...I prnt the screen for the ipconfig /all....and I am printing the screen for the registery....can I send it to you and have a look at it? if you have msn messenger, please add me q8sam@hotmail.com and maybe you can help me from there....this computer I am using has no problems.....it is just the other hard drive is having the problems....thanks


let me know please

 

[Moonrsr]

Had this under my old laptop casing:


Windows 2000–based clients can automatically configure an IP address and subnet mask if a DHCP server is unavailable at system start time. This feature, Automatic Private IP Addressing (APIPA), is useful for clients on small private networks, such as a small-business office, a home office, or a remote access client.

The Windows 2000 DHCP client service goes through the following process to auto-configure the client:

The DHCP client attempts to locate a DHCP server and obtain an address and configuration.
If a DHCP server cannot be found or does not respond, the DHCP client auto-configures its IP address and subnet mask using a selected address from the Microsoft-reserved Class B network, 169.254.0.0, with the subnet mask 255.255.0.0. The DHCP client tests for an address conflict to make sure that the IP address it has chosen is not already in use on the network. If a conflict is found, the client selects another IP address. The client will retry auto-configuration for up to 10 addresses.
Once the DHCP client succeeds in self-selecting an address, it configures its network interface with the IP address. The client then continues, in the background, to check for a DHCP server every 5 minutes. If a DHCP server is found later, the client abandons its auto-configured information. The DHCP client then uses an address offered by the DHCP server (and any other provided DHCP option information) to update its IP configuration settings.
If the DHCP client had previously obtained a lease from a DHCP server:

If the clients lease is still valid (not expired) at system start time, the client will try to renew its lease.
If, during the renewal attempt, the client fails to locate any DHCP server, it will attempt to ping the default gateway listed in the lease, and proceed in one of the following ways:
If the ping is successful, the DHCP client assumes that it is still located on the same network where it obtained its current lease, and continue to use the lease. By default, the client will then attempt, in the background, to renew its lease when 50 percent of its assigned lease time has expired.
If the ping fails, the DHCP client assumes that it has been moved to a network where DHCP services are not available. The client then auto-configures its IP address as described previously. Once the client is auto-configured, every 5 minutes it attempts to locate a DHCP server and obtain a lease.

 

[q8sam]

Hi, thanks for the input....I have read all this before, but the problem is how to fix it and how to find out what is missing and what is causing the DHCP server not to start...or not to obtain the ip address.....

 

[GlenJohnson]

Once more, how long has this been going on? Is this new, or always been like this. If it's new, what's changed? Good luck.

Glen A. Johnson
"To fear the worst oft cures the worse."
William Shakespeare (1564-1616); English dramatist, poet.

Want to get great answers to your Tek-Tips questions? Have a look at FAQ219-2884

 

[q8sam]

Glenn, it is not new but when it happened about a year ago, I did not have a chance to fix it and I just put a new hardrive.......and Now it is working fine.....wow...it took forever.....

You would not believe it guys.....there was an application that gotten installed on Internet Explorer by an internet site that is called MarketScore......as soon as I uninstalled it everything went back to normal....it is unbelievable....I would like to sure them for such intrusion. the only way I was able to take it off my computer since I didnot have internet access was to call them and get them to send me a removal file....anyhow I would like to thank each one of you for your continuos help and time and efferot was given to this matter....I appreciate it....take care and talk to you next time