ran updates and lost LAN and Internet connection 2

[lovewindoze]

Yesterday my computer (XP Pro) said new Windows updates had been downloaded and were ready to install. So I installed them. I think it asked me if I wanted to restart my machine, which I did.

Anyway, I instantly lost my connection to my router. I checked the Ethernet plug, and the network device said it was working properly. (It even knew when my cable was unplugged.)

I also disabled my Zone Alarm software firewall but that didn't seem to have any affect.

And I tried going to wntipcfg and releasing/renewing all. But Renewing FAILED.

I can no longer get out to the internet or even to my router admin page.
These were the 3 security updates that were installed:
MS04-011
MS04-012
MS04-014

I tried doing a System Restore. But for some reason after going through the motions and restarting, it tells me the restore failed and my system was unchanged.

Can someone help me on this?
Either uninstall these updates or tell me if there's some setting I now need to change in order to get LAN access?

I expected connectivity problems with SP2, but I'm still at SP1.
here's what the build info says on my OS:
2600 xpsp2.030422-1633 Service Pack 1

 

[smah]

As a shot in the dark, try this tool faq779-4625

If that fails to solve the problem post back with the results of ipconfig /all

 

[lovewindoze]

hate to sound like such a newbie... but how do I do a
ipconfig /all ?
Using RUN?

 

[muthabored]

Start/Run/cmd
type in ipconfig /all at the C: prompt (make sure there's a space between ipconfig and /all).

 

[lovewindoze]

I tried the Winsock fix. It 'said' it completed successfully. I restarted my machine but still the same problem. I still can't release/renew either.

Then I did a ipconfig /all and as I was writing down the numbers I noticed that my IP address was off from my router (192.168.2.1). See below.
Windows IP Configuration
host name: HPOmnibook
Primary DNS suffix:
Node Type: Unknown
IP Routing Enabled: No
WINS Proxy Enabled: NO
Ethernet adapter LANConnection:
Connection-specific DNS Suffix:
Description: VIA Compatable Fast Ethernet Adapter
Physical Address: 00-C0-9F-OE-47-B1
DHCP Enabled: Yes
Autoconfiguration Enabled: Yes
Autoconfiguration IP Address: 192.168.0.10
Subnet Mask: 255.255.255.0
Default Gateway: 192.168.2.1
DNS Servers: 63.162.100.33
63.163.128.33

So I fixed the the IP Address to: 192.168.2.10 (note the 2 instead of 0) And once I did that, I was able to get to my router and get out the the internet. Although an odd thing.... Even though I hard-coded the IP to be .10, my router thinks that machine is at .116 (or something like that).

BUT, here's the thing.... The IP, Gateway, Subnet, etc is all set to get the information dynamically from my DCHP router. And it used to get it auto magically.

But since the updates were installed, it appears to be using the ALTERNATE TCP/IP Configuration where I've hard-coded in numbers. And since 1 of those numbers was off, it wouldn't work until I fixed the number.

So why did the update screw up my 'General' TCP/IP properties so that my computer had to fall back on the Alt config?

 

[bcastner]

In Safe Mode, use Control Panel, Add/Remove Programs, and remove KB35732

 

[rasETL]

I believe Microsoft Windows Updates automatically create restore points for themselves.

So, couldn't he just restore his machine back to a point prior to the Windows Updates???

Or, uninstall the updates???

I had a problem where one of the updates was an updated modem driver for a brand I did not have, but it messed up my modem connection. Restored the machine to th point just prior to the update, and the problem was resolved.

 

[lovewindoze]

I tried to restore to several points before, but each time it went through the motions, but ultimately gave me an error message saying it could not restore.

 

[rasETL]

Then uninstall the updates manually.

Control Panel - Add/Remove programs.

 

[linney]

A read of this complete article (which also contains removal instructions) might be advisable. If your machine is now working OK you may decide against removal.

http://www.microsoft.com/technet/security/bulletin/ms04-011.mspx

It is not unusual for Microsoft to produce patches for patches shortly after the initial release.

It may be the case with KB835732 soon.

http://groups.google.com/groups?sourceid=navclient&ie=UTF-8&oe=UTF-8&q=kb835732

 

[lovewindoze]

I did what bcastner advised:
In Safe Mode, use Control Panel, Add/Remove Programs, and remove KB35732

And magically it started working again like it used to - able to see the router and internet and dynamically getting an IP address from the router. And also being able to release/renew the TCP/IP card.

THANK YOU!
curious though... how did you know which of the 3 updates screwed me up?

 

[bcastner]

I cheated.

As a Microsoft MVP I have access to private newsgroups at Microsoft and I was watching the April security hotfixes for possible problems. I also sit over several SuS servers, and can take the time to rollout hotfixes one-by-one in a large mix of OS versions to identify possible problems.

From my own testing, and from the newsgroup chatter by MS support and other MVPs it was clear that one hotfix was problematic for some workstations.

Best,
Bill Castner

 

[lovewindoze]

ok Mr. MS MVP....
This Sasser worm that's going around...

I don't suppose you know which particular patch is suppose to protect my computer from Sasser?

The reason I ask is, I have all the patches installed except the one I uninstalled (835732 ms04-011). Please tell me this isn't the one I need to install to prevent a Sasser infection?

Also, are they releasing a newer patch version? or a patch to patch the above patch?

 

[ceigl]

I just received this today - maybe it helps you a bit

Cheers,
Chris


- This alert is being updated to advise you of an update to Microsoft Security Bulletin MS04-011. This update details additional workaround steps which customers can take to protect against the LSASS vulnerability (CAN-2003-0533). This is the vulnerability which is exploited by the Sasser worm and its variants. Customers who have not yet deployed the security update for MS04-011 can evaluate implementing this new workaround to protect against the Sasser worm and its variants.

- In addition, Microsoft has updated the cleanup tool for W32.Sasser.worm to remove the C and D variants of the Sasser worm. The Sasser removal tool now removes Sasser A, B, C and D. The updated removal tool is located at

http://www.microsoft.com/downloads/...B6B-4FC3-90D4-9FA42D14CC17&displaylang=en

and is documented in Knowledge Base article KB841720

http://support.microsoft.com/default.aspx?scid=kb;EN-US;841720

.

What is it?

- Microsoft has been made aware of a worm identified as “W32.Sasser.worm” and it is currently circulating on the Internet. The worm exploits the Local Security Authority Subsystem Service (LSASS) vulnerability fixed in Microsoft Security Update MS04-011 on April 13, 2004.

- Microsoft encourages customers to protect themselves against this worm by installing Microsoft Security Bulletin MS04-011

http://www.microsoft.com/technet/security/bulletin/ms04-011.mspx

immediately.

- Customers who have enabled the Windows XP Firewall are protected from the vector this worm attacks, which is TCP Port 139. Most third party firewalls also block this attack vector by default.