dslreports logo
site
 
    All Forums Hot Topics Gallery
spc

spacer




how-to block ads


Search Topic:
uniqs
16979
share rss forum feed


Hall
Premium,MVM
join:2000-04-28
Germantown, OH
kudos:2

Web/HTTP access doesn't work, PING does

A co-worker asked me to look at their home PC (laptop) as "the internet quit working". Sure enough, it has no web or http access. IE, Firefox, and Google all fail to load pages. I can PING websites by name so DNS seems to be working okay.

I've scanned with AVG w/ up-to-date definitions. Malwarebytes finds nothing but the downloaded version is almost a month old and I can't update it. Does Malwarebytes offer a manual update method ? I can't find it if they do. An internet search for "no web access ping works" suggests malware and to try "ComboFix" and "RootRepeal" (??). I did and both found nothing.

I "cleaned" this same laptop for them a few months ago and installed Malwarebytes and Defender but when they gave it back, both programs were removed. When I asked, I got a shoulder shrug...

The machine runs XP Home and they only have recovery discs from HP so I don't believe I can do a repair install, can I ?

What else should I look for ?



nwrickert
sand groper
Premium,MVM
join:2004-09-04
Geneva, IL
kudos:7

What happens when you try to access a page in the browser? Does it time out, or is there some sort of error?
--
AT&T dsl; Speedstream 5100b modem; Zyxel NBG334W router; openSuSE 11.0; firefox 3.0.13



XT0RT
S3x, Drugs, War

join:2001-07-28
Edmonton, AB
reply to Hall

Sounds like she either got a DNS hijack in her browser or the TCP stack itself is shot. Did she update to IE 8 recently? Some plugins from 7 will not transfer over properly. As for the removal of MalwareBytes and BitDefender, she probably had someone else look at it and probably isn't being truthful about it.

Try these three commands in a command prompt window and then reboot the system, see if it still does it:

1. ipconfig /flushdns
2. netsh int ip reset resetlog.txt
3. netsh winsock reset

Other steps would be to disable the anti-virus solution, or uninstall it completely and try again. AVG is useless if the virus or malware is already in the system, that's why online scanners from Trend Micro and ESET exist. Use them :P

Let us know how it goes. WCS, she's in for a format and education on malware prevention.
--
Asus P5Q-E / Q9450 @ 3.6 / 4GB OCZ Reaper HPC 8500 / XFX 9800 GX2 / Vista Ultimate x64 SP1



Hall
Premium,MVM
join:2000-04-28
Germantown, OH
kudos:2

said by XT0RT:

Sounds like she either got a DNS hijack in her browser...
Wouldn't Hijack This show that ? I did run that and see that I didn't mention it above. It came back clean (I could recognize pretty much every entry or the paths appeared legit). Can't access a website via IP address either...
said by XT0RT:

...or the TCP stack itself is shot.

Try these three commands in a command prompt window and then reboot the system, see if it still does it:

1. ipconfig /flushdns
2. netsh int ip reset resetlog.txt
3. netsh winsock reset
Doesn't the "Repair" option in the right-click menu of the network adapter do that ? I did try that already. Besides, as I said, PING works.
said by XT0RT:

...that's why online scanners from Trend Micro and ESET exist. Use them.
Back to the original problem, the internet can't be accessed via a web browser.


Hall
Premium,MVM
join:2000-04-28
Germantown, OH
kudos:2
reply to nwrickert

said by nwrickert:

What happens when you try to access a page in the browser? Does it time out, or is there some sort of error?
Firefox says:

Connection Interrupted, The connection to the server was reset while the page was loading. The network link was interrupted while negotiating a connection.

IE says:

Internet Explorer cannot display the webpage

(and has the button that runs the network diagnostic wizard)

Google Chrome says:

The webpage is not available. The webpage at »www.yahoo.com/ might be temporarily down.....

ERR 101 (net::ERR_CONNECTION_RESET): Unknown error


nwrickert
sand groper
Premium,MVM
join:2004-09-04
Geneva, IL
kudos:7
Reviews:
·AT&T U-Verse

Does this happen quickly, or after a delay?

I'm inclined to agree that it is a winsock problem. However, line problems could also be involved.

If there are line errors, ping would work because it uses short packets, while browsing fails because it uses longer packets. You can test by using long packets with ping, or by seeing whether other computers work fine on the same ISP connection.
--
AT&T dsl; Speedstream 5100b modem; Zyxel NBG334W router; openSuSE 11.0; firefox 3.0.13



auggy
Premium,Mod
join:2001-12-24
Brockville, ON
kudos:18
reply to Hall

said by Hall:

said by XT0RT:

Try these three commands in a command prompt window and then reboot the system, see if it still does it:

1. ipconfig /flushdns
2. netsh int ip reset resetlog.txt
3. netsh winsock reset
Doesn't the "Repair" option in the right-click menu of the network adapter do that ? I did try that already. Besides, as I said, PING works.
The Network Adapter Repair option will not reset Winsock and there is a good chance the problem is Winsock corruption. With Winsock corruption ping may work but browsing may not.

I would suggest to go ahead with the Winsock reset.


Hall
Premium,MVM
join:2000-04-28
Germantown, OH
kudos:2
reply to nwrickert

said by nwrickert:

However, line problems could also be involved.
Line problems aren't likely the cause. He described what was happening with the laptop at his house and the exact same thing occurs at my house.

Will try the 'reset' option now.


Hall
Premium,MVM
join:2000-04-28
Germantown, OH
kudos:2

said by Hall:

Will try the 'reset' option now.
Didn't fix the problem....


auggy
Premium,Mod
join:2001-12-24
Brockville, ON
kudos:18

Can you restart the computer in "Safe Mode with Networking" and see if the same problem exists?



sonofjay
Mission Accomplished - Bush May 1, 2003
Premium,MVM
join:2001-05-14
Malden, MA
kudos:1

1 edit
reply to Hall

Anything in the event log? Any repeating entries every few seconds? Any Mention of True Vector Service?

can you telnet to port 80 anywhere?

i.e. telnet www.google.com 80

Do you know if FTP is blocked as well?

--
Mission Accomplished



Hall
Premium,MVM
join:2000-04-28
Germantown, OH
kudos:2
reply to auggy

said by auggy:

Can you restart the computer in "Safe Mode with Networking" and see if the same problem exists?
Interesting.... Browser access works in Safe Mode.


nwrickert
sand groper
Premium,MVM
join:2004-09-04
Geneva, IL
kudos:7

Is it possible that your software firewall is forcibly closing connections?



auggy
Premium,Mod
join:2001-12-24
Brockville, ON
kudos:18
reply to Hall

Can you try a "clean boot" of XP:

»support.microsoft.com/kb/331796

Clean booting may not stop all third party software that loads at startup.


Frohike
Premium
join:2000-07-23
Waxahachie, TX
kudos:4
reply to Hall

said by Hall:

said by auggy:

Can you restart the computer in "Safe Mode with Networking" and see if the same problem exists?
Interesting.... Browser access works in Safe Mode.
You have either security software or spyware blocking the connection.


Hall
Premium,MVM
join:2000-04-28
Germantown, OH
kudos:2
reply to auggy

said by auggy:

Can you try a "clean boot" of XP:

»support.microsoft.com/kb/331796

Clean booting may not stop all third party software that loads at startup.
Tried that.... Disabled everything as instructed in the KB article, rebooted and walked away. When I returned, the yellow shield balloon was telling me there were updates available .... Windows Update had internet access. Tried IE, FF, and Chrome, no access. Ping still works and DNS is working. Hmmm...

Still trying


Hall
Premium,MVM
join:2000-04-28
Germantown, OH
kudos:2
reply to Frohike

said by Frohike:

You have either security software or spyware blocking the connection.
Still running like just posted above.....

AVG is uninstalled. Windows Defender is uninstalled. Windows Firewall is turned OFF.

Still no web browser access.


Hall
Premium,MVM
join:2000-04-28
Germantown, OH
kudos:2
reply to sonofjay

said by sonofjay:

Any repeating entries every few seconds? Any Mention of True Vector Service?
No mention of "True Vector Service".
said by sonofjay:

can you telnet to port 80 anywhere? i.e. telnet www.google.com 80
Could not open connection to host on port 80: Connect failed
said by sonofjay:

Do you know if FTP is blocked as well?
It appears to be. No access through a browser nor via the command line.

ftp: connect: unknown error number


mattei
Moderated, now muzzled

join:2001-03-19
Canada
reply to Hall

What do

netsh dump
 
and
netdiag /test:winsock
 
tell you? Anything interesting?


MineCoast
Premium
join:2004-10-06
127.0.0.1

2 edits
reply to Hall

Try the following on the command line.

Netsh int ip reset reset.log (the command above is incorrect)

netsh int ip delete arpcache (this doesn't appear to have been tried)

Reboot after running these. It should resolve your issue.

If that does not resolve issue, uninstall/reinstall NIC drivers. Disable TCP/IP Version 6 if it's installed as well.


Frohike
Premium
join:2000-07-23
Waxahachie, TX
kudos:4

1 edit

said by MineCoast:

Try the following on the command line.

Netsh int ip reset reset.log (the command above is incorrect)

netsh int ip delete arpcache (this doesn't appear to have been tried)

Reboot after running these. It should resolve your issue.

If that does not resolve issue, uninstall/reinstall NIC drivers. Disable TCP/IP Version 6 if it's installed as well.
netsh int ip reset reset.log or netsh int ip reset resetlog.txt will both work.

Its not his NIC drivers - the NIC works fine in safemode.

As I said before - there is software loading in regular mode that is interfering with the HTTP that doesn't load in safemode.

If you can't seem to find it - can try system restore back to a date it was working and hope that system restore removes the program(s) in question. Which is never a guarantee.


Hall
Premium,MVM
join:2000-04-28
Germantown, OH
kudos:2
reply to MineCoast

said by MineCoast:

Netsh int ip reset reset.log (the command above is incorrect)
I didn't have any luck with the exact wording either. The resetlog file didn't look "right". I found the KB at MS and it was worded a bit different. Ran that and the resetlog file was full of entries.
said by MineCoast:

netsh int ip delete arpcache (this doesn't appear to have been tried)
Will try that.
said by MineCoast:

If that does not resolve issue, uninstall/reinstall NIC drivers. Disable TCP/IP Version 6 if it's installed as well.
Nothing is wrong with the NIC. It works in Safe Mode and things like PING work in normal mode. I haven't tried the wired connection but the owner said he tried both wired and wireless and got same problem. IPv6 is already disabled (not installed).


Hall
Premium,MVM
join:2000-04-28
Germantown, OH
kudos:2
reply to mattei

'netsh dump'

Interesting to whom ? I piped it's results to a logfile and read through it and nothing glaringly wrong jumps out (to me).

'netdiag /test:winsock'

command not found



Hall
Premium,MVM
join:2000-04-28
Germantown, OH
kudos:2
reply to MineCoast

said by MineCoast:

netsh int ip delete arpcache (this doesn't appear to have been tried)
Returned "ok"


Hall
Premium,MVM
join:2000-04-28
Germantown, OH
kudos:2
reply to Hall

Another "Automatic Update" got downloaded too. What protocol do those use ?

I also thought it could be something wrong with the user's account seeing as no 'net works when logged in as them but does as admin. So I created a 2nd user, with admin rights, and logged in. Still no 'net access though.



Hall
Premium,MVM
join:2000-04-28
Germantown, OH
kudos:2
reply to Hall

Since I can PING websites, networking isn't broken. I can PING them by name, so DNS is good.

When I try »/ in a browser address, I get the same blank page. Interestingly, it takes a couple of seconds as if it's trying. Something is blocking the outbound HTTP port(s), yes ??



Boredness
The Lurker
Premium
join:2005-07-07
In Limbo
reply to Hall

If you can get SUPERAntiSpyware on there that could probably fix it. There is a "Repairs" tab in the preferences section also called control center that can repair broken network connections [WinSock LSP Chain]. There are other system repair options in there as well like reset URL prefixes.
--
hey mems



MoJeeper
The Stig in 2012
Premium
join:2000-10-20
Springfield, MO
reply to Hall

I'm not sure if this is related but I'm using Alltel wireless here and I'm having the same problems and My father who uses Alltel also is having the same issues as the OP.

I'm able to browse to some web pages, others not. I have tried an alternate DNS and same thing. I have Chrome, IE8 and Firefox.

They all do the same, either time out or partial load and they spin away trying to load the rest of the page. Ping is the same goes out and returns no problem.

has me baffled too.
--
Semper Fidelis. 233 Years Strong.
»www.pleasant-viewfire.org



bangaroo
Premium
join:2000-08-13
reply to Hall

How about the Winsock Fix?
»www.snapfiles.com/get/winsockxpfix.html



mattei
Moderated, now muzzled

join:2001-03-19
Canada

1 edit
reply to Hall

:)

I missed the part where you followed through on resetting winsock. Likely, nothing interesting to be seen. I was interested in IP/IPSec routing, transports, and proxies. You've tried:

netsh winsock reset
netsh int ip reset reset.log
 
right?

May as well complete the trifecta:
netsh firewall reset
 
Then enable logging (advanced tab on the FW dialog) and see what you can see in %systemroot%\Pfirewall.log.

Back to winsock. A system service (hidden, injected, or sitting in plain sight) could be adding to the catalog after reset. Try
netsh winsock show catalog >xsp.txt
 
An obvious sign would be the presence of something removed by the reset (check the reset log Edit: no reset log is generated for winsock - use a clean machine's catalog or Google and a fine tooth comb). Resetting winsock removed non-default Layered Service Provider registry keys. Unless one of the third-party repair tools claims to do more they're not going to help.

Sorry about the second one. netdiag is part of the support tools package (on the CD and a free download) but now that I've read all the steps you have and have not taken I see it's pointless.

AU uses BITS. BITS uses HTTP and HTTPS to transfer files. Another tool in the support tools package, bitsadmin.exe, will allow you to create jobs, add files to a job, and monitor progress. There's also a BITS MMC snap-in if you want a GUI but I don't know which editions, if any, have it installed. Never used it.

The presence of successful MS Automatic Update downloads means HTTP transport is working for the Update Agent but I'm fuzzy on the circumstances. Have any of these downloads occurred in Normal mode or were they all in Safe/Clean Boot modes? If I've read what you've reported clearly, ICMP (Ping) and UDP (DNS) seem unaffected.

The next thing that pops into my head is Group Policy restrictions. GPResult.exe might help. Myself, I'd probably have Process Explorer and NetMon running at this point as well as a copious supply of "Admin fuel" aka beer.