internet connection problem with nc6000

[HQ T]

specs:
nc6000

wireless device: HP WLAN 802.11a/b/g W500
(driver version 3.1.1.54)
ethernet device: Broadcom NetXtreme Gigabit Ethernet (driver version 6.34.0.0)

router used: aztech DSL305EW

i have a really peculiar and annoying problem with internet connection on my nc6000. I have a aztech DSL305EW wireless adsl router modem which i use to connect to the internet. All of the other pc's (3 via cat5 connection, 1 via wireless connection using dlink DWL G520+ pci card) on my home network are able to connect to the internet with no problems whatsoever, all except my nc6000! I have tried to get internet connection using both a wireless connection and a cat5 connection, but to no avail. However, I am able to perform files transfers with other pc's on my home network!
I have installed service pack 2 on nc6000's winxp pro, and also updated it with the relevant softpaq's from the hp website, but so far, I am only able to use the internet for less than a minute before I lose internet connection! The softpaqs I have installed on my laptop so far are:
SP28088
SP27665
SP28089
SP23043
SP28781
Are there any other important updates that i should install??

So far, I have no idea what could b causing this problem. I initially thought that maybe it could b my router's fault. But if that were the case, how is it that my other pc's are able to still surf the internet?! So then I thought maybe it could b the internal mini PCI wireless card (HP WLAN 802.11a/b/g W500). But if dat were the case, then why does file transfer work?! I am even able to play mp3s that are stored on another pc in the network!! Anyways, I decided to try using a cat5 cable connection to my router to access the internet. But to my horror, that didn't work too!! It was the samething: I opened firefox and went to a few websites, then after less than a minute, clicking on any links in a webpage will fail to take me anywhere! The same is true for windows explorer. But again, I am still able to see and transfer files with other pcs on my network. The ethernet device of my nc6000 is a Broadcom NetXtreme Gigabit Ethernet.

So i can't get a reliable internet connection on both wireless and ethernet connection!!
So this led me to think that maybe my TCP/IP settings are wrong. But windows seems to think it's ok! It also always shows my connection status as 'Connected'. and running the command netsh diag netsh diag gui, and then doing a network diagnostics revealed nothing suspicious (to me, at least!)

So there u go! Can anyone out there help me out? Maybe even gimme a suggestion which i haven't tried?

Many thanks in advance!!

[Gary Cantwell]

Hi,

you cold also post this one over in the Notebook Category:

http://forums1.itrc.hp.com/service/forums/categoryhome.do?categoryId=274

The experts there will have some suggestions for you,

Hope this helps,

Gary

[Ron Kinner · Accepted solution]

Don't go away yet.

The "Connected" message and the network diagnostics test your Ethernet or wireless connection. They don't care about tcp/ip or dns.

Sounds like you either have a DNS problem, firewall problem or a bad case of worm. I assume we are talking a newer operating system like Win2K or XP.

First if running XP, turn off your firewall. If you have Zone Alarm or other third party firewall turn them off too.

Click Start, Control Panel, doubleâ click Network Connections, right-click the desired connection, Properties, Advanced tab, Under Internet Connection Firewall, uncheck the Protect my computer and network by limiting or preventing access to this computer from the Internet check box. Click on OK.

See if that helped any. No?

Check that it's a DNS problem: open a browser and go to 192.20.5.55. Does it take you to an AT&T site? If it works then it's a DNS issue.



Press Start then Run then type:
cmd
and hit enter.

Now type and hit Enter after each line:

ipconfig /all

(This will show you several important items. Find your own IP address (A.B.C.D), your netmask, your default gateway (A.B.C.E), and your DNS address (A.B.C.E -same as gateway or F.G.H.I something totally different).

ping A.B.C.D

(Just so you know what a successful ping looks like. You should get four replies.)

ping A.B.C.E

(This checks to see if you can talk to the router. If you can't then compare the netmask and gateway addresses to those of the working systems. I assume you are using DHCP so these shoudl be all the same and the ping should work. The fact that it appears to work for a while also is a good sign.)

nslookup att.com

(You should get H:\>nslookup att.com
Server: YourDNSname.com
Address: A.B.C.E or F.G.H.I
Name: att.com
Address: 192.20.5.55

If it times out then you have DNS problems. Again, compare with a working system. It's possible to have DHCP turned on and get the right IP address but still use a static DNS address. If you need to change the Network setup to use dynamic DNS instead of Static see:

http://www.showme.net/DNSchange/WindowsXP.htm


)

(Assuming it timed out and the DNS is the same as the other PCs:)

ipconfig /dnsflush

(it should come back and say it was successful)

(Try it now. If it works for a few minutes and stops again then try the registry change on

http://www.updatexp.com/dns-windows-xp.html

to keep it from caching negative answers.)

(Also check that the DNS Client Service is running:)

net start

(You will get a list of services and one of them should be DNS Client.)

If not then

net start "DNS Client"

(Should say:
The DNS Client service is starting..
The DNS Client service was started successfully.
Now try your browser. If you get an error message then report back what it says. If that fixed it you will need to go into services and make sure DNS Client is set to start automatically)

Just in case all else fails let's look for a worm.

http://www.tomcoyote.com/hjt/HijackThis.exe

Save the file and open it once it downloads. SCAN your system and SAVE LOG. (Note where you put the log), Now reply to this thread and attach the log file by pressing the Browse button and pointing to the log file.

If you are running XP try:

http://www.iup.edu/house/resnet/winfix.shtm

This often fixes netowrk problems with XP.

If not XP then get lspfix.exe
http://www.cexx.org/lspfix.htm
A bit harder to use but can also work miracles.

Ron

[HQ T]

Hi Ron!
Your insight on this problem is very enlightening!! Many thanx! I've followed ur suggestions, and have eliminated both the dns and firewall problems. And so what's left was the possibility of a worm lurking with my laptop! And I DO think that it might b the cause! It's silly how I never even considered that possibility!
My laptop could've been possibly infected by this worm about a week ago, when my antivirus software (a free anti-virus software called antivir from www.free-av.com) detected something. I don't have the log of what the virus was anymore(I scan my laptop every week, and the program overwrites the log file every scan!), but I quarantined the virus. It was saved as TFTP3012.VIR. I've tried googgling this to find out what this virus did, but googgle didn't reveal anything! I have a feeling that even though antivir detected it, the virus could've already done its damage.
Also, I've done a scan of my laptop with hijackThis, and attached hijackThis.log to this message. Hopefully u could shed more light on this. I have also tried to use WinSockXPFix from http://www.iup.edu/house/resnet/winfix.shtm
but i wasn't able to get the program to backup my registry successfully! I was met with the error message:
"Error saving file E:\ERDNT\SECURITY". Maybe the program has trouble accessing windows system files? Since i can't backup my registry files, I have refrained from using the program. I dare not push my luck for the mean time! Do u know how i can safely backup my registry files?
Thank u so much for ur help, Ron! I wouldn't have got this far without ur knowledge!!

[Ron Kinner]

OK. I almost missed it but I think this is the problem:

O4 - HKLM\..\RunServices: [Windows Registry Server] spoolsvc.exe

I'd boot into Safe Mode (F8 -without networking ) and run HijackThis then check the above line and hit fix checked.

Reboot and see if that fixes it by rerunning hijackthis and see if it comes back.

If you google on spoolsvc.exe you will see that it is a trojan. Read a couple of the links and see if you don't agree. Follow their instructions for removing the files. You might submit the file to your antivirus folks since they don't seem to have caught it.

Ron

[HQ T]

Ron,
U r ABSOLUTELY correct! How did u know that spoolsvc.exe was the cause of all my woes?! U didn't actually do a search on each and everyone of the running processes to find out, did u?? Whatever u did, i am veery grateful for ur help!
I did what u suggested: go into safe mode, ran hijackthis again, and checked the line

O4 - HKLM\..\RunServices: [Windows Registry Server] spoolsvc.exe

It didn't work the first time. I restart my laptop, had a look at the running processes, and i found spoolsvc.exe still running in the background.
So I decided to run regedit, did a search of the string spoolsvc.exe, and deleted every occurence of it!
And it work! I now have unhindered access of the internet!! Yay!

In hindsight, i could've probably solved the problem with hijackthis. After a lit'l small toast to my success (all thanx to u!), I went back and had a look at the log file that hijackthis created, and i found not one, but two occurences of spoolsvc, one in:

O4 - HKLM\..\RunServices: [Windows Registry Server] spoolsvc.exe

and another in:

O4 - HKLM\..\Run: [Windows Registry Server] spoolsvc.exe

If i had checked both these lines, maybe that would've fixed the problem. That said, I reckon running a search of the registry and deleting all occurences of spoolsvc.exe is still a more thorough approach. But I did make sure to backup my registry juz in case.

But bottom line is: I would've probably never found this if it weren't for ur help! Thank u thank u very much!!

[Ron Kinner]

Your welcome. Glad we got it.

I do so many hijackthis logs that I can recognize most of the normal and many of the bad processes at a glance so I only have to look up 2 or 3 unfamiliar processes per log. Doesn't take too long and to me it's fun. Like playing detective to find whodunit.

Ron