No Internet Connectivity on certain workstations

[Howard Rudisill]

Help! I have a W2k network (workstations and servers) that was recently hit with Sobig and Nachi. All of that appears to be cleaned up now, but I'm having connectivity issues with certain PC's. I have covered every issue I can possibly think of and can't come up with a reason for the issue. Gateway is there, DNS is working properly, there's just no connectivity. It seems like a firewall app is stopping the outgoing traffic, but I have shut any such software down but still have the problem. Rebuilding the machine seems to be the only thing that fixes the problem. Anybody out there experienced this?

[Massimo Bianchi]

By chance, have you zonealarm laoded as a firewall?

I had many problem with it, and only de-installi it worked out every issue.

Massimo

[Massimo Bianchi]

Another thing: is the proxy set correctly?

Is internet the only thing NOT working? If so, try installing another browser, like mozilla, and test the connection, to see if IE is damaged or all the infrastructure.

Massimo

[Howard Rudisill]

No. No Zone Alarm. SuperScout is the only thing I have running that could possibly do this and I shut it down. It's not just a browser issue. I can't ping anything on the other side of my router. The router can ping fine and some machines have connectivity. Some don't though and there's no reason for it that I can find.

[Massimo Bianchi]

you said that gateway is there... is there any other static route that can interfere ?
check with:
route print

Are all network services started, like in working server?
check with:
net start

Massimo

[Howard Rudisill]

Let me clarify. There have been no changes to the network. No router changes, nothing. The router config is fine. The only change that was made was upper management finally approved Sophos and it is currently being utilized. That's when the problems started, but I shut down sophos to see if that was the problem, but still have the issue. I'm the Corporate IT Manager and have 18 years of experience but have never seen an issue like this. Quite honestly, I'm stumped. I appreciate all your help.

[Ron Kinner]

Our experience with the virus (or the removal programs) has been that it turns off several critical services in Win2K. Right click on My Computer, select Manage, the Applications and Services, then Services. Compare the services which on Started and Automatic with those on a working system. Start with Remote Procedure Call, Remote Access Connection Manager and the DNS and DHCP clients.

IF that doesn't help check your routing table:

netstat -rn
and verify that there is a 0.0.0.0 0.0.0.0 route at the top and that it points to the correct gateway.

then check \winnt\system32\drivers\etc\hosts
and lmhosts files to make sure they are not doing something strange to you.

try
nslookup att.com

and see if you get an answer.

You can ping the gateway and DNS? Tracert -d to them to make sure it goes where you expect.

also do

ipconfig /all
and compare to a working system.

Ron

[Jon Finley]

Some anti-virus programs setup a "proxy" to redirect all incoming network to their engine for scanning (network and email traffic).

This is controlled through a GPO locally on the system. I would try uninstalling Sophos first, to see if it resolves the problem. Otherwise....

launch gpedit.msc and look under Computer Configuration, Windows Settings, Security settings. You may find the culprit there.

Jon