Internet connection problem

[SirBlack]

I'm stumped! A client brought his tower in for repairs. He had Dial-up connection but switched to Comcast broadband. He claims he had connection until a week ago after 3-4 months with no problems. According to him, he picked up a virus but was able to remove it (not surprising since he disabled Windows Firewall, set IE privacy setting to allow all cookies & IE Security to medium). I'm sure his wife wouldn't appreciate some of his downloads either but I digress.
I've run CCleaner,chkdsk, cwshredder, PeperFix, Grisoft's AV, AS & Anti-RootKit, WinsockxpFix, Ispfix and RegCleaner all to no avail. All junk files, malware & viruses have been deleted. He connects via a USB cable to Comcast using their modem. He was told he needed to install a driver for his Network adapter card but Device Manager displays no Network adapter. Here are the errors I found in Event Viewer:

The following boot-start or system-start driver(s) failed to load: i8042prt

The IPSEC Services service terminated with the following error: The authentication service is unknown.

The time provider NtpClient is configured to acquire time from one or more time sources, however none of the sources are currently accessible. No attempt to contact a source will be made for 14 minutes. NtpClient has no source of accurate time.

The IP address lease 192.168.100.10 for the Network Card with network address 0019474C871F has been denied by the DHCP server 68.87.68.32 (The DHCP Server sent a DHCPNACK message).

The server {C7E39D60-7A9F-42BF-ABB1-03DC0FA4F493} did not register with DCOM within the required timeout.

Unable to Connect: Windows is unable to connect to the automatic updates service and therefore cannot download and install updates according to the set schedule. Windows will continue to try to establish a connection.

It also showed the following warnings:

TCP/IP has reached the security limit imposed on the number of concurrent TCP connect attempts.

Your computer was not able to renew its address from the network (from the DHCP Server) for the Network Card with network address 0019474C871F. The following error occurred: The semaphore timeout period has expired. Your computer will continue to try and obtain an address on its own from the network address (DHCP) server.

Your computer has automatically configured the IP address for the Network Card with network address 0019474C871F. The IP address being used is 169.254.32.95.

OS is Windows XP Home SP2 with IE 6.0. I'm going to run Belarc Advisor later & copy it to a floppy to print & add to this thread if needed. Also plan on installing HijackThis & posting the log (again, if needed) but until then, if anyone has some suggestions, please let me know. Also ran System Restore with no help there.

Thanks in advance!

Bob B-)

 

[oisnds]

All indications are that he is not connected to a network, driver not loaded or installed. Did Comcast supply a driver CD with the modem? Try loading their software, last resort for me but it may make your job easier. Once the driver and network card are back in sync, everything else should look more normal.

 

[G0AOZ]

If he's using a USB cable to connect to the Comcast modem, then presumably there's no need for his machine to have a network adaptor?? Surely he'll use either one OR the other...

Network adaptor is easier to use as generally no software is required - Windows usually has all that's necessary loaded up once a network adaptor's installed.

The 169.254.32.95 address clearly indicates the machine is seeking an IP Address from a source (modem) which has DHCP enabled, but can't find that device.

Should be easy enough to spot the RJ45. No RJ45, no network adaptor in Device Manager...

ROGER - G0AOZ.

 

[SirBlack]

Hi Roger,
Not sure what you mean by spotting RJ45 but this is what I found:

Network adapter is displayed in Device Manager when clicking on show hidden devices including the following sub-levels:

Direct Parallel
WAN Miniport (ATW)
WAN Miniport (IP)
WAN Miniport (L2TP)
WAN Miniport (PPPOE)
WAN Miniport (PPTP)

When I checked Properties, Device status showed all devices working properly & all enabled. Device Manager shows no ! ? or X but still unable to connect.

Nothing so far except for a new error message at reboot:

Error loading C:\windows\system32\meafkekn.dll
The specific module could not be found.
Googling found no matches to this dll.

Here's what I've done so far:

Booted in "Safe Mode with Networking" No luck.

Diconnected my system from the modem, installed files & drivers for modem on client's PC & connected it to my modem. "Device Manager" shows modem installed in Network adapter as well as all the hidden dvices mentioned earlier with no conflicts so I don’t think it’s a Comcast issue. In addition, when I ran ipconfig /all, the Physical Address: 00-15-2F-F6-09-11 is the same as my USB MAC address of my modem. Rebooted & got a message stating limited or no connectivity

Connected modem to different USB port, only got yellow ! warning with same message for limited or no connectivity.

Ran command prompt netsh winsock reset - still no go.

Reran WinsockFix

Ran ipconfig /all & got the following results:

Physical Address....:00-15-2F-F6-09-11
IP Address............:169-254-134-138
Subnet Mask.........:255.255.0.0
Default Gateway.....:
DNS Server............:
WINS Server..........:

Shouldn't the results be the same as my PC when I connect his to my modem? Opening Network places dispays a LAN connection with yellow! All attempts to renew IP address return as unable. Would installing a NIC resolve this issue? Pulling my hair out here trying to figure out what's wrong & correct it. >:-<

Spoke to the client earlier and may have stumbled on the cause of the problem though. I mentioned how I disabled an app thru msconfig that kept popping up at reboot that was hard to stop. I thought it was a trial version of a spyware remover he downloaded to resolve his problem. He told me he did not know what it was (nor what virus he deleted) but tried using the Add/Remove program utility but couldn’t find it listed there (it wasn’t). I exported the Registry to Desktop & then deleted all keys associated with it. After checking more, I discovered the app, MalwareAlarm, was a bug designed to trick users into downloading the full version to further infect a system. When I double checked msconfig, it was no longer listed there but I did find a Startup item called meafkekn. The command line is: rundll32.exe “C\Windows\system32\meafkekn.dll”,sitypnow located in HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run. I don’t know if this is related to the connectivity issue. I can run HijackThis & post the log if that’ll help. There’s an item also in msconfig for WeatherBug but its location is in drive E: which is slaved off of his C: drive.

Finally, I noticed his MacAfee icon is no longer in the task bar or listed in neither the Add/Remove programs nor a Startup item in msconfig. Desktop shortcut & start menu shortcut are there but when I click on them, the screen pops up for a split second & disappears. I’m assuming this might be due to running netsh winsock reset.

Any other suggestions would be greatly appreciated.

Bob B-)

 

[G0AOZ]

Maybe I'm going off on the wrong track here but...

The basic network adaptor in a PC will offer an RJ45 8-pin connector on the back of the machine into which is plugged the Ethernet UTP (Cat5E or similar) cable. My Device Manager lists similarly to yours above but also shows:-

VIA Rhine II Fast Ethernet Adaptor

You're not showing this, so that machine doesn't have a network adaptor as such.

I don't have anything here that runs an Internet connection via a USB device, so can't easily guide you further. I think for the majority of cable connections in the U.K., the ISP now offers a cable modem with an Ethernet (RJ45) connection rather than USB.

Just looked at my laptop which is set to work with either a LAN connection (Ethernet/RJ45) or a USB modem to telephone line, although I currently don't have the USB device available here. XP's MSCONFIG file shows this line for the USB device:-

C:\Program Files\Thomson\Speedtouch USB\Dragdiag.exe

But of course the setup you're looking at could have the USB device loaded within the Registry and not shown in MSCONFIG.

Sorry, the above may not be of much help Bob...


ROGER - G0AOZ.

 

[SirBlack]

Thanks anyway! I was finally able to establish an Internet connection by installing new protocols & TCP/IP conections


That enabled me to install all Windows critical updates as well as update Grisoft's AV, AS & AntiRootKit that I installed. It was amazing this machine ran at all considering all the threats, viruses, etc. it discovered when I rernan these apps. I ran HijackThis but too tired to check it out now. Here's a copy of the log if you'd like to give it a scan as well:

Logfile of HijackThis v1.99.1
Scan saved at 12:59:57 AM, on 10/21/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Support.com\bin\tgcmd.exe
C:\Program Files\Seekmo\bin\10.0.275.0\OEAddOn.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\WINDOWS\system32\pctspk.exe
C:\WINDOWS\wanmpsvc.exe
C:\PROGRA~1\INCRED~1\bin\IMApp.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =

http://www.comcast.net/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =

http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =

http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =

http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =

http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

http://as.starware.com/dp/search?x=...56n6SpN+P9nawLjZvR5WdCNxlVit92aKWhQdsXTIzHcyH

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer provided by Comcast
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :0
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Seekmo /fleok=1D8A83A5C4E6167C9AAE6B2A1FBB39BFE4976E26CAEDA120180A196D6093 - {07AA283A-43D7-4CBE-A064-32A21112D94D} - C:\Program Files\Seekmo\bin\10.0.275.0\HostIE.dll
O2 - BHO: (no name) - {1D7B70B4-FFA0-4BB0-AC0D-A12899F7E374} - C:\WINDOWS\system32\pmnll.dll (file missing)
O2 - BHO: Comcast Toolbar - {4E7BD74F-2B8D-469E-93BE-BE2DF4D9AE29} - C:\PROGRA~1\COMCAS~1\COMCAS~1.DLL
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
O2 - BHO: {f26cbb3b-7b1e-a55b-ee14-1e03824c9e5b} - {b5e9c428-30e1-41ee-b55a-e1b7b3bbc62f} - C:\WINDOWS\system32\kveusecj.dll (file missing)
O2 - BHO: (no name) - {C093EB08-34A7-4891-8055-FDF36C236735} - C:\WINDOWS\system32\mlljj.dll (file missing)
O2 - BHO: (no name) - {CB049399-2643-4C4A-8DF1-A2FC57AD471A} - C:\WINDOWS\system32\ddcyw.dll (file missing)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\system32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Comcast Toolbar - {4E7BD74F-2B8D-469E-93BE-BE2DF4D9AE29} - C:\PROGRA~1\COMCAS~1\COMCAS~1.DLL
O3 - Toolbar: Seekmo - {07AA283A-43D7-4CBE-A064-32A21112D94D} - C:\Program Files\Seekmo\bin\10.0.275.0\HostIE.dll
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [tgcmd] C:\Program Files\Support.com\bin\tgcmd.exe /server /startmonitor /deaf
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SeekmoOE] C:\Program Files\Seekmo\bin\10.0.275.0\OEAddOn.exe
O4 - HKLM\..\Run: [SeekmoSA] "C:\Program Files\Seekmo\bin\10.0.275.0\SeekmoSA.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [Weather] E:\Program Files\AWS\WeatherBug\Weather.exe 1
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [IncrediMail] C:\Program Files\IncrediMail\bin\IncMail.exe /c
O4 - HKCU\..\Run: [Windows update loader] C:\Windows\xpupdate.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O12 - Plugin for .mpeg: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin3.dll
O12 - Plugin for .mpg: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin3.dll
O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O16 - DPF: {2DFF31F9-7893-4922-AF66-C9A1EB4EBB31} (Rhapsody Player Engine) -

http://forms.real.com/real/player/d.../mrkt/rhapx/RhapsodyPlayerEngine_Inst_Win.cab

O20 - Winlogon Notify: awtqr - C:\WINDOWS\system32\awtqr.dll (file missing)
O20 - Winlogon Notify: ddcyw - C:\WINDOWS\system32\ddcyw.dll (file missing)
O20 - Winlogon Notify: gebcd - C:\WINDOWS\system32\gebcd.dll (file missing)
O20 - Winlogon Notify: mljjk - C:\WINDOWS\system32\mljjk.dll
O20 - Winlogon Notify: mllml - C:\WINDOWS\system32\mllml.dll (file missing)
O20 - Winlogon Notify: mllmn - C:\WINDOWS\system32\mllmn.dll (file missing)
O20 - Winlogon Notify: nnnljki - nnnljki.dll (file missing)
O20 - Winlogon Notify: pmnli - C:\WINDOWS\system32\pmnli.dll (file missing)
O20 - Winlogon Notify: pmnll - C:\WINDOWS\system32\pmnll.dll (file missing)
O20 - Winlogon Notify: ssqro - C:\WINDOWS\system32\ssqro.dll (file missing)
O20 - Winlogon Notify: ssqrr - C:\WINDOWS\system32\ssqrr.dll (file missing)
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe
O23 - Service: PCTEL Speaker Phone (Pctspk) - PCtel, Inc. - C:\WINDOWS\system32\pctspk.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

Thanks again!

Bob B-)