kernel32.dll listening on Port 68

[BillB333]

I have 3 computers hard-wire connected to the Internet via a Linksys wireless router to a cable ISP. One of them, a laptop using a PC card ethernet modem, shows to have kernel32.dll listening on Port 68 for something (I see this via the Sygate Personal Firewall screen). All the computers are running WIN98SE with nearly the same programs installed. The other two do not show anything listening on port 68. I have done checks with various programs, including HijackThis and see nothing much different loading on the three computers (less is loading at bootup on the laptop). I run AdAware regularly and it cleans everything each time but no change. My EZ Antivirus program shows no type of infections on the computer.

The reason this is a problem is that this action by kernel32.dll seems to be causing a problem with Norton Cleansweep. During the latter part of a Cleansweep unistall, an error pops up saying that "NMAIN caused an invalid page fault in module KERNEL32.DLL" and requires Cleansweep to be shut down. I have uninstalled and re-installed Cleansweep as Norton recommends but no change.

I feel that the kernel32.dll listening on port 68 is causing the problem but don't know how to stop this or solve why it never stops listening. Any ideas.

 

[BillB333]

One more thing I forgot: when the computer first boots (if Sygate firewall is loading; I don't always have it on because the router has a very good firewall) a warning pops up from Sygate saying "Win 32 Kernel Core Component (kernel32.dll) is trying to broadcast an ICMP Type 10 (Router Solicitation) packet to 224.0.0.2". I have no idea what that URL represents since it does not respond to pings or browser openings.

Also, if I don't try to connect to the Internet IMMEDIATELY after the computer finishes booting, I can never connect unles I reboot; sometimes more than once. Once connected to the Internet, I NEVER lose the connection for the rest of the day.

A very frustrating nuisance!

 

[ChrisHirst]

Port 68 TCP/UDP is the BOOTP (bootstrap protocol) and DHCP port so it seems it may be looking for a non-existent DHCP server. Try checking the NIC properties.



Chris.

Indifference will be the downfall of mankind, but who cares?

 

[BillB333]

There is nothing in my NIC card properties (Xircom Ethernet Adapter 10/100) that relates to DHCP info. However, the router uses DHCP to dynamically set IP addresses for the computers on the LAN.

 

[ChrisHirst]

well 224.0.0.2 is issued to IANA and a name scan brings up this ALL-ROUTERS.MCAST.NET, so it appears that for some reason your laptop has decided to join the router multicast group!

RFC 1256: 4.3. Router Behavior

The router joins the all-routers IP multicast group (224.0.0.2) on all interfaces on which the router supports IP multicast.

(

http://www.networksorcery.com/enp/rfc/rfc1256.txt)

Chris.

Indifference will be the downfall of mankind, but who cares?

 

[BillB333]

Hi Chris:

Thanks for the info, but it did not help me to solve the problem on my laptop. Any specific recommendations for changes on my laptop to accomplish this?