TCP/IP broken for Windows Media Center (XP)

This is not really a wireless issue; however my posting on comp.os.ms-windows.networking.tcp-ip
didn't yield any responses. As I value the comments here, this seems like a good alternative.

Something happened with an HP dv5215us notebook. Suddenly for no apparent reason, both the wired and
wireless interfaces stopped being able to get an IP address through DHCP, and always get that
strange Alternate Private IP. The wireless card appears to connect to the AP, but I cannot be sure
that it has authenticated correctly. I have done the following to try to resolve the problem:

1. Booted a Knoppix CD and verified that the wired ethernet interface is working correctly.

2. Disabled all firewalls.

3. Cleared the arp cache with a 'netsh interface ip delete arpcache' command.

4. Deleted the network interfaces in the device manager and rebooted to reinstall them.

5. Reset the TCP/IP parameters with a "netsh int ip reset resetlog.txt" command.

I would appreciate any further commands to run, or any further data from my machine that is needed.

Thanks,

Larry

Larry Finger <(E-Mail Removed)> hath wroth:

>This is not really a wireless issue; however my posting on comp.os.ms-windows.networking.tcp-ip
>didn't yield any responses. As I value the comments here, this seems like a good alternative.

Groan. Water seeks its own lowest level.

>Something happened with an HP dv5215us notebook.

What do you mean sometimes? Is there something that happens after
running some program? I've had XP networking go nuts after going in
and out of standby multiple times.

>Suddenly for no apparent reason, both the wired and
>wireless interfaces stopped being able to get an IP address through DHCP, and always get that
>strange Alternate Private IP.

Is the "strange" IP address 169.254.xxx.xxx ?? If so, that's what
Windoze defaults to when it can't get an address via DCHP.

>The wireless card appears to connect to the AP, but I cannot be sure
>that it has authenticated correctly. I have done the following to try to resolve the problem:

Oh, it's a "card". Might it be a PCMCIA, CardBus, or PCIExpress Card?
Does this card have a manufacturer and a number?

>1. Booted a Knoppix CD and verified that the wired ethernet interface is working correctly.

Good. Nothing has failed.

>2. Disabled all firewalls.

Do you have more than one firewall? If so, kindly disarm one of them.

>3. Cleared the arp cache with a 'netsh interface ip delete arpcache' command.

Try:
arp -d *
which is easier to remember. Does the same thing.

>4. Deleted the network interfaces in the device manager and rebooted to reinstall them.

Well, plug-n-play is still working.

>5. Reset the TCP/IP parameters with a "netsh int ip reset resetlog.txt" command.

That's usually the last resort. The problem is that if you have a
personal firewall, such as Norton or McAfee installed, it will break
the installation requiring a reinstall. It will also remove all the
added LSP (layered service provider) entries, which will break many
applications.

>I would appreciate any further commands to run, or any further data from my machine that is needed.

Did steps 1->5 do any good? Does it work now?

I have no idea what to do next. The problem I have is with your one
word "sometimes". This implies that it sometimes works. My crystal
ball points to some application breaking things. It's not in the
wireless or wired device drivers as both apparently fail. Just about
any add-on program that installs itself into the LSP networking
pretzel may cause things to break. That includes wireless client
managers, network diagnostic tools, VPN shims, remote control
programs, VNC, browser add-ons, and various debugging programs from
card manufacturers. In addition, if you have some persistent spyware
installed, it will reinstall itself in the LSP when you reboot. Hard
to tell from here.

My wild guess(tm) is you should approach this problem as if you had a
virus/trojan/spyware problem and look for extraneous junk in the LSP.
I notice that you didn't mention scanning for viruses or spyware. Do
it, especially if you haven't bothered to stay up to date with Windoze
updates.

HijackThis LSP editor
<http://www.spywareinfo.com/~merijn/programs.php>


--
Jeff Liebermann (E-Mail Removed)
150 Felker St #D http://www.LearnByDestroying.com
Santa Cruz CA 95060 http://802.11junk.com
Skype: JeffLiebermann AE6KS 831-336-2558

Jeff Liebermann wrote:
> Larry Finger <(E-Mail Removed)> hath wroth:
>
>> This is not really a wireless issue; however my posting on comp.os.ms-windows.networking.tcp-ip
>> didn't yield any responses. As I value the comments here, this seems like a good alternative.
>
> Groan. Water seeks its own lowest level.
>
>> Something happened with an HP dv5215us notebook.
>
> What do you mean sometimes? Is there something that happens after
> running some program? I've had XP networking go nuts after going in
> and out of standby multiple times.

SomeTHING, not sometimes. The breakage is solid. It never works now, not even in Safe Mode with
Networking..

>> Suddenly for no apparent reason, both the wired and
>> wireless interfaces stopped being able to get an IP address through DHCP, and always get that
>> strange Alternate Private IP.
>
> Is the "strange" IP address 169.254.xxx.xxx ?? If so, that's what
> Windoze defaults to when it can't get an address via DCHP.

Yes, it is.

>> The wireless card appears to connect to the AP, but I cannot be sure
>> that it has authenticated correctly. I have done the following to try to resolve the problem:
>
> Oh, it's a "card". Might it be a PCMCIA, CardBus, or PCIExpress Card?
> Does this card have a manufacturer and a number?

It is a Broadcom BCM4318 mini-PCI card. The ethernet is a Realtek RTL8139 built into the motherboard.

>> 1. Booted a Knoppix CD and verified that the wired ethernet interface is working correctly.
>
> Good. Nothing has failed.
>
>> 2. Disabled all firewalls.
>
> Do you have more than one firewall? If so, kindly disarm one of them.

This computer had AOL 9, which has been uninstalled. The built-in Windoze filewall was then disabled.

>> 3. Cleared the arp cache with a 'netsh interface ip delete arpcache' command.
>
> Try:
> arp -d *
> which is easier to remember. Does the same thing.

Thanks for the tip.

>> 4. Deleted the network interfaces in the device manager and rebooted to reinstall them.
>
> Well, plug-n-play is still working.
>
>> 5. Reset the TCP/IP parameters with a "netsh int ip reset resetlog.txt" command.
>
> That's usually the last resort. The problem is that if you have a
> personal firewall, such as Norton or McAfee installed, it will break
> the installation requiring a reinstall. It will also remove all the
> added LSP (layered service provider) entries, which will break many
> applications.
>
>> I would appreciate any further commands to run, or any further data from my machine that is needed.
>
> Did steps 1->5 do any good? Does it work now?

No, otherwise I wouldn't ask.

> I have no idea what to do next. The problem I have is with your one
> word "sometimes". This implies that it sometimes works. My crystal
> ball points to some application breaking things. It's not in the
> wireless or wired device drivers as both apparently fail. Just about
> any add-on program that installs itself into the LSP networking
> pretzel may cause things to break. That includes wireless client
> managers, network diagnostic tools, VPN shims, remote control
> programs, VNC, browser add-ons, and various debugging programs from
> card manufacturers. In addition, if you have some persistent spyware
> installed, it will reinstall itself in the LSP when you reboot. Hard
> to tell from here.
>
> My wild guess(tm) is you should approach this problem as if you had a
> virus/trojan/spyware problem and look for extraneous junk in the LSP.
> I notice that you didn't mention scanning for viruses or spyware. Do
> it, especially if you haven't bothered to stay up to date with Windoze
> updates.

It has all of the Windows updates till about a week ago when it broke. Nothing new had been
installed just before it broke. Just before I uninstalled AOL 9, I did complete spyware and virus
scans that were clean. Of the LSP stuff you mention above, the only things that might be there are
browser add-ons and the card debugging stuff.
>
> HijackThis LSP editor
> <http://www.spywareinfo.com/~merijn/programs.php>

That is a cool tool. There were some AOL pieces left, but removing them didn't help. The log follows:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:39:05 PM, on 7/31/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\HP\QuickPlay\QPService.exe
C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\SBCLIG~1\SMARTB~1\MotiveSB.exe
C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
C:\WINDOWS\system32\wuauclt.exe
F:\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar =
http://ie.redirect.hp.com/svs/rdr?TY...lion&pf=laptop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
http://ie.redirect.hp.com/svs/rdr?TY...lion&pf=laptop
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings,ProxyOverride = 127.0.0.1
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program
Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program
Files\Java\jre1.5.0_06\bin\ssv.dll
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [RecGuard] C:\Windows\SMINST\RecGuard.exe
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [WildTangent CDA] "C:\Program Files\WildTangent\Apps\CDA\GameDrvr.exe" /startup
"C:\Program Files\WildTangent\Apps\CDA\cdaEngine0500.dll"
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\SBCLIG~1\SMARTB~1\MotiveSB.exe
O4 - Global Startup: HP Photosmart Premier Fast Start.lnk = C:\Program Files\HP\Digital
Imaging\bin\hpqthb08.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program
Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program
Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O14 - IERESET.INF:
START_PAGE_URL=http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q106&bd=pavili on&pf=laptop
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program
Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) -
http://update.microsoft.com/windowsu...?1153963972560
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program
Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program
Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) -
Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe

--
End of file - 4677 bytes

Thanks,

Larry

I found the problem using a tool called LSPFix <http://cexx.org/lspfix.htm>, which showed that
Winsock2 was messed up. A Microsoft help page told me how to reinstall it and all is well now.

Larry

"Larry Finger" <(E-Mail Removed)> wrote in message
news:wqIri.385301$(E-Mail Removed)...
> This is not really a wireless issue; however my posting on
> comp.os.ms-windows.networking.tcp-ip didn't yield any responses. As I
> value the comments here, this seems like a good alternative.
>
> Something happened with an HP dv5215us notebook. Suddenly for no apparent
> reason, both the wired and wireless interfaces stopped being able to get
> an IP address through DHCP, and always get that strange Alternate Private
> IP. The wireless card appears to connect to the AP, but I cannot be sure
> that it has authenticated correctly. I have done the following to try to
> resolve the problem:
>
> 1. Booted a Knoppix CD and verified that the wired ethernet interface is
> working correctly.
>
> 2. Disabled all firewalls.
>
> 3. Cleared the arp cache with a 'netsh interface ip delete arpcache'
> command.
>
> 4. Deleted the network interfaces in the device manager and rebooted to
> reinstall them.
>
> 5. Reset the TCP/IP parameters with a "netsh int ip reset resetlog.txt"
> command.
>
> I would appreciate any further commands to run, or any further data from
> my machine that is needed.
>
> Thanks,
>
> Larry

Recompile your colonel.

Mark W wrote:
> "Larry Finger" <(E-Mail Removed)> wrote in message
> news:wqIri.385301$(E-Mail Removed)...
>> This is not really a wireless issue; however my posting on
>> comp.os.ms-windows.networking.tcp-ip didn't yield any responses. As I
>> value the comments here, this seems like a good alternative.
>>
>> Something happened with an HP dv5215us notebook. Suddenly for no apparent
>> reason, both the wired and wireless interfaces stopped being able to get
>> an IP address through DHCP, and always get that strange Alternate Private
>> IP. The wireless card appears to connect to the AP, but I cannot be sure
>> that it has authenticated correctly. I have done the following to try to
>> resolve the problem:
>>
>> 1. Booted a Knoppix CD and verified that the wired ethernet interface is
>> working correctly.
>>
>> 2. Disabled all firewalls.
>>
>> 3. Cleared the arp cache with a 'netsh interface ip delete arpcache'
>> command.
>>
>> 4. Deleted the network interfaces in the device manager and rebooted to
>> reinstall them.
>>
>> 5. Reset the TCP/IP parameters with a "netsh int ip reset resetlog.txt"
>> command.
>>
>> I would appreciate any further commands to run, or any further data from
>> my machine that is needed.
>>
>> Thanks,
>>
>> Larry
>
> Recompile your colonel.

If you will loan me your copy of the XP source, I will be happy to do so.

Larry

On Jul 31, 9:43 pm, Larry Finger <Larry.Fin...@lwfinger.net> wrote:
> I found the problem using a tool called LSPFix <http://cexx.org/lspfix.htm>, which showed that
> Winsock2 was messed up. A Microsoft help page told me how to reinstall it and all is well now.
>
> Larry

I had a similar problem where the dhcp client service didn't start
sometimes just had to kickit
from the services menu