Thank you for being a valued part of the CNET community. As of December 1, 2020, the forums are in read-only format. In early 2021, CNET Forums will no longer be available. We are grateful for the participation and advice you have provided to one another over the years.

Thanks,

CNET Support

General discussion

Intermittent Internet connectivity

Feb 2, 2005 10:18PM PST

I'll start off describing my system:

HP Pavilion, Athlon XP 2000+ overclocked to 2600+, 512 MB RAM, 30 GB HD with 21 GB free, Windows XP SP2

Spybot resident in background as well as Spyware Blaster, AVG anti-virus 7.0, also run Ad-Aware SE frequently.

Have Juno email account, used to have dialup Web account with them. Use Juno's email software to download my email, use DSL from MCI. When I first got DSL 6 months ago, I immediately had a couple of viruses and several spyware issues, but have long fixed them and the Internet worked fine for 4 months before this.

When I first go on the Internet, I can browse fine for about 5 minutes. Then it takes longer to pull a page. Eventually, most of the time I get "Page cannot be displayed" errors.

I have run all of the above anti-spyware programs, as well as the free "check but do not fix" runs offered by Webroot, noadware.net and Trojan Hunter. I also ran the free anti-virus scans offered by Panda, Symantec, and TrendMicro ("House Call"). Nothing comes up.

One interesting side note is that if I try to run the Symantec online scan now, after literally scanning the first file or two it says I can't because I don't have Active X and scripting turned on even though I do.

I had shut off Windows Firewall and all my virus/spyware softwares and I still have the problem (they are all back on now of course). I upgraded my network card's drivers. I did a repair install of Windows, I ran "netsh winsock reset catalog", I also ran "ipconfig /dnsflush", and finally I changed the CAT5 cable between my DSL modem and the network card (it is connected directly, not through a router). Finally, I tried uninstalling the Juno software, didn't fix it.

Sometimes there are periods where it will work totally fine for 1/2 hour, and it always works fine for at least 5 minutes if I've had everything off for an hour or more. For that reason, I am thinking it is not the DSL modem or the network card (or the wire between the DSL modem and the phone jack).

Any thoughts on this would be much appreciated. Could overclocking suddenly do this, even if it's been fine for months? If I can't get a solution, I have two other ideas that I'd like advice on:

1) Uninstalling SP2. When you've had SP2 going for a couple of months, will my system be damaged when I do this to the point that I have to do a "scratch" install?

2) Trying Mozilla/Firefox. But while there are other reasons to try this, I want to try more things first before I get this as an answer, mainly because I have seen this problem (unanswered) on a couple of other forums where they said doing this didn't work.

Discussion is locked

- Collapse -
Thanks Cursor Cowboy but....
Feb 3, 2005 10:54AM PST

Tried it, pages load faster, but not "perfect" and still occasionally (like once every 5 minutes) get the "Page cannot be displayed" message. Keep in mind that I don't get that message instantly, it tries for about 30 seconds to load the page.

I'm hoping we figure this out and that's a clue because I otherwise like SP2 and hope not to uninstall it except as a last resort.

- Collapse -
UPDATE - What I found is very troubling.
Feb 5, 2005 7:19AM PST

I finally decided to uninstall SP2 and see if it's "fixed".

Indeed it is, but on the first reboot after the uninstall, my anti-virus software instantly found a "Trojan horse BackDoor.Small.5.BU" viruses in windns.exe. I know that these type of viruses can take over the Remote Procedure Call (RPC) service and cause the kind of intermittent Internet activity that I had, since I had had these kind of viruses before back with SP1 (but not at the time I installed the SP2 upgrade).

What troubles me is why these weren't found and deleted when I was in SP2? It sounds like I was "protected" but at the cost of frequent loss of Internet activity.

I didn't like that my SP1 install was now a "hybrid". It was SP1 in terms of the Windows Firewall, but like SP2 you could see "Security Center" and "Windows Firewall" in the Control Panel (of course, if you click on them it says they're not available). So I installed SP2 again. Same problems, and can't find the virus.

Can viruses be "hidden" in SP2 and not in SP1? I really don't want to stay on SP1 but it sounds like I'm forced to for now, I'm very disturbed by this.

- Collapse -
RE:
Feb 5, 2005 9:26PM PST

1. You could simply "googled" the main word and see if anything applies.

2. "Check" your system out for invasions.

- Collapse -
Well I kind of did that
Feb 6, 2005 9:58PM PST

I did the Googling thing before writing my first response, and I did a lot of checking, but still appreciate your very helpful post.

My real concern is why is it that while in SP2 the only sign I could see was highly intermittent Internet, but literally the second I uninstalled SP2 and reverted to SP1 the same softwares suddenly tell me I've had a slew of virusses, trojans, etc.?

It makes me feel good in a way in that it seems that SP2 "protected" me, but again, it was at the expense of decent Internet ability and with no way to really tell what was there and how to clean it.

Any ideas on this? By the way I ended up doing a fully clean SP1 install since I still had troubles after supposedly "cleaning" every this. I still after that somehow reappeared one or two viruses, but I know cleaned them as well. Internet works really well now, but still occasional interrupts (maybe one or two times in a 2-3 hour session, but then works fine again). This makes me think I'm still not out of the woods, which bothers me since now I'm not finding any viruses, spyware or trojans anymore. I want to get it fully working again before I put SP2 back in; I'm not convinced that SP2 is the problem but that my system is not truly "clean"; as I said before, when I first installed SP2 I didn't have a problem. Thanks.

- Collapse -
RE:
Feb 7, 2005 9:15PM PST

The very least I can suggest is to use #9c(6), my previous, and see if they can find anything for you. Second, even though you've check it once or maybe twice, I've found that some of these system checks have to be accomplished over several days to completely eradicate commercial software. As far as the supposed intermediate invasion, it would be that they were there but simply held in check someway we don't know about -- kind of like leaving the gate open. It could also be like that described in the M$ article, "MS03-039: A Buffer Overrun in RPCSS Could Allow an Attacker to Run Malicious Programs (Q824146)" (a 1,508Kb file), which everyone should keep on hand and installed, before ever accessing the Internet for Updates with IE should a system be formatted and XP reinstalled -- unless the version used already includes the SP2 update.

- Collapse -
Cursor Cowboy, I'm now thinking it's my ISP, any thoughts?
Feb 8, 2005 10:02PM PST

Suddenly last night, I initially had no problem and had much faster Internet (about 1 1/2x my normal speed when things are working I did some bandwidth tests). After about an hour it started to degrade again, but it didn't last as long.

As I suspected, it was again all in the name resolution. When the "disconnects" would go on, I could ping IP addresses but not their corresponding URL's and similarly for web browsing (i.e. if I put in Yahoo's IP address it would come up instantly, but I'd get "Page Could Not Be Displayed" if I typed in "www.yahoo.com". But after 15 minutes of this, it was good again for another 2 hours before degrading for only a minute and coming back up (about 10 minutes after that I stopped surfing).

I read an article that said as a test to try disabling the DNS client service, so that the DNS resolving is strictly at the ISP's end, not a combination of their name servers and your internal DNS cache. They noted that the only difference is that it may take slightly longer for new pages to appear and if you still see problems, to contact your ISP.

Well, I did this this morning and had the problem twice in a one hour period but they only lasted a minute or less. So I'm now thinking it's my ISP and not virusses/spyware anymore (not that I think there wasn't any, but that I'm clean). Actually, as you suggested Cursor Cowboy, I think what happened is that when I went back to SP1 I didn't repatch in time (I had my DSL modem on) and those virusses came a knocking (I guess the article that says an unpatched PC can be stricken in under 1 minute is true!). My DSL is with MCI, does anyone know of any issues with them or if they're doing any speed upgrade work in the New York area?

Any other thoughts on this? And if you think I'm correct, does it appear "safe" to put SP2 back on again or am I likely to see repeated problems re-occur? Thanks.

- Collapse -
Texas is a long way from NY.
Feb 9, 2005 10:10PM PST

1. Domain Name System (DNS), a locator service in Windows, is an industry-standard protocol that locates computers on an IP-based network. IP networks, such as the Internet and Windows networks, rely on number-based addresses to process data. Users however, can more easily remember name addresses, so it is necessary to translate user-friendly names (www.microsoft.com) into addresses that the network can recognize (207.46.131.137). Before DNS, a Hosts file was used -- a manually created file residing on a host computer that associates host names with IP addresses -- still in use today.

2. DNS Servers map IP addresses to computer names and computer names to IP addresses. By doing so, they provide the mechanism to locate network resources. The DNS WMI Provider allows applications to interact with DNS Servers through the unified management framework of Windows Management Instrumentation (WMI). A DNS Server is a computer that completes the process of name resolution in DNS and contains zone files that enable them to resolve names to IP addresses and IP addresses to names. When queried, a DNS Server will respond in one of three ways:

? The server returns the requested name-resolution or IP-resolution data.

? The server returns a pointer to another DNS Server that can service the request.

? The server indicates that it does not have the requested data.

3. A DNS zone is a set of files or records (more precisely, a database of resource record entries) that corresponds to part of the DNS hierarchical name space. DNS zones are used to delineate which DNS Servers are responsible (authoritative) for resolving name-resolution queries for a given section of the DNS hierarchy. DNS zones differ from the domain structure in the following fashion: zones can be composed of one or more DNS domains. One zone in the gadgets.widgets.microsoft.com domain tree might be authoritative for the gadgets and widgets domains.

4. DNS WMI Provider Overview

a. A provider is an architectural element of Windows Management Instrumentation (WMI). WMI defines a unified architecture for describing, accessing, and instrumenting objects. Part of this architecture is a large database of WMI classes used to carry out remote management tasks on specific objects.

b. WMI providers act as intermediaries between WMI and one or more managed objects. When WMI receives a request from a management application for data that is not available from the CIM repository or for notifications of events that WMI does not support, it forwards the request to a provider. Providers supply data and event notifications for managed objects that are specific to their particular domain. A provider extends the WMI schema of classes to allow WMI to work with new types of objects. The DNS WMI Provider defines classes for querying and configuring a DNS Server, along with its associated DNS zones and DNS records.

c. The DNS WMI provider exposes a number of DNS objects to clients, including DNS Server, DNS domain, and DNS RR objects. Through those objects, clients are able to perform DNS management activities.

5. Supplemental:

a. "HOW TO: Configure Windows XP TCP/IP to Use DNS (Q305553)."

b. "Can't display page (Server or DNS error) " - scroll to, or use "page search".

c. "Logging WMI Activity."

d. "Reinstalling WMI."

e. "Secrets of Windows Management Instrumentation."

6. "What to Know Before You Download and Install Windows XP Service Pack 2."

- Collapse -
Thanks much, that should do it
Feb 10, 2005 1:26AM PST

Ironically the last day and a half have had no problems, but what you give me here should give me all I need to know to get a grip on it and let me decide when it's OK to bring back SP2. Thanks, you've been a big help.

- Collapse -
Intermittent Internet connectivity
Mar 5, 2005 1:22AM PST

Hi

I have a very similar problem on my PC. In started abruptly and following no system changes.

I removed the spyware 'aboutblank' from my system using spybot about 6 weeks ago and wonder whether this might be relevent.

Looking forward to any thoughts on how to fix this.

- Collapse -
RE:
Mar 6, 2005 12:20AM PST

1. Please note that just above the text editor (where you enter a question on the forum) is the following paragraph, and if certain information is not present in your question, our reply may not be very helpful:

Tip: If you are asking for help to troubleshoot a computer-related problem, please be sure to include all the necessary information (ie: operating system, model number, hardware, software, etc) that will help others identify your problem for a speedy resolution.

Note: You have the option of using the hyperlink "Edit My Profile" on the right side of the main page to fill in applicable system information so that it is available.

2. Download and follow the instructions for "IEFix" - a general purpose fix for Internet Explorer (Win 98/ME/2000/XP):

Note: Else, some of the core Internet Explorer ".dll files" may not be correctly registered or need registering. First, verify the exact path of where the Iexplore.exe file is found and used as noted for the "Primary. . ." example. Second, click Start, Run, type exactly "Primary Hard Drive Letter:\Program Files\Internet Explorer\iexplore.exe" /rereg, and then either click OK or press Enter.

a. Registers Urlmon.dll, Mshtml.dll, Actxprxy.dll, Oleaut32.dll, Shell32.dll, Shdocvw.dll, [Q281679].

b. Refreshes Internet Explorer using IE.INF method. Note:

"Unable to Install Internet Explorer 6 on Windows XP (Q304872)"

"How to Reinstall or Repair Internet Explorer and Outlook Express in Windows XP (Q31837Cool"

c. Initiates "SFC /Scannow" (Win2K&XP), [Q310747].

3. Reinstall:

a. First, be familiar with "Information About Internet Explorer Setup (Q256340)". Second, click Start, Search, All Files and Folders, More Advanced Options, enter a check in Search Hidden Files and Folders, Search System Folders, and Search Subfolders. Type ie.inf in All or Part of the File Name box, select C: in the Look In drop-down menu or the letter of the hard drive containing the Windows folder, and then click the Search button. Find the file labeled ie.inf in the result pane. Right-click this file and then from the context menu, select Install.

b. The article [Q304872] states that when you try to install IE6, you may receive an error message that can occur if it has already been installed and the installation package does not contain any new customizations -- a customized versions of Internet Explorer 6 that was created by an Internet service provider, Internet content provider, or a corporate administrator that is installed instead of the default browser.

c. "How to Reinstall or Repair Internet Explorer and Outlook Express in Windows XP (Q31837Cool."

4. "LSP-Fix" is a free utility that may be downloaded to repair certain problems associated with Internet software when you can no longer access Web sites due to bugs in the LSP software or deletion of software. LSP-Fix repairs the Winsock LSP chain by removing the entries left behind when LSP software is removed by hand (or when errors in the software itself break the LSP chain), and removing any gaps in the chain.