W2k local area connection trouble....

Had an issue late in the day at work today that I couldn't figure out.

Info: W2k SP4

Problem: Can't access the network at all even though the local area connection shows that it's connected and the duration timer counts up. The packets sent and received both stay at 0.

What I tried: pinged the loopback address and it worked. Reinstalled TCP/IP, updated the driver, removed and reinstalled the ethernet controller, installed a brand new NIC with the exact same problem as the onboard NIC. I plugged a laptop up to the same network cable and it got an IP address right away so I know that it has something to do with the PC or one of the settings and not a bad cable or port on the switch.

I also ran Adaware and removed a bunch of spyware. I don't know if there is a possible virus that has this jacked up or what.

I see a reformat in my future for tomorrow morning unless somebody has encountered this problem in the past and has a quick fix for me.

Any suggestions would be appreciated.

Find more posts tagged with

Free for TechExams community: Cybersecurity salary guide

Compare cert salaries and plan your next career move

Button

Comments

royal

It sounds like you've done everything I can think of. Has anything specifically been changed on the system lately? Did the end-user do anything to it? Did the help desk to anything to it? Anyone? If the system had a bunch of spyware, I'd agree that there is a good possibility the machine has a virus. What I would do, is take a cd with at least 1 antivirus utility, and do a scan on that machine. It might find a virus on it and might clear the system up to the point where you can achieve connectivity. From there, you can update the definitions and rescan the machine. I do have to say, that if the machine is indeed virus infected, I would reformat it. I take no chances in having a network virus infected because I didn't want to spend a bit of time re-imaging a machine. Also, with all this troubleshooting, you might as well re-image/reformat as you'll have a clean machine spyware/antivirus free with very little additional time than it would have taken to do antivirus scans; which might not even fix the problem.

flares2

So you got lights on the NIC, physically it's good. You got a reply from the loopback, logically it's good. And other machines work on the line, so the line is good.
Sounds like it could be an IP problem. Are you on static IPs or DHCP? If static, does this machine have an IP that falls in the correct subnet and VLAN. Or if DHCP, is it pulling a valid IP or a 169.254.x.x? If you have a MAC filtered DHCP, is the machine's MAC in the table?
Also, is it possible the machine fell off the network (Trying to log in and getting Domain Unavailable). If so put it back on. Or just can't reach network resources, in which case DNS may be incorrect.

Just a bunch of ideas. I see problems like this on a regular basis. One of those should work.
Hope this helps.

tech-airman

Go Bucks wrote:

Had an issue late in the day at work today that I couldn't figure out.

Info: W2k SP4

Problem: Can't access the network at all even though the local area connection shows that it's connected and the duration timer counts up. The packets sent and received both stay at 0.

What I tried: pinged the loopback address and it worked. Reinstalled TCP/IP, updated the driver, removed and reinstalled the ethernet controller, installed a brand new NIC with the exact same problem as the onboard NIC. I plugged a laptop up to the same network cable and it got an IP address right away so I know that it has something to do with the PC or one of the settings and not a bad cable or port on the switch.

I also ran Adaware and removed a bunch of spyware. I don't know if there is a possible virus that has this jacked up or what.

I see a reformat in my future for tomorrow morning unless somebody has encountered this problem in the past and has a quick fix for me.

Any suggestions would be appreciated.

Go Bucks,

Questions:

Does the computer have a Microsoft Certificate of Authenticity sticker on the exterior of the computer case? Here's what Certificiate of Authenticities look like - http://www.microsoft.com/resources/howtotell/en/coa.mspx
Does the operating system listed on the Certificate of Authenticity match the operating system boot up splash screen? Here's what some operating system boot up splash screens should look like - http://content.zdnet.com/2346-9595_22-61343-1.html
Has the operating system been registered with Microsoft?

Kasor

You did add a new NIC and cable. I assumed that you try to 2 different slot and the PC pick up the NIC. If your hardward is OK.

Then it is your configuation.

When did it start? How it start? What did the user do? If it is a WK, then re-image. Sometime even every positive approach sound logically, but still don't work. This is called "IT" and we love it... Ha.. ha..

Treg

Problem: Can't access the network at all even though the local area connection shows that it's connected and the duration timer counts up. The packets sent and received both stay at 0.

So is the problem accessing resources on the machine remotely or cant ping anything?

- Have you checked the "server" service to make sure it is started? Have found this service to die on serveral occasions.

- No one fiddling with IPSEC on machine by any chance too?

Go Bucks

We use DHCP, but I believe the leases are set to never expire. We also checked the IP pool and there were more than 70 addresses still available so there is no IP shortage.

I'll probably pull the machine out tomorrow morning and fool with it a little more at my desk. I hate to spend too much time in someone else's office. If nothing else we'll pull her documents off and set her up on a refurb with XP on it. It'll likely get reformatted and cycled back out, but if we're not too busy tomorrow I'd like to figure this one out for future reference.

It has to be either a virus or something to do with the configurations like Kasor mentioned. The user called today after being off a week for vacation. She said someone else used her machine while she was off.

Thanks for all of the suggestions. I'll let you know how it turns out, but my money is on the reformat as of now.

Go Bucks

Can't ping anything other than the loopback which is successful.

sprkymrk

Since you removed some spyware, it is safe to assume that this computer was at one time able to access the network, then suddenly stopped.

My bet is that the spyware inserted itself like a shim in your TCP/IP stack and completely hosed it. Best bet is format/reinstall.

One quick try before you do though is to run this from a cmd prompt:

netsh interface ip reset ipresetlog.txt

If the whole command string doesn't work, try running one command at a time:

netsh (this should take you to a netsh context prompt)

netsh>interface

netsh interface>ip

netsh interface ip>reset ipresetlog.txt

This in effect does the same thing as reinstalling TCP/IP, which you already did, but I have had better luck with doing it this way.

Silver Bullet

When you said you uninstalled and reinstalled TCP/IP, did you delete the TCP/IP, Winsock and Winsock2 keys before reinstalling? Or did you just uninstall and reinstall from the Network Properties?

Check this Microsoft KB article if you only did the latter.

JDMurray

Is the green link LED on the NIC on and does the amber activity LED occasionally flash? Can you ping the bad computer from another computer on the same LAN? Verify that the IP address and netmask of your NIC is correct for a host on your LAN.

blargoe

I don't believe I saw that you even received an IP address from the DHCP server... did I miss something here? Are you getting an IP address at all?

Go Bucks

Well, the user got a new PC today

Our bench guy reinstalled the OS and was able to get it back on the network, but there were other problems as well. We were able to pull the users documents across the network to her new PC. There were several bad sectors on the drive, but I couldn't say for sure that that was the culprit.

Apparently, one of the previous "IT guys" thought the user needed a RAID setup. There were 2 drives going to the controller, of which only one was screwed in to the case. The other was laying on top of it with a piece of foam wedged between them. There was also a 3rd drive that was connected to the motherboard and it too was just laying on a piece of foam with no screws holding it in place.