can't access websites when online

I just ran "recovered" WinXP on an HP computer (essentially a reinstal, I think), and installed AdAware, Spybot S&D, Spyware Guard, Spyware Blaster, ZoneAlarm firewall and AVG antivirus before even going online. Downloaded all the updates for the above spyware/virus programs when I first connected to the internet, and then ran them all again - everything was fine. In the meantime, the Windows Update screen had come on, and I had the computer go ahead an download the Critical updates. I don't know if it included SP2 or not (the download lasted somewhere between 1 and 2 hours) - at the end, it told me I had to reboot; I clicked on restart later, because I was still downloading a driver for the printer.
At a certain point after than, I became aware that the driver download seemed to have gotten stuck, and I was no longer able to access any websites with either Mozilla (Firefox, actually) or IE. I can't get the Windows Update page to come up so that I can see what was installed on my system... I was hoping maybe the problem was that SP2 HAD downloaded/installed, and its firewall was conflicting with my ZoneAlarm one. But when I go to Start>Control Panel, there's no "Windows Security Center" option for me to click on in order to deactivate WinXP's firewall...
Any ideas why things would've been working smoothly on the internet all morning, and now nothing? (I'm working on another computer now, which is how I'm getting this missive off.)
Thanks,
Rebecca

 

Hi rebecca,

Any ideas why things would've been working smoothly on the internet all morning, and now nothing?

First, don't have any idea what went wrong, too little info.

At what point did it stop running smoothly? Sounds like it was ok after all your application updating and went bad at the driver download and Windows update. Is that right?

First question, do you have a Restore point after the app updates? If so, you can go back to that and probably would do two things: undo the MS update, whether completed or not and the same for the driver update. Sounds like the conflict occured there.

If not, you're going to have to go back to a restore point where the system was working, and if so, first undo - uninstall all the apps installed post the System Restore point - then go back to that SR point.

The lesson here is do one thing at a time with manually created restore points between each step. Each change you've made is significant and should have been backtrackable individually.

Regards - Charles

 

Since sending off my original missive here, I have been using System Restore to try to restore the computer to any one of 10 earlier times (I created restore points before installing each of the programs). In every single case, I get the message that the computer is unable to restore to that point, and that no changes have been made. Right now I'm trying to undo the latest Spybot S&D deletions I made (there were 5 DSO Exploits when I ran the program after downloading the updates), to see if THAT will make any difference... nope, that didn't do it either. I know everything was working ok after the first run of Spybot, so no point undoing THOSE deletions.
There is a point in my System Restore that's labeled "installed Widows XP KB842773 -- does that tell you anything?
Maybe I should just run "recovery" on this system all over again and start anew?
Thanks again,
Rebecca
PS - the driver never finished downloading

 

I created restore points before installing each of the programs

My apologies, you did it right.

Ok, lets see if it's a Winsock problen. Download the LSP fix for XP - scroll down - from this site http://www.cexx.org/lspfix.htm and run it on the problem system.

SR should not have responded that way unless its maxed out on HD space. When I come back I'll give you a way to test SR periodically to see that its working ok.

In the meantime, if you're maxed out on the System Volume Information file (System Restore file) which by defualt is 12% of HD space, try the following:

One of the causes of not being able to restore is the system doesn't have any room, restores take up much more room than a restore point takes. One way to create room is to move the slider to the left - less room - which will get rid of the earliest restore points. Then reboot, and set the slder back to maximum room. Once there is some room created, try restoring to the latest good RP.

Regards - Charles

 

Well, it turned out to be a firewall problem -- rather, my inability to use the thing properly. Every time I log onto the internet, I get these ZA firewall popup screens telling me that "Spooler SubSystem App" and "Generic Host Process for Win32 Services" (this one always shows up twice) are trying to access the internet - I had been denying them access. When nothing else seemed to work (as far as accessing websites), in desperation I gave in and clicked on "allow" instead. Lo and behold, I could access websites again. Just did a google search on both, and it looks like the Generic Host Process is something I have to allow (the spooler seems to have something to do with the printer, so I think I can safely deny that one permanently).
I would very much like to know how to get System Restore up and running again, both in XP and in ME (as well as how to test the system to make sure it's working in both versions). I've changed the slider on my ME compute (SR still doesn't work anyway), but I've forgotten where to locate the slider in order to do it on the XP computer - please refresh my memory!
Thanks,
Rebecca

 

Hi rebecca,

Well, it turned out to be a firewall problem -- That's good news!

The following is my "canned" instructions on how to test SR - would apply to both ME and XP.

You probably have a corrupt restore point somewhere in the chain of Restore Points, the integrity of each restore point is dependent on the previous one.

Shut SR off: My Computer > Properties > System Retore tab > Check "Turn off System Restore on all drives" - below, if multiple drives - have the option to differentiate.

Reboot.

Go back and re-enable SR - will create an initial restore point.

After re-establishing SR, a way to test the Restore function:

Take any executable file ( extention .exe) , and burn it out and/or move it to the My Documents folder and delete it from it's original location. SR does not monitor files in My Documents folder regardless of file type.

Then restore to the initial restore point created by the system; the deleted executable should be back in it's original location. Afterwards, you can delete the copy in My Documents.

The SR slider for XP is in the SR tab > settings.

From what you wite about ME's SR, it probably is corrupt, so there you should get rid of cuurent RP's. In ME, that's done by moving the slider to zero and then rebooting. Not so sure about XP's. Go thru the test and see.

In both cases I would recommend setting them at less than the max - I have XP's set to 5%. When I have to go thru a series of restores, I set the slider for more space and then back again when whatever problem I've had gets resolved.

If I haven't explained this well enough let me know. In any case, post back on this.

Regards - Charles

 

System Restore will give you the message that a Restore couldn't be done if it doesn't detect any changes made to System Files.

Poor wording on MS part.

Is your computer on a network? If not, you shouldn't need to enable Gen 32 host process 32 to get online in order for YOU to be online. I have been blocking it for 3 years.

Now here's a wild guess:
Maybe Auto Update began the download or install of SP2 and was interrupted. It is designed to resume itself when it can, but it occasionally gets "stuck ". There are ways you might recover it, but in your case there is a faster, better way.

Since you just reinstalled, I presume you have your data back ups. Before you install any more software, might want to reinstall XP, then put on your firewall and AV, go online, get your MS updates, put your regular software back on and THEN install all the spyware finders you mentioned. Unless you are doing some heavy duty surfing, you don't need to run those apps every day. If your security settings are good, like this you shouldn't need all that stuff much at all.

When SP2 is on there correctly, you will have an icon in the Notification Area that takes you directly to the same dialog box that Control Panel displays. Download that printer driver you need, save it to your hard drive and install from there, or download it on your other computer and make a floppy. After all your MS and Security updates are exhausted, do your software. Unplug and disconnect all peripherals, and do them last, and one at a time.

If, pre SP2, you need to change the settings on the ICF (XP Firewall), Control Panel> Network Connections> The connection you are using> general tab> Properties> Advanced Tab > settings will get you there. (Whew!)

Starting over is going to be faster and also easier than risking corrupt sytem files.

Johanna

 

rebecca--And to clear up one small loose end

The report of 5 DSO Exploits in SpybotS&D is a bug in Spybot. Ignore it.

 

Johanna,
No, I'm not on a network, but after experimenting with denying those Generic Host Process win32 popups over the last two days (I consistently get two of them, one with an IP of 216.211.26.14: DNS, the other one with all zeros), I still find that while I can get online if I deny them access, I cannot access a single webpage. Today I wanted to download MSN messenger, and the Generic Host popup came up asking me if I would allow it to accept connections from the internet. Don't know if it was directly related to the MSN download or not, but since the download wasn't kicking in, I ultimately allowed it. After that, the MSN download page materialized, but I still haven't been able to actually download the program. I'm guessing that has something to do with the firewall too, though I haven't done any research online on THAT subject yet.
I checked for Windows Update today, and see that SP2 has yet to be installed -- ugh. Says it's nearly a 10-hour download, so I'll have to leave instructions for the XP computer's owner and have her try to download it overnight. Then if things are still screwy after that, I may take your advice and try reinstalling from scratch, doing things in the order in which you suggested.

Frankly, I'm kind of wondering if I might fare better with the Sygate firewall - any feelings about that, anyone? Seems like everywhere I've looked online, people with the free ZA firewall have questions about what to allow and what not to. Maybe the same thing happens with the free Kerio and Sygate firewalls, and I'm just not looking in the right places to find out about the problems people have with those systems.

Charles, thanks for the SR instructions - I'll give those a shot over the weekend, too!
And Welshjim, thanks for the heads up on the 5 DSO Exploits!
Rebecca

 

Hi Rebecca,

Frankly, I'm kind of wondering if I might fare better with the Sygate firewall - any feelings about that, anyone? Seems like everywhere I've looked online, people with the free ZA firewall have questions about what to allow and what not to. Maybe the same thing happens with the free Kerio and Sygate firewalls, and I'm just not looking in the right places to find out about the problems people have with those systems.

Yes, both Sygate, which I use on XP, and as far as I know, Kerio also ask what to allow. The only firewall that doesn't is XP's.

I'm wondering why allowing MS processes access is giving you such a "headache ". I have to allow Generic Host Process for Win32 out or I don't ride the web. There is a bunch of MS processes that have periodically wanted access, so I denied them, and if the system worked, fine, if the system didn't work, I allowed them; what choice is there?

Regards - Charles

 

Charles,
I think my frustration with the ZA firewall and XP stems from the fact that I'm doing all this on a friend's computer. AdAware found 1242 "critical bugs" on her system when I first took a look at it on Monday, and as I mentioned, I ended up having to reinstall/recover XP from scratch. I have the ZA firewall on my ME computer, and have never had to deal with as many popup questions about access as are showing up with XP. I want the system to be easy for my friend to use (she's brand new to computers), but it seems like every time I log on, there's something new to deal with. I can't get back to my own computer until I feel like she's comfortable with hers...
How do I recognize an "MS process ", as you called it? If I were sure of what these things are, I suppose I'd be less reluctant to allow them. I read somewhere that I have to allow Windows Messenger to act as a server in order to use the IM program, so I've done that (and even clicked on "remember this setting" when I clicked "allow" -- certainty, for once!). So I'm SLOWLY gaining a little more nerve in allowing things. I just don't want to universally allow everything, or it seems like I'm kind of defeating the purpose of a firewall. Maybe not? Heck, I'm new to firewalls myself!
Thanks for all your help and input!
Rebecca

 

Hi Rebecca,

Ok, I have a better understanding now of your situation.

I looked at Sygate's application dialog page where I permit/deny outbound access.

The following MS processes have asked for access at one time or another:

Application Layer Gateway Service
Generic Host Process...
LSA Shell (Export Version)
NT Kernel & System

The NT Kernel is a system in XP that seperates the core operating system from applications in order for the OS not to be affected when those apps cause problems. Why it would want access, I don't know.

The others I used to know what they generaly are from way back when I first installed XP by googling. Also keep in mind that in XP, multiple processes are "bundled" into each of the of the ones I've listed. For example, the XP update program that looks for Windows updates piggybacks on our old friend Generic Host Process.

All the above processes, with the exception of Generic Host.. which I have to allow, I've either allowed/not allowed and did not tell sygate to remember my answer because I want to know when and under what circumstances they want access. I can't remember the last time any of those others wanted out. Its VERY infrequent.

There will be differences in what MS processes are running between systems that run XP Home and XP Pro and in the same OS category depending on the Services that are running. Don't know if you've looked into XP's services, they are accessed by: from Start > Run > type services.msc > ok.

Regards - Charles

 

Rebecca,
Sorry for the late reply. Unless you are on a network, you don't have to permit MS to access the net. I use Norton to block MS (gen host 32 etc) and I surf just fine. You can look up system processes here, or you can use msconfig and "hide" ms processes to identify what is NOT an MS process.

Two suggestions (if you want to learn more) IE security settings and XP Services.

If you aren't having any conflicts, leave your XP firewall enabled. It will block incoming traffic, not outgoing, so it is not a substitute for a third party firewall (but may quite possibly be sufficient after SP2- that is still open for discussion, now) If you don't know whether to allow something, a good rule of thumb is to block it- you can always change your mind later and allow it.

Johanna

 

Similar Problem

I am running XP Home and just downloaded SP2. After much effort everything seemed to be working fine. I can get to the internet and to online games with no problem.

However, after about 90 seconds of connection I am unable to access anymore web pages, or start any more sessions. I get no response to clicks, but if I am in a gaem already for instance I am still connected and continue to play online with no latency.

What could be causing me to lose the response, but still be able to continue existing sessions? I have run all the standard spyware programs and have alternately enabled and disabled the XP firewall with no change.