Intermittent WiFi Connection Driving Me Crazy

I am using Windows 2000 Pro (with all updates) with a 802.11(b) card in a laptop in my bedroom. I have Cox highspeed internet with a cable router with WiFi. My laptop receives strong signal. My connection has become markedly sporadic. Starting only in the evening, I began being unable to connect to the internet using Internet Explorer. Often (but not always) I could get email through Outlook Express when I couldn't use Internet Explorer. Then for no apparent reason, Internet Explorer would work again. Now the same problem has spread to the day occasionally. Rebooting rarely fixes the problem (although sometimes it does). I use Norton Antivirus (always clean) and regularly use Ad-Aware and Spybot. My g/f stupidly downloaded HotBar and I spent a lot of time reomving its tentacles from Internet Explorer. I think that the problem was there before that, but seems significantly worse after. I figured that IE was corrupt. But when it is stalled and I hook up an Ethernet cable, I can use IE, and then when I disconnect the cable and restart IE, it usually works. What the heck is going on and how can I fix it short of reformatting and loading up XP Pro?

 

Please post the make and model of your wireless card.

If the card is built in, then please post the make and model of your laptop. Please supply the make and model of your wireless router as well.

Please correct me if I am wrong in my interpretation of your post. What you are saying is that the connection works, and is stable with a wired connection. When you are connected wirelessly, it is intermittent even with a strong signal. If this is the case, and your OS is up to date, please update the drivers for the wireless card, if you have not already.

 

Intermittent Internet

I have a Compaq N600 with a proprietary WiFi Card built in. I have a Siemens Speedstream 2524 Router, which apparently works fine. My drivers are the latest release from Compaq for the WiFi Card. The problem is now getting worse. At first, I suspected either my attempts to remove HotBar or interference from other sources at night. Now the problem is intermittent during the day as well. I had suspected IE, but when it is hard-wired, IE works fine, leading me to suspect the Compaq card, I guess.

 

Have you updated the BIOS since your last driver update?

I tried looking this up on the compaq web site. I found a Compaq N600C , so I am assuming that that is it. From the list on the site, I am also assuming that you have the Compaq 802.11b Multiport Module. Please correct me if I am wrong on my assumptions.

Have you updated the BIOS on the laptop since your last driver update? If not, you should always check for BIOS updates before updating drivers for built in devices.

You should also make sure that your wireless router will support the new security protocols that your new network card drivers bring. A lot of people will neglect looking at this and stick with the older and less secure protocols.

I tried going to Siemans (Efficient.com) site to look for the latest BIOS for that router. I cannot find it. All I found was pdf files.

I do not believe that Huntbar caused this problem. I believe that you have a hardware/driver/configuration issue somewhere.

We need to determine what changed on your laptop to cause the problem. Did the problem crop up after a recent Windows Update?

 

First, thanks for taking the time to go through this. I have not flashed new BIOS since I loaded the most recent software for the WLAN200 Multiport Module. I am pretty sure that it is not the Siemens, since I have had that for some time without a hitch. However, this problem showed up well after that software update to the WLAN200. My Windows 2000 automatically updates, as does Norton Antivirus 2003, so its hard to pinpoint a correlation between the problem and any update. If it were a hardware/software conflict, I would think that it would be regular, not intermittent. Likewise, if it was a corrupt file in IE, I would think that it would be problematic whether I was hardwired or WiFI. Finally, if it were either the Mutiport or a conflict, I would think that ALL internet connectivity would be lost, but in my case, I can almost always access my email servers using Outlook Express even when IE has stalled. How could IE not work and OE work if it wasn't an IE problem? Likewise, how could IE work through an Ethernet connection while not WiFi? Is there a Windows or IE subroutine that handles IE WiFi only?

 

You can look at the update history.

If you go to windowsupdate.microsoft.com, you can click on "View Installation History" on the left hand side. Find the updates that happened around the time that your connection became unstable.

Outlook Express and Internet Explorer use two different protocols (SMTP and HTTP respectively) to communicate. So you are comparing apples and oranges. If you said that Firefox and Internet Explorer were behaving differently, then you would have a point.

If you want, we can use HijackThis to confirm that your system is spyware free. I just need to see the log file that HijackThis produces. But I still believe that you have another issue.

If you have never used HijackThis, it is a must have. It is a small program that does not install on your system. You just run it from where you unzip it to. Click on the "Do a system scan and save a logfile" button. It will produce a text file called "hijackthis.log ". If I can see that log, then I can tell you if your system is clean.

I also highly recommend running Spybot Search & Destroy v1.3, with the TeaTimer option selected. TeaTimer is resident and will tell you if something is trying to insert itself into your systems startup. It will ask you if you want to allow or deny the change. Spybot also hilites changes to your startup that have happened since it was installed.

 

Thanks

I regularly use Spybot and Ad-Aware to make sure that I haven't picked anything up by accident. I am embarassed to admit that I went to the Compaq WLAN downloads and sure enough, there was an update from 11/04 that supposedly fixed sporadic disconnects from the internet! I downloaded it and so far, so good -- not one dropped connection yet, and I could even log onto neighbors' unsecured networks! I feel like a moron for having wasted your time before doing the obvious! Anyway, thanks again, and it looks like the problem is solved!

 

You are welcome!

I am happy to have helped.

 

Maybe I spoke too soon . . .

Got up this morning and had the same problem connecting again. Perhaps by hooking up the ethernet connection last night to download the update, I kicked IE back into gear again. It may be relevant that I am not actually getting a message that it is unable to connect or a time out of some sort, but IE seems to endlessly attempt to load the requested page, leaving a blank screen, almost like it is stalled.

 

The next time that it stalls...

Go to the DOS prompt and enter the following command:

netstat -a >netstat.txt

Copy the contents of the netstat.txt file to this thread. Replace your IP address in the file with xxx.xxx.xxx.xxx.

 

Netstat

Active Connections

Proto Local Address Foreign Address State
TCP Laptop:echo Laptop:0 LISTENING
TCP Laptop:discard Laptop:0 LISTENING
TCP Laptop:daytime Laptop:0 LISTENING
TCP Laptop:qotd Laptop:0 LISTENING
TCP Laptop:chargen Laptop:0 LISTENING
TCP Laptop:epmap Laptop:0 LISTENING
TCP Laptop:microsoft-ds Laptop:0 LISTENING
TCP Laptop:1028 Laptop:0 LISTENING
TCP Laptop:1029 Laptop:0 LISTENING
TCP Laptop:1033 Laptop:0 LISTENING
TCP Laptop:1047 Laptop:0 LISTENING
TCP Laptop:1327 Laptop:0 LISTENING
TCP Laptop:1707 Laptop:0 LISTENING
TCP Laptop:2301 Laptop:0 LISTENING
TCP Laptop:2686 Laptop:0 LISTENING
TCP Laptop:2689 Laptop:0 LISTENING
TCP Laptop:2694 Laptop:0 LISTENING
TCP Laptop:4343 Laptop:0 LISTENING
TCP Laptop:4345 Laptop:0 LISTENING
TCP Laptop:1038 Laptop:0 LISTENING
TCP Laptop:4343 Laptop:8080 ESTABLISHED
TCP Laptop:4377 Laptop:2301 TIME_WAIT
TCP Laptop:4378 Laptop:2301 TIME_WAIT
TCP Laptop:4379 Laptop:2301 TIME_WAIT
TCP Laptop:4380 Laptop:2301 TIME_WAIT
TCP Laptop:4381 Laptop:2301 TIME_WAIT
TCP Laptop:4382 Laptop:2301 TIME_WAIT
TCP Laptop:4383 Laptop:2301 TIME_WAIT
TCP Laptop:4384 Laptop:2301 TIME_WAIT
TCP Laptop:4385 Laptop:2301 TIME_WAIT
TCP Laptop:4386 Laptop:2301 TIME_WAIT
TCP Laptop:4387 Laptop:2301 TIME_WAIT
TCP Laptop:4388 Laptop:2301 TIME_WAIT
TCP Laptop:4389 Laptop:2301 TIME_WAIT
TCP Laptop:4390 Laptop:2301 TIME_WAIT
TCP Laptop:4392 Laptop:2301 TIME_WAIT
TCP Laptop:4393 Laptop:2301 TIME_WAIT
TCP Laptop:4394 Laptop:2301 TIME_WAIT
TCP Laptop:4395 Laptop:2301 TIME_WAIT
TCP Laptop:4396 Laptop:2301 TIME_WAIT
TCP Laptop:4397 Laptop:2301 TIME_WAIT
TCP Laptop:4398 Laptop:2301 TIME_WAIT
TCP Laptop:4399 Laptop:2301 TIME_WAIT
TCP Laptop:4400 Laptop:microsoft-ds TIME_WAIT
TCP Laptop:4401 Laptop:2301 TIME_WAIT
TCP Laptop:4402 Laptop:2301 TIME_WAIT
TCP Laptop:8080 Laptop:0 LISTENING
TCP Laptop:8080 Laptop:1325 CLOSE_WAIT
TCP Laptop:8080 Laptop:1708 CLOSE_WAIT
TCP Laptop:8080 Laptop:4343 ESTABLISHED
TCP Laptop:netbios-ssn Laptop:0 LISTENING
TCP Laptop:1047 208-45-133-23.excite.com:http ESTABLISHED
TCP Laptop:1327 xx.xx.xx.xx:http ESTABLISHED
TCP Laptop:1707 xx.xx.xx.xx:http ESTABLISHED
TCP Laptop:4345 208-45-133-23.excite.com:http ESTABLISHED
TCP Laptop:4391 Laptop:0 LISTENING
TCP Laptop:4391 OFFICE:netbios-ssn ESTABLISHED
UDP Laptop:echo *:*
UDP Laptop:discard *:*
UDP Laptop:daytime *:*
UDP Laptop:qotd *:*
UDP Laptop:chargen *:*
UDP Laptop:snmp *:*
UDP Laptop:microsoft-ds *:*
UDP Laptop:1039 *:*
UDP Laptop:netbios-ns *:*
UDP Laptop:netbios-dgm *:*
UDP Laptop:isakmp *:*
UDP Laptop:router *:*

 

What was open when you ran NETSTAT?

That is a lot of ports being used. What was open?

This is what mine looks like now with three Firefox windows open:

Active Connections

Proto Local Address Foreign Address State
TCP acomputer:microsoft-ds acomputer:0 LISTENING
TCP acomputer:1027 acomputer:0 LISTENING
TCP acomputer:1728 localhost:1729 ESTABLISHED
TCP acomputer:1729 localhost:1728 ESTABLISHED
TCP acomputer:1732 64.91.226.241:http TIME_WAIT
UDP acomputer:microsoft-ds *:*
UDP acomputer:isakmp *:*
UDP acomputer:1025 *:*
UDP acomputer:1044 *:*
UDP acomputer:1045 *:*
UDP acomputer:4500 *:*
UDP acomputer:ntp *:*
UDP acomputer:1144 *:*
UDP acomputer:ntp *:*

 

Only one IE window and Proxomitron. Could there be some type of Trojan operating?

 

It could be Proxomitron.

The only way to find out is to temporarily disable Proxomitron, restart the system, and do the experiment all over again.

If the ports remain open, then you probably have something running that shouldn't be. This is what you will have to do in that case:

Since you have Windows 2000, you cannot run NETSTAT with the -o parameter. The -o parameter will tell you what process has those ports open. What you need is a program called PortExplorer v2.0 by DiamondCS in Australia. I highly recommend that you buy this software regardless. In fact, I believe that it should be part of the OS.

PortExplorer is a much more powerful graphical version of NETSTAT. It is not only a port enumerator like NETSTAT, it is a packet sniffer. This means that it will capture all of the network traffic generated by the processes and allow you to see exactly what it is that they are doing. This is why I believe that it should be part of the OS. You have every right to know what the OS is doing.

You can go to DiamondCS and download a demo version if you want.

So the first thing that you need to do is temporarily disable Proxomitron and run the test. Post the NETSTAT results here, and we will move on from there.

 

First, thanks for your help! I have downloaded Port Explorer, and run it. There are 41 processes running, all either Norton Antivirus, windows or Compaq related. One of those, webdmi.exe seems to open several ports and is listed as a Compaq program. Anyway, what should I post here for you? A log file or something else? Let me know and I will do it.

 

I am leaving work.

When I get home I will take a look.

That program is pretty cool. I keep it in my QuickLaunch bar, as well as Process Explorer. As soon as I see traffic that should not be there, I bring it right up to see what is going on.

While you are waiting, you can use DNSStuff.com to confirm that those processes are talking to the domains that they should be. DNSStuff is a web site where you can ping, trace route, and whois from without it getting traced back to you. It's a great way to probe someone if you think that they are attacking you.

Those processes should be communicating with Symantec.com and HP.com. You can also search Compaq (HP) and find out what that WEBDMI file is. Something tells me that you don't need it.

By the way. I don't think that you have any malware. I still think that you have a configuration iussue. But I do think that this is a good exercise in learning how to defend yourself on the internet and learning what is really running on your system. We will get that system cleaned up for you soon enough.

 

Have PortExplorer running the next time...

...that you start IE. You may see some processes in a SYN_SENT state. Those processes are the ones that that are freezing up. You should see it in the Status column.