TCP/IP may be damaged

I have a computer that the TCPIP will not communicate to the outside world. i.e. the pc will not "surf" the internet through Netscape nor IE. Where can I find the ports that TCPIP uses?

(The pc has been scanned for any known viruses, trojans, worms, adware, spyware.....)

 

NETSTAT is the command that will list what ports are in use or listening. Use:

NETSTAT /?

to get a list of the switches that control the output. The most useful for checking all the ports open on your PC is:

NETSTAT -a

The key port pairing for browsing is 80 (remote/server end) matched to a port greater that 1024 at the client/near end. There are other ports used by the browser (8080, 8000, 443 server side, for example). For a complete list of standard server side ports look at IANA port-numbers page which describes the main standard port usage.

However, I am not sure this will help you if you are unable to connect. To test connectivity:

1. Check cables. A huge number of network problem turn out to be disconnected cables, and it is easy to over-look.
2. Ping 127.0.0.1 - this will tell you if the TCP/IP stack is up and running. if this fails you need to reinstall TCP/IP.
3. Ping <your local IP> - For example PING 192.168.0.4; this will check the communication with the network card.
4. Ping a remote IP address - A useful address to use is the IP address of your ISP's DNS server. If you don't know this number, try 60.102.9.104, which is one of Google's servers. If this fails you have a problem with the network communication and/or you routing setup for the network. Use a TRACERT <ip address> to find the place where the fault occurs on the pathway out of your network.
5. Ping a remote server by name. For example PING WWW.GOOGLE.COM - this will test your name resolution. (this is the most likely problem!). If this fails and the other test pass, you need to investigate your DNS setup.

The order I've listed this test is the easiest way to write them, and a logical progression. However, it is often quicker to start with the last test (5) and work backwards (4, 3, 2, 1), as the later tests are the more likely to fail.

 

path out block

Thank you for the suggestions/lists ReggieB! I've completely forgot about that command. The pc did not reply with the tracert command. My pathway out of the network is stopped. I already knew that pathway out was stopped because the browswers will not go out, but I do have internal network.

How do I clear the pathway out? All the numbers are correct. Seems theres a port problem. Maybe an application? I know there's no virus or adware because I've spend 2 days scanning.

All the "pings" work fine internally, not externally.

 

"Did not reply" as in the command returned nothing or the command failed or the command did return results but only to a certain place on your LAN?

What OS on the affected machine?

 

didn't reply

Hi Newt:

O/S is 2K. (2000 with all patches installed)

ReggieB's check list helped, however I got to #4 (above) and received "failed to resolve target" with the tracert command. Everything internally is fine, externally--null. I've replaced the host and lmhost files. I think it is stopping at my gateway. The DNS is ok.

My concern is that this user has received a "not yet known" worm for virus of some sort.

Also, I'm not familar with the physical port information in order to read which port(s) is acting incorrectly.

 

Host, LMHost, and DNS are all name resolution systems. Name resolution will only work if the underlying IP system is works. Therefore, I would suggest concentrating on getting things working at the IP level first. Once IP is working, then move on to name resolution.

If we go back to basics, use this tool to check your addressing is right. Put the computers address with gateway address in "Computer 1" area and the router (without a gateway address) in the "Computer 2" area. Run the check and that should tell you if the IP addresses are right.

Then try tracert to the internal IP address of you router. Then tracert to the IP address of the DNS server. Does it stop at the router?

To cover the virus/trojan issue, I suggest running McAfee's stinger. It is the best tool I know for one off cleaning/testing of a system for the latest viruses and trojan.

If you want to delve in further still, I'd recommend Sysinternal's Process Explorer. That will allow you to have a good look at what process are running and what programs those process are associated with.

 

hopeless

Well, all the tools that were suggested on this bbs were extremely knowledgeable, however, the pc has detiriorated. All icons will not drag across the desktop, network has completely disappeared (blank folder but still accessing internal network..?..), event viewer will not show any properties to explain the warnings etc., control panel has 1/2 the icons available (any executables will not open, and most properties of the hardware are shadowed gray-not accessible.

format.....;(

Thanks for the helpful suggestions and tools....!!!!

 

Give this a shot. LSP Fix

 

still no luck

Hi ssmith10pn:

Thanks for the link. I will utiliza it in the future. When I ran it on this computer, I did not receive any logs or errors. The computer still performed strange. At this point, I am formatting it with a clean install of XP. This way the user will be up-to-date with the rest of her division.

This is very unfortunate. I/we still do not know what caused this strange behavior.

 

NEW.NET.......somthing

As I continue my pc support throughout the company, I've come across yet another xp pc with the same symptoms!! This time, in the control panel, there is an application that was installed--not knowing how or where from, and that is not my concern right now--named "New.Net...." After removing this application---and I may add that during removal, it did state it changed the network settings!! Now IE DOES NOT WORK. Exactly the same as the previous pc that unfortunately got formatted!!

If "anyone" is familar with this spyware that will not be detected with SpyBot S&D or SpySweeper----please help. I refuse to format yet another pc...;(

 

I'd suggest posting a new thread to the Security / spyware / virus forum as there will be people there who know a lot about spyware and what's out there, who don't browse this forum.

This looks like it is not a network problem. Posting a new thread will allow you to update the thread name to something more appropriate to the latest manifestation of the problem.

I for my sins, don't recognise that agent.

 

New thread

I guess you can close this one. The computer in this thread has been formatted and I've started another thread per your request.

Thank you.