ICS Probs with WIn XP

Hi Guy's

Normaly solve most of my problems with a little reading and head bashing.. But I have problems that have left me baffeled.

Helping a friend fix on going problems after a tech installed a Wirless lan and a p4-2.4 Server (Winxp pro). My friend has had various ongoing problems from printers not working or accessable from network, clients not found, software failing..

about 10 days ago all clients (3 xp and 1 win me) lost internet connection.
The server has full and normal access.. Initially all I could find was the usual cydoor/gator crud on the Server.., ran Spybot s&d and Adaware (fully updated), as well as CWShredder, and studdied the HJT list backwards..
The server is connected to isp via a DLink usb ADSL modem..

+ ReInstalled ICS, checked the setting, especially the other users controle of connection and made sure (while testing) the firewall was off. no change
+ re-configured the Network settings - ie ran the network config wizard on each machine.. now that caused problems..
+ while now we have internet connection from the WinMe machine ..good..
+ + but now we had to reinstall the printers,
+ + AND Reset ALL file sharing on the Server.. some shared folders were accessable and some were locked to clients.
+ + as well 2 of the wirless clients dropped off the network.. they would communicate with each other but not the server or other clients..
+ + + Hard wiring these via a Hub fixed that problem.
+ HAve checked various things even the MTU value, even lowered it to 1200 on the clients..
+ Oh yeh.. I can Ping a external IP from the clients..
+ emptied the cache and temp internet..

Any ideas.. please..
- oh yes AV definitions as are Spybot and AdAware uptodate..
- server is running PC-Cillen, clients NAV 2003..
defs upto date .. clients manually updated ..
and a NAV online scan run on the server..

I suspect either of the following:
- Virus/parasite program that I have missed.
- A setting in the server from the other tech.. he did have remote access..not now..

I will post the HJT log from the server and client later if that may help..

Cheers
- Iknow I haven't tried everything.. it aint working
- Don't bother with *nix install ideas.. When my friend cools down I will start to throw those ideas at him..
- I thing I have considered is to temp install another ICS server.. and confirm the problem as client or Server.. (I see the ME machine working could be a red herring)

get the feeling I posted in the wrong forum.. or no one has encountered a problem with ICS..

must admitt this is my first that I didn't have going in under 30mins..

Is further information required or should I post this under a security forum?

cheers

Hey Hey,

I'll throw out some ideas, don't know how good they'll be but they may result in something.

When you say the firewall is off, do you mean a third-party firewall or ICF and whichever you meant, have you checked the other. I'd set-up the ICS NIC as a trusted zone and make sure ICF wasn't in use.

Have you considered a hijacked hosts file? I remember getting hit once by something that Spybot wouldn't find. It left my original hosts file alone, but created a new one in %systemroot%\Help\iisHelp. It had changed/added a registry entry telling the system to look their for my hosts file instead.

You can ping by IP... can you ping by hostname? Can you resolve by IP/Hostname..... in other words does your machine know the DNS Servers IPs. Can you statically set them and see if that works?

Just a few ideas to throw out and get you thinking, I've seen those all cause problems before.. Good luck with it and if you get any more info... post it and I'll be sure to follow the thread.

Peace,
HT

just to add my two bits, not that it may help, but...

what version of pc-cillin are you using? versions 2002+ aslo have a firewall that are enabled. wouldn't explain how you are able to ping through though since with all logic in line it should block it since it may not be trusted.

i agree with the hijacked hostfile with the exception that it shouldn't come into play yet since it sounds like Und3ertak3r is having a problem with basic network connectivity. although i would give the lmhost file a good look. i have seen those hijacked as well and that would kill most basic name resolution... especially if it is pointing out to who knows where.

another silly little thing to try is forcing lan speed. i know i may get flamed for this, but i have seen (recently and not like the old 1st gen smc nic days) that auto sensing being enabled on a nic has caused major problems. just set them to force whatever your hub/network can handle. ie 10 full duplex/100 full duplex rather than auto. like i said let the napalm fly, but i have seen situations of major network issues due to something like that. even similar to what you are experiencing.

i may be all over the plate on this one, but i feel like i may be missing something in your original post. also to add a few more questions... is this a basic workgroup or is it an actual domain?

SOOOOoooo if i have wasted your time by reading my post... frag me now and hate me later :D

Thanks for the Ideas HTRegz and Kohei Sogekihei,

all noted and listed in my notebook for tomorrows attention.. I have a couple of Games machines to assemble tonight..

Cheers

Edit: Rude of me.. Greets to AO Kohei Sogekihei trust you have a good time here

:-) thank you for the welcome Und3ertak3r. having a blast here so far. although some of the time i feel way out of my element, i feel (and others feel) that i might have something usefull everynow and then to contribute. here's to being addicted to a new board!

CHEERS!