Very Strange XP Home Network Issues

Hey Hey,

I've been discussing this issue with Pooh and Ph1sh on AIM for about the last hour... Been working on it for a couple of hours... I can't seem to come up with any ideas other than a reinstall (which I don't have the authorization to do)... so I'm hoping some new minds will help out...

The Hardware:
A relatively brand new system... maybe a month old.. it's got a VIA onboard nic. (Recognized as VIA PCI 10/100MB Fast Ethernet))...

The Problem:
The system booms up and obtains an IP Address on boot from the proper DHCP server... all details are included in the DHCP lease... MSN Will Log on, IE will browse pages.. IP Address can be released and renewed.. After about a minute the connection drops.. Network Utilization goes to 0%... no packets travelling at all... I can't renew my IP address. The question is Why?

What I've Tried/Checked:
Checked the Network Drivers (reinstalled off XP Builtin drivers, Driver CD and VIAs latest)
Checked the NIC configuration
Reset TCP/IP settings (netsh)
Reset Winsock Registry Settings (WinSockFix.exe)
Virus scan with Panda (installed and afterwards uninstalled due to lack of a registration key)
Virus scan with TrendMicro SysClean
Scanned with SpyBot (only Alexa Related and DSO Exploit found... so nothing really)
Scanned with AdAware (Also found Alexa related.. nothing else... not even a cookie)
Wiped the IE tools (deleted files, deleted cookes, reset security, privacy, web and advanced settings)
System Restore to 2 Weeks ago
Verified Against Services to ensure the proper services were running
Checked that ICF wasn't running and that no third party firewalls were on
Removed everything from startup through msconfig
Tested the NIC using knoppix livecd... network functions fully in Knoppix
Scanned with VX2 Cleaner (Older Malware that caused these kind of problems)
Scanned with HiJack This!... (it's cleaner than my system)
Scanned with CWShredder
Tried 3 Different VLANs to ensure it wasn't a network issue
Attempted Static IP Addresses
Validated DHCP Lease and all included information (IP, Subnet Mask, Gateway, DHCP and DNS Servers... as well as lease time)
Checked System, Application and Security Event logs... nothing out of the ordinary (startup and shutdowns and system log ons)
Removed all protocols from Adapter and reinstalled them
Removed adapter and reinstalled it.

I'm stumped and have ran out of ideas... Anyone have anything for me? I'm on 2.5 hours of overtime so I doubt I'll be here much longer, but I'll be working on it again tomorrow if anyone has anything (also the system is up to date... with the exception of service pack 2)..

TYIA and Peace,
HT

Everything seems to work fine, then the connection drops and there is nothing? and its not anything you can think of.... mmm...

well i trust that its nothing obvious and that any suggestion i could give you (from what you have explained) im sure you have tried. but to give you some points on where to start. it sounds like its tripping on something and i dont know if it may be the ISP (but then wouldnt affect network) or maybe one of the routers/hubs(as well as the onboard LAN) is faulty.

sure seems strange...


CTO

Quote:

---

Originally posted here by CybertecOne
Everything seems to work fine, then the connection drops and there is nothing? and its not anything you can think of.... mmm...

well i trust that its nothing obvious and that any suggestion i could give you (from what you have explained) im sure you have tried. but to give you some points on where to start. it sounds like its tripping on something and i dont know if it may be the ISP (but then wouldnt affect network) or maybe one of the routers/hubs(as well as the onboard LAN) is faulty.

sure seems strange...


CTO

---

Hey Hey,

It is very strange indeed and I thank you for your comments... I'm not concerned with the ISP since it's like 3 10 Mbps backbones for the various sections of the college... As far as router/switch failures... (or the onboard LAN)... As I said it works fine in knoppix.. (which means the onboard LAN is fine) and it also means the routers/switches are fine.. plus it happens on every VLAN regardless of where it's connected or how it's connected.. it has the same problem... It's a single machine problem.... the fault is definately not in the network.


Peace,
HT

Then the only thing i can imagine is the MoBo LAN. it must be faulty. fair enough it works under knoppix, but possibly because knoppix isnt trying to execute a command or string that is causing the failure, which XP may be doing. have you tried configing to switch off anything unnessacary.

it may be hardware failure, initiated by software commands only XP is giving. sounds far off but possible (and likely with the way the results are comming :p)

How long is the time frame from connection to failure. is it contant or does it vary depending on activity??

CTO

Quote:

---

Originally posted here by CybertecOne
Then the only thing i can imagine is the MoBo LAN. it must be faulty. fair enough it works under knoppix, but possibly because knoppix isnt trying to execute a command or string that is causing the failure, which XP may be doing. have you tried configing to switch off anything unnessacary.

it may be hardware failure, initiated by software commands only XP is giving. sounds far off but possible (and likely with the way the results are comming :p)

How long is the time frame from connection to failure. is it contant or does it vary depending on activity??

CTO

---

Hey Hey,

The faulty hardware is definately a longshot... but I suppose it could be possible... just not something I'm willing to accept yet... not with XP anyways.. if we were talking like 95.. I'd believe anything about it... but I've got a fair amount of faith in XP....

The time is fairly constant.. always under 5 minutes... usually within the first minute.. but it can last slightly longer...

I'm leaning towards something similar to VX2 (VX2.ABetterInternet) or whatever stream you can find it as... We had many infections of it last year.. it was malware going around that would give you like 5 minutes of internet access max... and then kill it... Lavasoft has an AdAware plugin to remove it but the system checks out clean... I've been searching google looking for a new variant or something similar and but I haevn't found anything yet...

Peace,
HT

Mmm, yea it seems to be running out of solutions. maybe it is some kind of malware and its just being particularly difficult to find. in any case, sorry i couldnt help but i hope you get it working soon .... plus the over-time cant be that bad :p

*will keep thinking about it though and will post if anything comes to me :)*


CTO

HTRegz.. I may sound a bit like CTO..

I looked at your list of have dones.. Have you tried a new Cable?
Failing that install a seperate network card.. if it is a hardware prob the second NIC (seeing as the existing is onboard) will 98% bypass the cause....

IF the problem persists ... scann the HDD in another machine (with repair off) or use a live cd OS.. like the BART-PE system.. (with the stinger and McAfee AV's and a remote reg edit tool).. you will already know the drill.. latest..update..update..latest latest

I will be interested in what you find

Cheers

Quote:

---

Originally posted here by Und3ertak3r
HTRegz.. I may sound a bit like CTO..

I looked at your list of have dones.. Have you tried a new Cable?
Failing that install a seperate network card.. if it is a hardware prob the second NIC (seeing as the existing is onboard) will 98% bypass the cause....

IF the problem persists ... scann the HDD in another machine (with repair off) or use a live cd OS.. like the BART-PE system.. (with the stinger and McAfee AV's and a remote reg edit tool).. you will already know the drill.. latest..update..update..latest latest

I will be interested in what you find

Cheers

---

Hey Hey,

I've tried several cables... I'm going to try the second network card tonight to test it out (have to wait til the boss leaves... something about not beign allowed to open PCs because we're software support)... but meh.... I'll also try scanning off aLive CD and see if I find anything.

Peace,
HT