IE7 cannot connect to internet but can use msn and ping google

[jpdykes]

Hi,

I'm dealing with the following issue:

- I can ping www.google.co.uk and recieve return with no packet loss
- I can use msn messenger
- I can ping my router and othr networked computers
- I cannot connect to web pages via IE7
- I cannot update AVG free - "connection to update server failed"
- The computer has been rebooted numerous times
- The internet is known to be working because I'm posting from it.

The computer runs Windows XP SP2 is connected by ethernet to the router.
The windows firewall has been disabled.

My "Network Connections" tab in the Control Panel reads:

Lan or High-speed internet
- 1394 Connection - disabled
- LAN connection - connected


I am now rather stumped. Any help would be greatly appreciated.

Jeremy

 

[pat mcgroin]

Try this
goto Iexplorer|tools|advanced and hit reset

Also get to a command prompt and type
ipconfig /flushdns

Im pretty sure that will fix you up. If not schedule your AV for a scan at boot up.

 

[jpdykes]

Thanks for the reply pat,

I'm trying the reset now, already /released and /renewed in ipconfig, but can try /flushdns.

Jeremy

 

[jpdykes]

I'm having trouble getting Tom's to post - get blank page or "cannot display message". Hence multi post.

I've tried both of your suggestions but with no success.

Could this be a ports issue on the computer?
Or a winsock issue? (whatever that is!)

Jeremy

 

[jpdykes]

I also cannot browse to my router.

It just seems to point to this being Internet Explorer not looking for or using the LAN to attempt to connect to the internet. Thoughts?

Also installing Firefox 3 to see if this is just an IE issue, although given that AVG doesn't update I'm not convinced.

Update: Neither IE7, Firefox nor AVG can access the internet despite which MSN is still working perfectly.

 

[jpdykes]

Another update: Using the "set up small / home network" wizard doesn't work either. Set to connect through the residential network in the correct workgroup (MSHOME).

Update: Run sfc /scannow from cmd prompt. Possible missing dll's, need to get the XP CD from the computer owner.

Does this give anyone a clue as to what the problem might be?

Still very confused.

 

[jpdykes]

Update: Run sfc /scannow from cmd prompt. Possible missing dll's, need to get the XP CD from the computer owner.

Does this give anyone a clue as to what the problem might be?

 

[Proximon]

Is this a new build? Or was it working and suddenly failed? If it suddenly failed, when?

It certainly sounds like a virus. Remember, not all viruses are caught by any particular program. I would try grabbing the latest Avast or Trend or some other free DL. Possibly HiJack This, and a registry repair utility.

 

[jpdykes]

Thanks for the reply Proximon,

This is a system I am looking at for a friend. It is an old Dell 4550, she wants to be able to connect it to the internet via a new router - hence trying to make it work!

She has never used it to connect via a router, or at least it hasn't worked if she did. Previously she has used dial-up broadband.

Would it be useful for me to post the Hijack This log file?

I've tried a sfc checker scan, which seems to want the XP CD, probably suggests that there may be some problems, I'm slightly wary of letting it update them all incase I bring more trouble upon myself.

I'll get a hijack this log done and give it the once over with a new virus scanner.

Jeremy

 

[jpdykes]

This si the Hijack This log file from the machine:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:42:17, on 08/04/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16791)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\common files\logitech\lvmvfm\LVPrcSrv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATICAE.EXE
C:\Program Files\OLYMPUS\OLYMPUS Master 2\MMonitor.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\CCleaner\CCleaner.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.co.uk/0SEENGB/SAOS01?FORM=TOOLBR
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.co.uk/0SEENGB/SAOS01?FORM=TOOLBR
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = http://go.microsoft.com/fwlink/?LinkId=54843
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 192.168.0.1:80
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\NppBho.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll (file missing)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\UIBHO.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [OM2_Monitor] "C:\Program Files\OLYMPUS\OLYMPUS Master 2\FirstStart.exe" /OM
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NVMCTRAY.DLL,NvTaskbarInit
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [EPSON Stylus DX4400 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATICAE.EXE /FU "C:\WINDOWS\TEMP\E_SA4.tmp" /EF "HKCU"
O4 - HKCU\..\Run: [OM2_Monitor] "C:\Program Files\OLYMPUS\OLYMPUS Master 2\MMonitor.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.btclick.com/
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5) - http://upload.facebook.com/controls/FacebookPhotoUploader5.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} - http://go.divx.com/plugin/DivXBrowserPlugin.cab
O16 - DPF: {71057C18-0507-4747-86BC-E11CE7512C5F} - http://register.btinternet.com/templates/btmailcontrol013.cab
O16 - DPF: {EC5A4E7B-02EB-451D-B310-D5F2E0A4D8C3} (webhelper Class) - http://register.btinternet.com/templates/btwebcontrol024.cab
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\common files\logitech\lvmvfm\LVPrcSrv.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe

As far as I am aware Norton has been removed (by the looks of things incorrectly) from the system. There are no files relating to it on the hard disk.

I am running a virus scan using AVG Free 8.5 with a database from last month - found nothing other than tracking cookies and a BT openworld dialer that it has marked as potentially dangerous and removed.

Still won't display webpages or access internet to update AVG definitions.

Jeremy

 

[WR2]

I also cannot browse to my router.

It just seems to point to this being Internet Explorer not looking for or using the LAN to attempt to connect to the internet. Thoughts?

Also installing Firefox 3 to see if this is just an IE issue, although given that AVG doesn't update I'm not convinced.

Update: Neither IE7, Firefox nor AVG can access the internet despite which MSN is still working perfectly.

Since you've also ruled out a DNS problem by trying to reach a "real" IP addresses like:
http://212.58.226.138/
http://91.198.165.67/
http://209.85.225.99/

It's looking like port 80 (the http port) is being blocked. Which helps explain why you can't browse to your own router and why MSN Messenger is working since it uses TCP ports 1863 and 443.
Previous success connecting to the Internet seems to indicate a good winsock protocol stack.

You already disabled Windows Firewall. Is there another security suite installed that might have it's own firewall?
No real success using google to source a solution. Did find this: http://beer234.blogspot.com/2008/10/port-80-blocked-windows-xp.html

 

[WR2]

Found one more link:
http://www.petri.co.il/block_web_browsing_with_ipsec.htm

 

[jpdykes]

Thanks for your help again WR2,

I can ping the IP addresses and their www. counterparts.

I agree that port 80 maybe be blocked, but it is definately at the PC level rather than the router as all my other networked pc's (including this one work fine).

Is there an application that would allow me to "see" what ports are opened and which are closed?

Jeremy

Edit: I have checked the beer234.blogspot and that registry entry is set as requested.

 

[WR2]

Visit http://www.grc.com/intro.htm and use the Shields Up test.

 

[WR2]

Also run the Tools over @ http://www.dslreports.com/tools

 

[pat mcgroin]

Does she have any other firewall possibly built into the router?
Try putting the computer on the other side of the router for a few minutes
to see if it can connect. If so then that will help to narrow it down.

As for the AVG free i thought they didnt update that anymore.
I had it for a while and then it told me that I would have to but it to continue si I got something else.

Ok after looking at the Hijack log I have possibly found something
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 192.168.0.1:80

Im not great with networking but give me a little time and Ill boot into XP and see
what settings I have.
The trick is I am not behind a router so my settings would pertain to getting to the internet without a router but I still think that is where the conflict is.

 

[Proximon]

That line set off my alarms as well.

Can you just back up the files and install XP fresh on a reformatted disk? I'm pretty sure that would resolve the issues.

 

[jpdykes]

Thanks for the replies again,

WR2, I can't test with ShieldsUp onto the computer in question - I will try it onto the network - though I think the problem lies with the machine rather than the network.

ShieldsUp test returns all ports as stealthed.

Pat,
- The computer is running on my own network (I've bought it home with me) and that network is the one I am posting from. In principle the network works fine, it could be an issue between machine and router.
- Unfortunately I have a modem built into the router so I couldn't test without router. I am going to try it on our other network this evening, haven't had time yet.

- It would be useful to know what settings you have for the R1 entry. WR2 if you have Hijack This and could run it that would be interesting to.

Thanks very much (again!)
Jeremy

 

[jpdykes]

Proximon, I don't have access to all the programs that she has on her machine at the moment. I could if needed do a complete reinstall but I was trying to avoid it.

This started out as "could I install some extra RAM...."

 

[Proximon]

LOL it always does start that way

Still, I would go through the program list and uninstall anything not needed or wanted. Then I would run a registry cleaner.

I would also look through the running processes in task manager and google anything suspicious.

 

[jpdykes]

I've already run CCleaner on the registry, although I'm thinking of deleting the Norton instances because I think that was a bad uninstall.

I'm currently running sfc, which appears to be copying in some dll's, see if that solves the problem.

Could this be a winsock issue? It keeps popping up on my searches but I don't really understand what it is.

Jeremy

 

[jpdykes]

Run sfc, seemed to have used the XP disk to retrieve some files, but no success in terms of IE. Does it have a way to check results?

 

[pat mcgroin]

Ok Im on XP now so maybe i can be of help.
try this
control panel|network|connections|right click lan|properties|hightlight tcp/ip and see its properties
In mine all of the all of the top checkboxes are checked, in all options.

Under advanced
in ip settings
ipaddresses dchp enabled and automatic metric

In dns
top 2 appends and register are checked

in wins
lmhosts and default are checked

in options
tcp/ip filtering is in box
and its properties are all yes.

Im thinking since she was on a dial up possibly try to create a new connection and use the defaults to see if it doesnt help.

I have a feeling that the other connection is the cause of the proxie setting and the new one wont have that.
I also think that maybe the proxie is the one using the port 80 as its own so you may have to disable that connection so port 80 opens up again.

 

[jpdykes]

Thanks Pat, I've checked all my settings and they are the same as yours.

If I use the wizard to set up a new connection I get "Your broadband connection should be configured and ready to use". I don't know of any other method to set up a connection.

I'm feeling more convinced that this is a port 80 issue - I just don't know how to solve it.

 

[jpdykes]

Just found this interesting command: netstat
http://technet.microsoft.com/en-gb/library/bb490947.aspx

The syntax allows me to check which ports the computer is listening to and which connections are active.
Noteable neither syntax shows that port 80 is active.

I comparison the laptop I'm using now has loads of connections open on port 80 and one on 31335. Using the -n command.

Jeremy

Edit:
Also netsh command seems to have lots of functionality, but I don't really understand how to use it. Anyone more skilled?