XP SP2 and IE....

[ainwood]

I am having a very strange problem. I have two PCs networked, and they share a dial-up connection.

On the PC that connects to the internet, I have just installed XP service pack two (it sXP 'home' - the other PC is 'professional'). Now that I have done this, I can connect to the internet, and load up one or two pages without problems. Then it loses the connection, and I get 'page not found' errors for all pages. This problem happens again and again. The only way I can restore it is to disconnect from the internet, and reconnect again.

The really strange thing is that it is the browser - because I can still use the connection with no problems from the other PC (Which I am doing right now). I have tried disabling the XP firewall, disabling the pop-up blocker and reducing the security settings - all to no avail. Any suggestions?

 

[stormbind]

No idea! IE seems to be messing up in many different ways across many systems..

http://windowsxp.mvps.org/IEFIX.htm

See bottom of page for a solution to re-installing IE.

 

[kcwong]

Is the XP Professional SP2 also?

Things to try:

1) Try unplugging the other PC (the professional one) from the network. See if disconnect still happens.

2) When you got disconnect in IE, open command prompt (Start | Run, type "CMD", press ENTER). Type "ping www.yahoo.com" and see if it can reach the site or not.

Post the results then... it might tell about the problem.

 

[MOTH]

After installing XP SP2 Professional on 2 PCs I am now having ongoing problems with IP adress conflicts that come up out of nowhere. I have released the IP leases, tried to assign static IPs. I have a 3rd PC that is W98 with no problems.

Strange thing is: The 2 XP SP2 PC's can both connect to the W98 box over the wireless net but can't get to the internet. The 98 box can do everything (of course I have no monitor or keyboard hooked up so that cramps things).

My Fix: every 24-48 hours I hit reset on my wireless router and by the time I am back upstairs everything is fine.

Well, not fine, but better. The internet seems painfully slow lately. Is it all the XP SP2 updates eating up bandwidth?

 

[MOTH]

Is the XP Professional SP2 also?

Things to try:

1) Try unplugging the other PC (the professional one) from the network. See if disconnect still happens.

2) When you got disconnect in IE, open command prompt (Start | Run, type "CMD", press ENTER). Type "ping www.yahoo.com" and see if it can reach the site or not.

Post the results then... it might tell about the problem.

If it doesn't work also try "ping 66.94.234.13" which is the IP for yahoo when I try it. This would tell you if it is a name resolution thing.

 

[ainwood]

I am starting to think its caused by a virus. I noticed that my PC hangs a bit following these crashes, and that the internet connection from that PC is very slow (I also noticed that there appears to be a lot more data being sent to / from my PC than would normally be expected with the browsing I do!)

Anyway, when it was hanging for a few seconds, the process list informed me that I had two copies of a process called 'winitr32.exe' running, each taking up 50% of the CPU time! This is being loaded via the startup, so I disabled it via msconfig. And, it was reenabled automatically when I next booted.

After sending the file to the link below this is what we found.
<http://www.kaspersky.com/scanforvirus>
http://www.kaspersky.com/scanforvirus

I'm awaiting the binary to review.

It probably came in on a laptop and spread to machines unpatched to MS04-11.
W32/Forbot-C is a worm which attempts to spread to remote network shares.
The worm also contains backdoor Trojan functionality, allowing unauthorised
remote access to the infected computer via IRC channels while running in the
background as a service process.

W32/Forbot-C moves itself to the Windows system folder as winitr32.exe
andcreates the following registry entries to run itself on system logon:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
Win32 Wmls Driver = winitr32.exe
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce\
Win32 Wmls Driver = winitr32.exe
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices\
Win32 Wmls Driver = winitr32.exe
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\
Win32 Wmls Driver = winitr32.exe
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce\
Win32 Wmls Driver = winitr32.exe

W32/Forbot-C attempts to spread to network machines using various exploits
including the LSASS vulnerability (please see MS04-011
<http://www.microsoft.com/technet/security/bulletin/MS04-011.mspx> ).

W32/Forbot-C attempts to terminate several processes related to anti-virus
and security related software.

link

Now, the strange thing is that I don't know where this virus could have come from! I reformatted my HDD on sunday, and since then have only installed programs from CDROMs - all genuine, and nothing new.

 

[ainwood]

Well, not fine, but better. The internet seems painfully slow lately. Is it all the XP SP2 updates eating up bandwidth?

Well, it was actually because of painfully-slow internet that I installed SP2 when I did - I was about to start playing with modem settings and install SP2 "later". I didn't want to tweak my modem settings and then somehow lose them when XP2 changed all the security.

Yes, the internet was painfully slow, but I can't blame SP2 for it, although now its worse....


Edit: PS thanks for the ping suggestion - I'll try it, but am at work now...

 

[ainwood]

Well, it looks like it might have spread via my network share.....

Link

W32/Forbot-C is a worm which attempts to spread to remote network shares. The worm also contains backdoor Trojan functionality, allowing unauthorised remote access to the infected computer via IRC channels while running in the background as a service process.
W32/Forbot-C moves itself to the Windows system folder as winitr32.exe andcreates the following registry entries to run itself on system logon:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
Win32 Wmls Driver = winitr32.exe
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce\
Win32 Wmls Driver = winitr32.exe
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices\
Win32 Wmls Driver = winitr32.exe
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\
Win32 Wmls Driver = winitr32.exe
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce\
Win32 Wmls Driver = winitr32.exe
W32/Forbot-C attempts to spread to network machines using various exploits including the LSASS vulnerability (please see MS04-011).
W32/Forbot-C attempts to terminate several processes related to anti-virus and security related software.

I'll have to check my other PC, and see if its installed itself there. I <hope> that's the only problem - shutting down that 'service' did nothing to stop these problems with IE disconnecting.