Ethernet problem

[xcelr8]

I have an nf7-s and use the onboard ethernet. Last night i restarted my computer and this problem began, I hadn't changed any settings, just rebooted. When it came back I couldn't acquire an ip address, so i unplugged the cable, plugged it back in and noticed that the yellow ligth was stuck on. I unplugged my router and plugged it back in to reboot since i couldn't get into it, still the light was stuck on. I reinstalled my drivers, and even uninstalled and reinstalled the ethernet and still the same. The computer can be off, psu on, and right when i plug the cable in both the green and yellow lights are locked on. Also, now norton antivirus is acting up and won't scan. Does this sound like a virus and if so how can i get the newest definitions installed without liveupdate?

 

[Zolty]

Might be a bad ethernet card, I am assuming that the yellow light is the activity light.

 

[xcelr8]

Yes, I think the yellow light is the activity and the green is the connection. It comes on right away whenever i plug something in. It's almost like it's stuck sending but i have cycled the power and completely unplugged the computer. Windows says that the device is fine and working properly when the drivers are installed, but i'm guessing winxp doesn't know much and there still could be a prob.

If i turn the lan off in the bios should i see any lights on the back when i plug a cable in or not?

 

[FlyingPenguin]

Most modern LAN cards (even onboard) are powered all the time even when the computer is off. That's normal. That supports the "Wakeup on LAN" feature. I'm not sure that disabling it in BIOS would turn it off.

I would suspect the LAN port took a hit or the port you're using on the switch/router took a hit and it's dead, or the cable is shorted (mice eating through CAT5 cable is fun).

You need to systematically troubleshoot this. Plug the cable into another port on your switch or router, or plug another known good computer and cable into the port you're using on for this computer.

Temporarily connect the computer to the switch/router with a different cable (you may need to move the computer to another room if the router's not in the same room).

Finally, try installing add-on network card. They're cheap enough - $10 at office Depot. You can always return it if it doesn't turn out to be the problem.

 

[xcelr8]

The router is in another room, so far i have:

1) tried plugging the cable into another router port, same thing
2) tried a different cable from a different router port, same thing
3) tried plugging straight into the cable modem with a different cable, same thing

Seems like it's dead then, the norton antivirus problem along with this is troubling me though, that's the reason i wondered if it could be a virus somehow, but I can't really check right now.

 

[mechBgon]

To do an initial check on the virus aspect, open this text file and follow the instructions. It's very straightforward but it could take a while to complete the scan if you have lots of data. Afterwards, cut & paste the output from C:\report.html into this thread so I can look at it.

Alternative: take the drive out of that computer, slave it into a different computer, and do some antivirus scans on it in the other computer using a current-generation antivirus software. What version of Norton are you using, by the way? 2003, 2004, 2005...?

Also please download and run HijackThis and post the logfile's contents here too. That won't take more than a minute, so you might do that first. If HJT won't run, rename it from hijackthis.exe to something else and try again.

Lastly, what brand & model of router do you have, so I can see if there are ways to get insight from its logging/filtering capabilities

 

[xcelr8]

Thanks for all of the helpful advice mechBgon. I'm going to run hijackthis now, but i figured i would give a quick update.

I removed the ethernet card from this pc that i'm on and plugged it inot the one with the problem. It wasn't able to obtain an ip from the router, it's a d-link di-624, everything is wired. I then assigned the card an ip address through windows and rebooted, i was able to connect to the router then, but i wasn't able to go online still. I then removed the card, and assigned the same ip to the onboard ethernet in the nf7-s and it was able to connect to the router then too, but still no internet, that's where i'm at now. Thanks again, i'll post the logfile when i can, but the dinner bell is ringing. Also, i'm running nav 2003. Thanks again.

 

[mechBgon]

Ok, I got the DI-624 manual downloaded. If your scans don't turn anything up then I can suggest an investigative course of action using the router. You've got its wireless capabilties turned off, right?

1) go to this page in the router's configuration menus.

2) for the IP address of the afflicted computer, create a rule that will Deny all traffic on all interfaces, for ports 1 through 65535, all the time, for each of the different protocols that are available in the dropdown box (TCP, UDP, ICMP, whatever else they got). So now you have a bunch of rules each applying to a different protocol, all of them set to deny all traffic on all possible ports.

3) now fire up the problem computer and look at your router's logs in the Status > Log panel, to see what that crazy 'puter is doing Is there a pattern?

 

[xcelr8]

I ran adaware and it only found some cookies, i ran hijackthis and here is the log file:

Logfile of HijackThis v1.99.1
Scan saved at 7:09:53 PM, on 4/6/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\PROGRA~1\NORTON~1\SPEEDD~1\nopdb.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Messenger\msmsgs.exe
C:\PROGRA~1\WINZIP\winzip32.exe
C:\Documents and Settings\Hiro\Desktop\HijackThis.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [NVMixerTray] "C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRA~1\AIM95
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v...86/client/wuweb_site.cab?1111360298531
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation Service (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\SPEEDD~1\nopdb.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe


I'm running that mcafee virus scanner now, but it will probably take a while if it searches all 3 hds, i couldn't put the drives in another computer b/c they are raided. Again, thanks for the help.

 

[xcelr8]

That virus scan finished and didn't find anything. Also, i don't think i can block the computer with the router b/c there is a permanent rule that allows all lan traffic to go out to the internet or to the network.

I can login to the router and ping it, but I cannot ping the other computer on the network, nor can i connect to anything on the internet with the nf7-s. Are there any other dieas floating around out there?

 

[mechBgon]

Firewalls "stack" the rules. The default rule might be to allow all, but you can add another rule and then it's "allow all, except for _____________." Maybe it has a new SDbot/Gaobot/Spybot variant and has received orders to DDoS a website or something.

What else you could do, is to dredge up an old leftover hard drive, unplug the present hard drive, and set up Windows on the leftover hard drive real quick as a test, and see if it behaves normally.

 

[xcelr8]

Alrighty, I went and did what i should have probably tried from the beginning, and that was doing a restore to the day before yesterday. It fixed the internet connection problems, after i turned off the router denial which i had obviously set correctly. NAV still wasn't working right so i'm going to try to reinstall that now and run it to see if it will find anything. Again, thanks for all of your time and effort, I'll make sure to post what this was if NAV works and finds something.