annabug
asked on
Event Viewer / DNS / DHCP / at wits end :)
Hello everyone.
First of all, I'd like to thank you all for this great resource. I have spent the last 4 days searching the web for an answer to my question and your boards have come the closest to answer it. So, I thought I would register and ask my own question.
This all started about..oh...a week ago. It started innocently enough. I could connect to my ISP (rural dialup-max speed 28.8) and browse the web. But then I noticed my pop3 email client wasn't working, it was receiving a DNS / DCHP error. No biggie. thought it was software related. then my other programs that access the net such as Norton LiveUpdate, portal, Spybot, etc...couldn't get through, either. I thought this was strange. I updated my virus definitions via disk from my husband's net connection. Ran it and discovered I had the w32.Tkoz (Tkez?) worm. Quarantined / removed it. Searched symantec for how to fix stuff..not much there. So, on a tip from another "tech" (and that's being generous calling him that), I uninstalled SP4 and some other stuff that I can't remember. Anyway, things got worse. I can still connect to my ISP, but can't see the web, etc. When IE tries to access a page, it goes through the "detecting DNS proxies" and errors out. Like I said, I've been searching and searching..can't figure this out. I really hope someone can help me. I've looked through the answers here but nothing really solved it. Below are the errors and other info. PLEASE HELP *grin* I'd be glad to do things in return!
IPCONFIG /ALL info:
Host name: anna
Primary DNS Suffix:
Node Type: Broadcast
IP Routing enabled: yes
WINS Proxy Enabled: no
Ethernet Local Area Connection (for my home network):
Connection Specific DNS suffices:
Description: Network Everywhere Fast Ethernet Adapter (NC100 v2)
Physical address: 00-04-5A-72-2C-3C
DHCP Enabled: Yes
Autoconfiguration enabled: yes
Autoconfiguration IP address: 169.254.9.156
Subnet mask: 255.255.0.0
Default gateway:
DNS Servers:
Ping issues:
CAN ping loopback 127.0.0.1
CANNOT ping own IP: 169.254.9.156
- recieve PING: Transmit failed: error code 65
EVENT VIEWER ERRORS:
Event Type: Error
Event Source: BROWSER
Event Category: None
Event ID: 8032
Date: 9/5/2003
Time: 4:16:39 PM
User: N/A
Computer: ANNA
Description:
The browser service has failed to retrieve the backup list too many times on transport \Device\NetBT_Tcpip_{77AC7
Data:
0000: 35 00 00 00 5...
Event Type: Error
Event Source: ipnathlp
Event Category: None
Event ID: 30013
Date: 9/5/2003
Time: 4:04:42 PM
User: N/A
Computer: ANNA
Description:
The DHCP allocator has disabled itself on IP address 169.254.9.156, since the IP address is outside the 192.168.0.0/255.255.255.0 scope from which addresses are being allocated to DHCP clients. To enable the DHCP allocator on this IP address, please change the scope to include the IP address, or change the IP address to fall within the scope.
Event Type: Error
Event Source: ipnathlp
Event Category: None
Event ID: 32003
Date: 9/5/2003
Time: 4:04:32 PM
User: N/A
Computer: ANNA
Description:
The Network Address Translator (NAT) was unable to request an operation of the kernel-mode translation module. This may indicate misconfiguration, insufficient resources, or an internal error. The data is the error code.
Data:
0000: 1f 00 00 00 ....
Event Type: Error
Event Source: ipnathlp
Event Category: None
Event ID: 31012
Date: 9/5/2003
Time: 1:37:43 PM
User: N/A
Computer: ANNAS
Description:
The DNS proxy agent encountered an error while obtaining the local list of name-resolution servers. Some DNS or WINS servers may be inaccessible to clients on the local network. The data is the error code.
Data:
0000: e8 00 00 00 è...
Thanks again!
Anna Schwartz
annabug@washtucna.com
First of all, I'd like to thank you all for this great resource. I have spent the last 4 days searching the web for an answer to my question and your boards have come the closest to answer it. So, I thought I would register and ask my own question.
This all started about..oh...a week ago. It started innocently enough. I could connect to my ISP (rural dialup-max speed 28.8) and browse the web. But then I noticed my pop3 email client wasn't working, it was receiving a DNS / DCHP error. No biggie. thought it was software related. then my other programs that access the net such as Norton LiveUpdate, portal, Spybot, etc...couldn't get through, either. I thought this was strange. I updated my virus definitions via disk from my husband's net connection. Ran it and discovered I had the w32.Tkoz (Tkez?) worm. Quarantined / removed it. Searched symantec for how to fix stuff..not much there. So, on a tip from another "tech" (and that's being generous calling him that), I uninstalled SP4 and some other stuff that I can't remember. Anyway, things got worse. I can still connect to my ISP, but can't see the web, etc. When IE tries to access a page, it goes through the "detecting DNS proxies" and errors out. Like I said, I've been searching and searching..can't figure this out. I really hope someone can help me. I've looked through the answers here but nothing really solved it. Below are the errors and other info. PLEASE HELP *grin* I'd be glad to do things in return!
IPCONFIG /ALL info:
Host name: anna
Primary DNS Suffix:
Node Type: Broadcast
IP Routing enabled: yes
WINS Proxy Enabled: no
Ethernet Local Area Connection (for my home network):
Connection Specific DNS suffices:
Description: Network Everywhere Fast Ethernet Adapter (NC100 v2)
Physical address: 00-04-5A-72-2C-3C
DHCP Enabled: Yes
Autoconfiguration enabled: yes
Autoconfiguration IP address: 169.254.9.156
Subnet mask: 255.255.0.0
Default gateway:
DNS Servers:
Ping issues:
CAN ping loopback 127.0.0.1
CANNOT ping own IP: 169.254.9.156
- recieve PING: Transmit failed: error code 65
EVENT VIEWER ERRORS:
Event Type: Error
Event Source: BROWSER
Event Category: None
Event ID: 8032
Date: 9/5/2003
Time: 4:16:39 PM
User: N/A
Computer: ANNA
Description:
The browser service has failed to retrieve the backup list too many times on transport \Device\NetBT_Tcpip_{77AC7
Data:
0000: 35 00 00 00 5...
Event Type: Error
Event Source: ipnathlp
Event Category: None
Event ID: 30013
Date: 9/5/2003
Time: 4:04:42 PM
User: N/A
Computer: ANNA
Description:
The DHCP allocator has disabled itself on IP address 169.254.9.156, since the IP address is outside the 192.168.0.0/255.255.255.0 scope from which addresses are being allocated to DHCP clients. To enable the DHCP allocator on this IP address, please change the scope to include the IP address, or change the IP address to fall within the scope.
Event Type: Error
Event Source: ipnathlp
Event Category: None
Event ID: 32003
Date: 9/5/2003
Time: 4:04:32 PM
User: N/A
Computer: ANNA
Description:
The Network Address Translator (NAT) was unable to request an operation of the kernel-mode translation module. This may indicate misconfiguration, insufficient resources, or an internal error. The data is the error code.
Data:
0000: 1f 00 00 00 ....
Event Type: Error
Event Source: ipnathlp
Event Category: None
Event ID: 31012
Date: 9/5/2003
Time: 1:37:43 PM
User: N/A
Computer: ANNAS
Description:
The DNS proxy agent encountered an error while obtaining the local list of name-resolution servers. Some DNS or WINS servers may be inaccessible to clients on the local network. The data is the error code.
Data:
0000: e8 00 00 00 è...
Thanks again!
Anna Schwartz
annabug@washtucna.com
Before trying to manually replace files from the CABs, you should to a repair installation -- instructions are shown here:
http://www.windowsinstall.co.uk/install/textonly/repair2k.htm
--
By "connecting" to your ISP, you really are only stating that the dialup succeeds in connecting your modem with a modem on the other side. From the info you provided, you have not been assigned a valid IP address from you ISP. From the IPCONFIG info you listed, there is no listing for your "Dial-Up adapter". If Dialup networking has not somehow been corrupted, it needs to be bound to TCP/IP. Since the problem just started happening, it sounds like something has gotten corrupted -- however, I wouldn't rule out a problem with your provider (see 1 below). I see as many of two courses of action:
(1)There is a problem at your dial-up provider's end.
- If you haven't already, try re-establishing the dialup connection.
- Try another dialup access number
(2)Something related to the Dial-up Networking or other networking components has / have been corrupted (possibly due to the worm).
- Perform the repair installation from he Win 2000 CD as explained in the link above.
I hope this helps.
http://www.windowsinstall.co.uk/install/textonly/repair2k.htm
--
By "connecting" to your ISP, you really are only stating that the dialup succeeds in connecting your modem with a modem on the other side. From the info you provided, you have not been assigned a valid IP address from you ISP. From the IPCONFIG info you listed, there is no listing for your "Dial-Up adapter". If Dialup networking has not somehow been corrupted, it needs to be bound to TCP/IP. Since the problem just started happening, it sounds like something has gotten corrupted -- however, I wouldn't rule out a problem with your provider (see 1 below). I see as many of two courses of action:
(1)There is a problem at your dial-up provider's end.
- If you haven't already, try re-establishing the dialup connection.
- Try another dialup access number
(2)Something related to the Dial-up Networking or other networking components has / have been corrupted (possibly due to the worm).
- Perform the repair installation from he Win 2000 CD as explained in the link above.
I hope this helps.
I left out something:
From the IPCONFIG info you listed, there is no listing for your "Dial-Up adapter" -- you show the info for your Etherfast NIC, however you are not using the NIC to connect to the net. The default IP address assigned by Windows to a NIC which is not connected is 169.something.something.so
--
mrdtn
From the IPCONFIG info you listed, there is no listing for your "Dial-Up adapter" -- you show the info for your Etherfast NIC, however you are not using the NIC to connect to the net. The default IP address assigned by Windows to a NIC which is not connected is 169.something.something.so
--
mrdtn
ASKER
mrdtn - Good point. I forgot to put in the ipconfig info for the modem as I didn't have it connected at the time of the ipconfig. I will post that momentarily. Also, I have already done a repair install of Win2k and it hasn't helped. Hmmm...but you have provided food for thought and I thank you for that :) Any other ideas while I get my IP info for you on the dial up adapter? When I stated "connected", what you said is exactly what I meant. I can connect to the ISP's modem..but that's it.
Try changing the MTU in the registry. Perhaps your provider or a router in the path has been updated to disable ICMP or something. I have been subjected to such insanity (I refer you to https://www.experts-exchange.com/questions/20621043/Router-modem-service-provider-problem.html):
http://www.winguides.com/registry/display.php/280/
Does this fix things?
--
mrdtn
http://www.winguides.com/registry/display.php/280/
Does this fix things?
--
mrdtn
By the way:
Concidering you are using a modem I would recommend setting the MTU to 576 if you try this.
mrdtn
Concidering you are using a modem I would recommend setting the MTU to 576 if you try this.
mrdtn
I personally think this is getting pretty technical without basic fault finding being done. First things first, is your NIC card attached to a HUB/Switch and does it have a link light?
Reinstall SP3/4 and check the event log after doing this for errors.
Delete your dial-up account (right click Network Neighbourhood, right click ICON)...make sure you got your Phone number/username/password before you try to recreate it. Dont change anything in the settings when you recreate it, just username/password/ph number.
Now You TCP/IP settings should be DHCP unless you have other PC's on the network that supply them to you. 169.254.x.x addresses are supplied by the pc itself when it cannot find a DHCP service so that is not something to be worried about. When you dial-up you need to check the with ipconfig /all. The ISP will supply
IP ADDRESS
SUBNETMASK
GATEWAY
DNS SERVERS
it may even supply you a hostname, depends on how they are setup, probably something like x.x.x.x.rural.isp.com
if all that is correct. try | ping www.yahoo.com |
if that works, then try your browser. If you browser does work, then its an app problem. if the ping doesnt work, it means you are not getting a DNS address from your ISP or something is wrong with the TCP/IP stack on your box.
Post back and let us know where you get up to.
Reinstall SP3/4 and check the event log after doing this for errors.
Delete your dial-up account (right click Network Neighbourhood, right click ICON)...make sure you got your Phone number/username/password before you try to recreate it. Dont change anything in the settings when you recreate it, just username/password/ph number.
Now You TCP/IP settings should be DHCP unless you have other PC's on the network that supply them to you. 169.254.x.x addresses are supplied by the pc itself when it cannot find a DHCP service so that is not something to be worried about. When you dial-up you need to check the with ipconfig /all. The ISP will supply
IP ADDRESS
SUBNETMASK
GATEWAY
DNS SERVERS
it may even supply you a hostname, depends on how they are setup, probably something like x.x.x.x.rural.isp.com
if all that is correct. try | ping www.yahoo.com |
if that works, then try your browser. If you browser does work, then its an app problem. if the ping doesnt work, it means you are not getting a DNS address from your ISP or something is wrong with the TCP/IP stack on your box.
Post back and let us know where you get up to.
>> I personally think this is getting pretty technical without basic fault finding being done. First things first, is your NIC card attached to a HUB/Switch and does it have a link light?
What does the NIC have to do with this? The link light won't be lit unless it's connected to something which is prividing a carrier frequency!
>>Delete your dial-up account (right click Network Neighbourhood, right click ICON)...make sure you got your Phone number/username/password before you try to recreate it. Dont change anything in the settings when you recreate it, just username/password/ph number.
The dialup is working as stated already.
--
mjokeefe, did you read the entire question and the posts already submitted?
What does the NIC have to do with this? The link light won't be lit unless it's connected to something which is prividing a carrier frequency!
>>Delete your dial-up account (right click Network Neighbourhood, right click ICON)...make sure you got your Phone number/username/password before you try to recreate it. Dont change anything in the settings when you recreate it, just username/password/ph number.
The dialup is working as stated already.
--
mjokeefe, did you read the entire question and the posts already submitted?
>>> I personally think this is getting pretty technical without basic fault finding being done. First things first, is your NIC card attached to a HUB/Switch and does it have a link light?
>What does the NIC have to do with this? The link light won't be lit unless it's connected to something which is prividing a carrier frequency!
Well if the event log stats that "
Event Type: Error
Event Source: ipnathlp
Event Category: None
Event ID: 30013
Date: 9/5/2003
Time: 4:04:42 PM
User: N/A
Computer: ANNA
Description:
The DHCP allocator has disabled itself on IP address 169.254.9.156, since the IP address is outside the 192.168.0.0/255.255.255.0 scope from which addresses are being allocated to DHCP clients. To enable the DHCP allocator on this IP address, please change the scope to include the IP address, or change the IP address to fall within the scope.
I would be guessing that they are using some type of ICS and therefore am "trying" to fault find without making anymore changes seen as the person has already removed/changed quite a few things. Get back to basics, get a baseline and then work through the problem.
>>Delete your dial-up account (right click Network Neighbourhood, right click ICON)...make sure you got your Phone number/username/password before you try to recreate it. Dont change anything in the settings when you recreate it, just username/password/ph number.
The dialup is working as stated already. Her husbands dial-up is working, not her's and to me it looks like the ICS has become corrupt and looks like has corrupted the remote connection service. Hence why i suggest making a new dial-up account without changing anything. Have i ever changed an MTU after 5 years of supporting clients, NO, never had to, because the MTU aint gonna be the problem.
Like i have said previously, get you PC back to a baseline we can help you fault find with and go through the steps i have stated and we'll see if it starts working, then if its still not working, it might be an idea to start looking at more advanced fault finding techniques.
--
>What does the NIC have to do with this? The link light won't be lit unless it's connected to something which is prividing a carrier frequency!
Well if the event log stats that "
Event Type: Error
Event Source: ipnathlp
Event Category: None
Event ID: 30013
Date: 9/5/2003
Time: 4:04:42 PM
User: N/A
Computer: ANNA
Description:
The DHCP allocator has disabled itself on IP address 169.254.9.156, since the IP address is outside the 192.168.0.0/255.255.255.0 scope from which addresses are being allocated to DHCP clients. To enable the DHCP allocator on this IP address, please change the scope to include the IP address, or change the IP address to fall within the scope.
I would be guessing that they are using some type of ICS and therefore am "trying" to fault find without making anymore changes seen as the person has already removed/changed quite a few things. Get back to basics, get a baseline and then work through the problem.
>>Delete your dial-up account (right click Network Neighbourhood, right click ICON)...make sure you got your Phone number/username/password before you try to recreate it. Dont change anything in the settings when you recreate it, just username/password/ph number.
The dialup is working as stated already. Her husbands dial-up is working, not her's and to me it looks like the ICS has become corrupt and looks like has corrupted the remote connection service. Hence why i suggest making a new dial-up account without changing anything. Have i ever changed an MTU after 5 years of supporting clients, NO, never had to, because the MTU aint gonna be the problem.
Like i have said previously, get you PC back to a baseline we can help you fault find with and go through the steps i have stated and we'll see if it starts working, then if its still not working, it might be an idea to start looking at more advanced fault finding techniques.
--
ASKER
Hello again :)
I'm sorry for the long delay in responding. things have been rather hectic here. i am on my husband's machine for now. i did try creating a new dial up and that did not work. :( What is the ICS you mentioned? I will try to answer any questions and TRULY appreciate all your help in this :)
Sincerely,
anna
I'm sorry for the long delay in responding. things have been rather hectic here. i am on my husband's machine for now. i did try creating a new dial up and that did not work. :( What is the ICS you mentioned? I will try to answer any questions and TRULY appreciate all your help in this :)
Sincerely,
anna
Have you actually tried making the MTU configuration changes suggested in my previous post?
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
My husband's dial up is working. That is how I'm online at the moment. I have not tried to MTU as suggested as of yet. My husband and I both have NIC cards and are connected directly to one another so that (originally, before this all happened) we could share an internet connection. The internet connection was on my machine. However, since it cannot seem to recognize DNS, etc...I reinstalled my husban'ds modem on his machine to dial in from here. The NIC card seems to be working fine. However, I will retest it. I was able to get things from his computer earlier so...
That is where things stand now. Should I try the extraction of cab files as suggested by my other friend, as well?
anna
That is where things stand now. Should I try the extraction of cab files as suggested by my other friend, as well?
anna
ASKER
Update -
My husband got MSN messenger to work..so that is progress. IE still isn't working. email isn't working.
The error he found was in TCP/IP - for some unknown reason, the "obtain automatically" was unchecked, which is weird cuz it was checked before. he went to Advanced and to the options tab, tcp/ip filtering, properties, checked enabled TCP/IP filtering all adapters. He then hit ok. Then he went to Ip security, and changed from "do not use ipsec" to "use this ipsec - client" then he clicked ok. So, now MSn messenger works, but not IE and Email.
Further ideas? *griN* And yes, I upped the points more. it's the max points I have. And I'll keep upping them every day as this progresses. thanks bunches for helping!
My husband got MSN messenger to work..so that is progress. IE still isn't working. email isn't working.
The error he found was in TCP/IP - for some unknown reason, the "obtain automatically" was unchecked, which is weird cuz it was checked before. he went to Advanced and to the options tab, tcp/ip filtering, properties, checked enabled TCP/IP filtering all adapters. He then hit ok. Then he went to Ip security, and changed from "do not use ipsec" to "use this ipsec - client" then he clicked ok. So, now MSn messenger works, but not IE and Email.
Further ideas? *griN* And yes, I upped the points more. it's the max points I have. And I'll keep upping them every day as this progresses. thanks bunches for helping!
ASKER
Well, good news! DH got it all up and working! YES! *does a happy dance* but, I want to thank you all for your great help, especially Mrdtn. Hence, I'm going to award him the points. :) Thanks again!
Oh..and when DH remembers what he did..I'll post it here for future reference. :0
Oh..and when DH remembers what he did..I'll post it here for future reference. :0
ASKER