Solved

Cannot use Internet or Get e-mail because of WSOCK32.dll?

Posted on 2004-09-14
37
927 Views
Last Modified: 2008-02-01
I'm using Road Runner, have Outlook express for E-mail and have a wired network of two computers. Today I found that I could not get onto the internet. I kept getting "Page Could Not Be Displayed" message, As if I was not conetected. This computer I'm on now is attached to the network mentioned and works fine, which rules out Road Runner, the cable modem and the router. Meanwile E-mail was working

The tech person at RR had me do PING WWW.Yahoo.COM which sent and received four packects if data.  My suspicition turned to the network card on the failed machine (Gateway). I installed it, it's driver but now E-mail stopped working and Outlook gave a message about the "Pop Server" not being found. Again I called the techs at "Brighthouse" who stepped me thru some more things. It was found that I could PING usng and IP address but not a WWW.*** address. The TEch said it was the WSOCK32 file that ust have been corrupted and That I should restore it. It did and nothing changed!!

1. is this a common problem?

2. Are there other files I need to restore?

3. Since previously I had "Ad-Subtract" running but then removed it would this cause this problem? (I've tried to re-install it several times but It does not start up!)I remember that with Ad-Subtract, if you mistakingly deleted an empty directory it needed the Internet would not work.

4. Since I cannot blame it on Brighthouse what should I do.

5 I'll have to use the web to check this site for answers since I have no e-mail.

0
Comment
Question by:hrogers
  • 13
  • 11
  • 5
  • +4
37 Comments
 
LVL 11

Expert Comment

by:Paul S
ID: 12061187
Run LSP fix - http://cexx.org/lspfix.zip
Run winsock fix - http://www.spychecker.com/program/winsockxpfix.html

Run hijackthis - http://www.paulscomputerservice.net/download.php?link=10

look for things that say "broken internet access"

post log here.
0
 

Expert Comment

by:bbodenmiller
ID: 12061278
Try running a virus scan and adaware.
0
 
LVL 1

Expert Comment

by:SithLoaded
ID: 12061625
You don't need to reinstall those files.  You are not resolving names to IP addresses.  You can ping by IP address any web address like:

ping 64.233.167.104
and you get four replys

BUT if you...

ping www.google.com
you don't get any replys

If you ping www.google.com you will first get a DNS resolution...you can tell this by seeing the following:

Pinging www.google.akadns.net [64.233.167.104] with 32 bytes of data:

Reply from 64.233.167.104: bytes=32 time=31ms TTL=246
Reply from 64.233.167.104: bytes=32 time=24ms TTL=246
Reply from 64.233.167.104: bytes=32 time=26ms TTL=246
Reply from 64.233.167.104: bytes=32 time=25ms TTL=246

Ping statistics for 64.233.167.104:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 24ms, Maximum = 31ms, Average = 26ms


The first line: "Pinging www.google.akadns.net [64.233.167.104] with 32 bytes of data" shows a valid DNS name resolution occurred.  I say this, because it returned the IP address of www.google.com.  If you were not getting name resolution, the ping would not get this far and return "Ping request could not find host www.thisisagoodtest.com. Please check the name
and try again." or "Unknown host".  My demos are from a system running WinXP PRO.  Now, what if you get name resolution, but not a reply?  Well that would look like this:

Pinging test123.com [209.73.48.170] with 32 bytes of data:

Request timed out.
Request timed out.
Request timed out.
Request timed out.

Ping statistics for 209.73.48.170:
    Packets: Sent = 4, Received = 0, Lost = 4 (100% loss),



I would suggest flushing the DNS cache prior to trying to ping any of the www.XXXXXXX.com addresses, by typing:

ipconfig /flushdns

at the command prompt.

Then try pinging the addresses by name.

If you still can't resolve addresses, try this at the command prompt:

ipconfig /all

This should output the ip setting for all network adapters.  Find the adapter that you are using and get the DNS server addresses.  Then ping those by their IP address.  If you get all replys.....

Do a search on your computer for *host* (make sure to search within hidden files).  You are looking for two files: host and lmhosts.  Open each of these files up with NOTEPAD and verify they look like these:

Host:

# Copyright (c) 1993-1999 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
#      102.54.94.97     rhino.acme.com          # source server
#       38.25.63.10     x.acme.com              # x client host

127.0.0.1       localhost

LMHOST:

# Copyright (c) 1993-1999 Microsoft Corp.
#
# This is a sample LMHOSTS file used by the Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to computernames
# (NetBIOS) names.  Each entry should be kept on an individual line.
# The IP address should be placed in the first column followed by the
# corresponding computername. The address and the computername
# should be separated by at least one space or tab. The "#" character
# is generally used to denote the start of a comment (see the exceptions
# below).
#
# This file is compatible with Microsoft LAN Manager 2.x TCP/IP lmhosts
# files and offers the following extensions:
#
#      #PRE
#      #DOM:<domain>
#      #INCLUDE <filename>
#      #BEGIN_ALTERNATE
#      #END_ALTERNATE
#      \0xnn (non-printing character support)
#
# Following any entry in the file with the characters "#PRE" will cause
# the entry to be preloaded into the name cache. By default, entries are
# not preloaded, but are parsed only after dynamic name resolution fails.
#
# Following an entry with the "#DOM:<domain>" tag will associate the
# entry with the domain specified by <domain>. This affects how the
# browser and logon services behave in TCP/IP environments. To preload
# the host name associated with #DOM entry, it is necessary to also add a
# #PRE to the line. The <domain> is always preloaded although it will not
# be shown when the name cache is viewed.
#
# Specifying "#INCLUDE <filename>" will force the RFC NetBIOS (NBT)
# software to seek the specified <filename> and parse it as if it were
# local. <filename> is generally a UNC-based name, allowing a
# centralized lmhosts file to be maintained on a server.
# It is ALWAYS necessary to provide a mapping for the IP address of the
# server prior to the #INCLUDE. This mapping must use the #PRE directive.
# In addtion the share "public" in the example below must be in the
# LanManServer list of "NullSessionShares" in order for client machines to
# be able to read the lmhosts file successfully. This key is under
# \machine\system\currentcontrolset\services\lanmanserver\parameters\nullsessionshares
# in the registry. Simply add "public" to the list found there.
#
# The #BEGIN_ and #END_ALTERNATE keywords allow multiple #INCLUDE
# statements to be grouped together. Any single successful include
# will cause the group to succeed.
#
# Finally, non-printing characters can be embedded in mappings by
# first surrounding the NetBIOS name in quotations, then using the
# \0xnn notation to specify a hex value for a non-printing character.
#
# The following example illustrates all of these extensions:
#
# 102.54.94.97     rhino         #PRE #DOM:networking  #net group's DC
# 102.54.94.102    "appname  \0x14"                    #special app server
# 102.54.94.123    popular            #PRE             #source server
# 102.54.94.117    localsrv           #PRE             #needed for the include
#
# #BEGIN_ALTERNATE
# #INCLUDE \\localsrv\public\lmhosts
# #INCLUDE \\rhino\public\lmhosts
# #END_ALTERNATE
#
# In the above example, the "appname" server contains a special
# character in its name, the "popular" and "localsrv" server names are
# preloaded, and the "rhino" server name is specified so it can be used
# to later #INCLUDE a centrally maintained lmhosts file if the "localsrv"
# system is unavailable.
#
# Note that the whole file is parsed including comments on each lookup,
# so keeping the number of comments to a minimum will improve performance.
# Therefore it is not advisable to simply add lmhosts file entries onto the
# end of this file.

Notice that the host file only has a listing (the # representing that that line is commented out) for the loopback address 127.0.0.1 and the LMHOST file is all commented out.  Spyware and nasty adware programs will modify your host file and you may not be able to resolve names or go to websites because of that.

If this still doesn't solve it, I would check for adware redirecting your browser to a proxy of some sort.

Let me know if this helped.
0
 
LVL 1

Expert Comment

by:SithLoaded
ID: 12061639
By the way, name resolution would effect both internet and email.  The email server names have to be resolved.
0
 

Author Comment

by:hrogers
ID: 12064833
Thanks for the responses:

1. When I type in "PING WWW.***" I get "Unknown Host"

2. IP addresses seem to PING OK

3. I ran Ad-Aware that comes with Ad-Subtract and it found registry entries, files and folders that it thinks were adware components. I backed them up and deleted them. Rebootted and still no change.

4. ipconfig /flusdns did not work. I'm running Win/98 second addition. flushdns is not one of the parameters.

5. I could not find any files HOST or IMHOST. what directory should they be in?

6. I treid to re-install Ad-Subtract because I think it's the reason behind this but it does not want to start probably because there is NO internet connection.

7. I have a printer that is shared between the two computers. The printer is hooked up to the problem machine. Since I CAN print from this machine (Good one) then my network card is NOT part of the problem.

8. There are no Proxy settings.
0
 

Author Comment

by:hrogers
ID: 12066769
At this point I don't know what to do. Let's talk about proxy settings. What are they for?

I really have nothing filled in under Ie's Tools/OPtions/Connections...same on this working computer.


I'm really dead in the water!
0
 
LVL 1

Expert Comment

by:SithLoaded
ID: 12070382
I'm sorry I thought you were on Windows 2000 or higher.  Right click the desktop and choose new--->shortcut.  In the target field type:

"C:\Program Files\Accessories\WORDPAD.EXE" C:\WINDOWS\HOSTS

Click Next and then choose a name for the shortcut.  Shortcut to hosts is fine.  Once the shortcut is created then you need to double click it and that will open your hosts file.  The hosts file maps Computer Names (Hosts) to IP Addresses.  This is how DNS works.  If you cannot ping a domain name (ie.  google.com) but you can ping an IP address, you're computer doesn't know how to translate www.google.com into 64.233.171.104.  It must translate this address or you are dead in the water.  Email works the same way.  I would look at the hosts file and do the above instructions to look for any erroneous entries.  If you right click on the file after making any changes and choose properties, you can change the attributes of the file to READ ONLY and that should stop adware from editing it.

After cleaning out the hosts file, ping www.google.com or some other web address by name and see if that works.  If this is still not working....

Click start---->run

Type: winipcfg
In the run prompt and hit enter.

The Windows 98 Ip Configuration window should appear.  You may have to change the interface from PPP to the NIC that you are using.  Click the more info button.  Write down the addresses of your DNS servers.  Try pinging these by IP and let me know if it works.
0
 
LVL 1

Expert Comment

by:SithLoaded
ID: 12070393
The proxy settings should be blank.  You would know if you were using a proxy server to get internet access.
0
 
LVL 4

Expert Comment

by:rhettlee
ID: 12071244
This is just a DNS problem, if you could ping the DNS servers successfully, you could try removing the TCP/IP on the network properties of your PC restart it then re-install the TCP/IP again.

Maybe "Ad-Subtract" just corrupted some files needed by TCP/IP to work properly.
0
 

Author Comment

by:hrogers
ID: 12071538
Thanks for the responses.

1. My HOST file had two entries:

127.0.0.1 ie3.proxy.aol.com # added by adsubtract for AOL support
127.0.0.1 Adsubtract # added by AdSubtract for auto-dial

That's it two entries.

2. I added:" 64.233.171.104 google.com # some comment" to the HOSt file and I could PING google.com. I even deleted everything out of HOST, rebooted but again no E-Mil or internet.
I removed the google entry.

Should not my HOST file been bigger? If I frequent many web sites, will there be an entry in there  for each one?

0
 
LVL 4

Expert Comment

by:rhettlee
ID: 12071760
NO there won't be because HOST file was used mainly in the old days for resolving DNS names to IP addresses. Now we have DNS servers for that.

It is a definite DNS problem since your windows 98 is not resolving anything except those you manually define on the HOST file.

If you type winipcfg on run what IP does it say on your DNS entries?

SInce you remove the Adsubtract delete those entries that that was added by ad-subtract.

Have you tried uninstalling TCP/IP then reinstalling it.

0
 

Author Comment

by:hrogers
ID: 12074187
1. I have not deleted the TCP/IP stuff out of the Properties of Network Neighborhood becase this is what I have:

TCP/IP -> D-Link DFE - 530TX+PCI Adapter
TCP/IP -> Toshiba PCX1100U USB Cable Modem (NDIS5)

The top entry is from the new network card I installed when this all started happening

The second entry is for the Cable Modem Brighthouse gave me.

You want me to remove these?

Also, When I do properties on either of these entries the DNS Config tab has DNS disabled. It is that way on the computer that does work. I thought I'd mention it.

The IP address for the DNS entry is 24.95.227.34.

When this all started, in winipcfg int the pull down list there was something called PPP adapter and the previous network card. PPP adapter was the selected one so I removed it.
NOW all that's there in the pulldown is the D-link adapter card that I installed.

0
 
LVL 4

Expert Comment

by:rhettlee
ID: 12080287
PPP adapter is used for dial up so don't mind it.

If you remove tcp/ip it will be automatically remove all of its entries.

restart it then reinstall the tcp/ip.. make sure you have the win98 cd or just the win98 installation files. Because you will need it when you reinstall the TCP/IP. To install it if remember correctly on network properties click ADD choose protocol then choose microsoft then find TCP/IP.

Its ok that the DNS option on the DNS config is disabled. When your computer is set to automatically obtain IP address the DNS is also automatically configured. But if you are using static IP's you need to enable it and add a DNS server of brighthouse or whoever your Internet provider there manually.

0
 
LVL 1

Expert Comment

by:SithLoaded
ID: 12081225
You still haven't answered my question.

Can you ping the DNS server listed in winipcfg?
0
 
LVL 1

Expert Comment

by:SithLoaded
ID: 12081354
DHCP is running from the ISP provider (aol, earthlink, whatever).  That means that your IP address, subnet mask, default gateway, DNS settings, etc. are automatically given to your PC upon boot.  You do not have to configure any IP settings in the TCP/IP properties.  This means that there should not be any IP configuration in the TCP/IP properties.
0
 
LVL 11

Expert Comment

by:Paul S
ID: 12081370
have you tryed running lspfix or the winsock fix tools that i linked to? try them. run hijackthis and post your log here if you can.
0
 
LVL 1

Expert Comment

by:SithLoaded
ID: 12081379
One more question:

Could you tell me the configuration of your network?

You have a router, 2 computers, and a printer.  The printer is locally shared off one of the PCs.  The cable modem connects to the router.  Like below:


                         Cable From Wall
                                    |
                                    |
                            Cable Modem
                                    |
                                    |
                                Router
                                    |
                       _______|________
                       |                          |
                       |                          |
                    PC 1                      PC 2


Is this correct?
0
 
LVL 1

Expert Comment

by:SithLoaded
ID: 12081385
I am assuming then your router is handling the DHCP request?
0
What Should I Do With This Threat Intelligence?

Are you wondering if you actually need threat intelligence? The answer is yes. We explain the basics for creating useful threat intelligence.

 
LVL 1

Expert Comment

by:SithLoaded
ID: 12081389
Remember, you need to PING the DNS server 24.95.227.34.

ping 24.95.227.34

Please do that, without knowing if you have connectivity to the DNS server, we really can't go much further.

Thanks!
0
 

Author Comment

by:hrogers
ID: 12083406
1. Yes I can ping 24.95.227.34 infact, there is a button to the right of it that when you press it the number changes to 24.95.227.35 and again to 65.32.1.79. I can ping ALL of those addresses.

2. The only CD's I have came with the PC. It's a gateway 750 MHZ from 2000. It came with a little binder of disks. There is an application restoration CD, Operating System Backup CD and System restoration CD. I do not have disks for Win/98 from Microsoft. I fI remove TCP/IP I may not be able to get it back. There are some CAB files under Windows but I'm not sure what they are for.

3. The drawing you gave is correct. PC 1 lest say is the Gateway and PC 2 is the working one I"m on now.

4. I cannot tell if my router is handling DHCP requests. Since I'm able to get to this site from PC 2 then the connections are correct, just the PC 1 files are screwed in some fashion.

5. The restore disks mentioned contain CAB files too. What would I look for to get TCP/IP back?
0
 

Author Comment

by:hrogers
ID: 12083607
About LSPFIX, when I ran it it found none to be missing so it updated nothing. HiJack this created this log:

Logfile of HijackThis v1.98.2
Scan saved at 8:05:39 AM, on 09/17/2004
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\PROGRAM FILES\COMMON FILES\WINTOOLS\WTOOLSA.EXE
C:\WINDOWS\SYSTEM\LEXBCES.EXE
C:\WINDOWS\SYSTEM\RPCSS.EXE
C:\WINDOWS\SYSTEM\LEXPPS.EXE
C:\PROGRAM FILES\COMMON FILES\WINTOOLS\WSUP.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\NORTON ANTIVIRUS\VPTRAY.EXE
C:\WINDOWS\SYSTEM32\DRIVERS\DCFSSVC.EXE
C:\WINDOWS\CONFIG\DOCFONT.EXE
C:\WINDOWS\STARTER.EXE
C:\PROGRAM FILES\VIEWPOINT\VIEWPOINT MANAGER\VIEWMGR.EXE
C:\WINDOWS\RunDLL.exe
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\WINDOWS\TEMP\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.websearch.com/ie.aspx?tb_id=50010
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.websearch.com/ie.aspx?tb_id=50010
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.scrk.com/searchbar.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.websearch.com/ie.aspx?tb_id=50010
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - {87766247-311C-43B4-8499-3D5FEC94A183} - C:\PROGRA~1\COMMON~1\WINTOOLS\WTOOLSB.DLL
O2 - BHO: (no name) - {87766247-311C-43B4-8499-3D5FEC94A183} - C:\PROGRA~1\COMMON~1\WINTOOLS\WTOOLSB.DLL
O2 - BHO: (no name) - {8952A998-1E7E-4716-B23D-3DBE03910972} - C:\Program Files\Toolbar\toolbar.dll
O2 - BHO: CATLEvents Object - {3EC8E271-FAB9-418a-8A8E-65AEB4029E64} - C:\WINDOWS\TEMP\TNOFCOD.DAT
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: (no name) - {339BB23F-A864-48C0-A59F-29EA915965EC} - (no file)
O3 - Toolbar: &Search Toolbar - {702AD576-FDDB-4d0f-9811-A43252064684} - C:\PROGRAM FILES\COMMON FILES\OE\TOOLBAR.DLL
O3 - Toolbar: (no name) - {4E7BD74F-2B8D-469E-92C6-CE7EB590A94D} - (no file)
O4 - HKLM\..\Run: [TaskMonitor] c:\windows\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\NORTON~1\vptray.exe
O4 - HKLM\..\Run: [Dcfssvc] c:\windows\System32\Drivers\dcfssvc.exe
O4 - HKLM\..\Run: [DOCFONT] C:\WINDOWS\CONFIG\DOCFONT.EXE
O4 - HKLM\..\Run: [EnsoniqMixer] starter.exe
O4 - HKLM\..\Run: [ALCHEM] C:\WINDOWS\ALCHEM.exe
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [WinTools] C:\PROGRA~1\COMMON~1\WINTOOLS\WTOOLSA.EXE
O4 - HKLM\..\RunServices: [WinTools] C:\PROGRA~1\COMMON~1\WINTOOLS\WTOOLSA.EXE
O4 - HKLM\..\RunServicesOnce: [WinTools] C:\PROGRA~1\COMMON~1\WINTOOLS\WTOOLSA.EXE /boot
O4 - HKCU\..\Run: [Taskbar Display Controls] RunDLL deskcp16.dll,QUICKRES_RUNDLLENTRY
O4 - HKCU\..\RunOnce: [*MS Setup] C:\WINDOWS\VBTASK.EXE ren
O8 - Extra context menu item: Shorten URL - http://www.cjb.net/menuext.html
O8 - Extra context menu item: Web Rebates - file://C:\PROGRAM FILES\WEB_REBATES\Sy1150\Tp1150\scri1150a.htm
O16 - DPF: Dialpad Java Applet - http://www.dialpad.com/applet/src/vscp.cab
O16 - DPF: {A27CFCAE-9351-4D74-BFFC-21EB19693D8C} - http://www.xupiter.com/search2/install/XupiterToolbarLoader.cab
O16 - DPF: {8522F9B3-38C5-4AA4-AE40-7401F1BBC851} - http://64.227.53.90/stereo/mp3search.exe
O16 - DPF: {6B4788E2-BAE8-11D2-A1B4-00400512739B} (PWMediaSendControl Class) - http://216.249.24.140/code/PWActiveXImgCtl.CAB
O16 - DPF: {FC327B3F-377B-4CB7-8B61-27CD69816BC3} - http://www.clock-sync.com/ClockSyncAutoSYNC0016.cab
O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) - http://us.chat1.yimg.com/us.yimg.com/i/chat/applet/v43/yacscom.cab
O16 - DPF: {D7B3E460-9968-4191-BD6F-BEED1BC18482} (Loader Class) - http://www.orbitexplorer.com/OELoader.cab
O16 - DPF: {54E7E082-1DA6-412E-96B5-C290FCEF5329} (DFRun Class) - http://webpdp.gator.com/v3/download/iegator_4090_hd3ptdmgainads.cab
O16 - DPF: {A8F2B9BD-A6A0-486A-9744-18920D898429} (ScorchPlugin Class) - http://www.sibelius.com/download/software/win/ActiveXPlugin.cab
O16 - DPF: {E8EDB60C-951E-4130-93DC-FAF1AD25F8E7} (MoneyTree Dialer) - http://cdn.climaxbucks.com/mt/dialers/fc/UniDist.CAB
O16 - DPF: {DC765522-D5BE-49C9-AF5F-8C715A44BA28} (MS Investor Ticker) - http://fdl.msn.com/public/investor/v9.5/ticker.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://207.188.7.150/18723f1c29e944912614/netzip/RdxIE601.cab
O16 - DPF: {13197ACE-6851-45C3-A7FF-C281324D5489} - http://www.2nd-thought.com/files/install011.exe
O16 - DPF: {EF0DBA6F-43CE-4B26-9808-2AB38FA0DB29} (MSN Money Ticker) - http://fdl.msn.com/public/investor/v13/ticker.cab
O16 - DPF: {086A694F-91FB-4068-B44C-124FB69BF05D} - http://www.searchwww.com/search.cab
O16 - DPF: {00000EF1-0786-4633-87C6-1AA7A44296DA} (F1 Organizer Class) - http://www.addictivetechnologies.net/DM0/cab/fr03tp.cab
O18 - Protocol: tpro - {FF76A5DA-6158-4439-99FF-EDC1B3FE100C} - (no file)

Hope this is what you wanted
0
 
LVL 4

Expert Comment

by:rhettlee
ID: 12090476
well are there cab files under c:\windows\options\cab directory?

example:
win*.cab

If there is then you could remove and re-install the tcp/ip, when it asks for the win98 CD then just point it there.
0
 
LVL 4

Expert Comment

by:rhettlee
ID: 12090495
Also i looked at your hijack log you could delete the following:
You don't need them and some of them are spywares:

Scan it again with hijackthis.exe then check the items below then click on fix:

O4 - HKLM\..\Run: [ALCHEM] C:\WINDOWS\ALCHEM.exe
O2 - BHO: CATLEvents Object - {3EC8E271-FAB9-418a-8A8E-65AEB4029E64} - C:\WINDOWS\TEMP\TNOFCOD.DAT
O8 - Extra context menu item: Web Rebates - file://C:\PROGRAM FILES\WEB_REBATES\Sy1150\Tp1150\scri1150a.htm
R3 - URLSearchHook: (no name) - {87766247-311C-43B4-8499-3D5FEC94A183} - C:\PROGRA~1\COMMON~1\WINTOOLS\WTOOLSB.DLL
O2 - BHO: (no name) - {87766247-311C-43B4-8499-3D5FEC94A183} - C:\PROGRA~1\COMMON~1\WINTOOLS\WTOOLSB.DLL
O2 - BHO: (no name) - {8952A998-1E7E-4716-B23D-3DBE03910972} - C:\Program Files\Toolbar\toolbar.dll
O4 - HKLM\..\Run: [WinTools] C:\PROGRA~1\COMMON~1\WINTOOLS\WTOOLSA.EXE
O4 - HKLM\..\RunServices: [WinTools] C:\PROGRA~1\COMMON~1\WINTOOLS\WTOOLSA.EXE
O4 - HKLM\..\RunServicesOnce: [WinTools] C:\PROGRA~1\COMMON~1\WINTOOLS\WTOOLSA.EXE /boot

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.websearch.com/ie.aspx?tb_id=50010
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.websearch.com/ie.aspx?tb_id=50010
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.scrk.com/searchbar.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.websearch.com/ie.aspx?tb_id=50010

O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: (no name) - {339BB23F-A864-48C0-A59F-29EA915965EC} - (no file)
O3 - Toolbar: &Search Toolbar - {702AD576-FDDB-4d0f-9811-A43252064684} - C:\PROGRAM FILES\COMMON FILES\OE\TOOLBAR.DLL
O3 - Toolbar: (no name) - {4E7BD74F-2B8D-469E-92C6-CE7EB590A94D} - (no file)



0
 
LVL 23

Expert Comment

by:gecko_au2003
ID: 12092126
Which file exactly is it because there is wsock.vxd, winsock32.dll and a few others ? Also would using the regsvr32 command to register it make any difference providing you replace that specific file considering the one you have now is corrupt ?

0
 
LVL 11

Expert Comment

by:Paul S
ID: 12092557
did you try running the winsock fix?
0
 

Author Comment

by:hrogers
ID: 12092832
The Winsock fix was not for Win/98.


I removed the TCP/IP entries in the Network Props, rebooted then went back and added TCP/IP by just pressing the ADD button and selecting Protocol. t never asked for any disks. The two that I removed re-appeared again. This had NO effect on and I still cannot use email or internet.
0
 
LVL 8

Expert Comment

by:natcom
ID: 12093140
0
 
LVL 23

Expert Comment

by:gecko_au2003
ID: 12094044
last resort if no one else can solve your problem you can always partition your hard drive using partition magic and back up the stuff you want to keep, format your computer using a bootable disk (www.bootdisk.com ) or bootable cd rom. Then re install the operating system, drivers , etc.
0
 

Author Comment

by:hrogers
ID: 12094285
Wiping the HD is not an option.

I want to go over what we've been thru so far:

1. The network Card I replaced was a different brand but still made for my router. Is it true that since the printer is shared between these two machines, and I can print from machine B using machine A's printer (machine A is the problem machine), that the new network card in stalled in machine A is working?

2. What possibly could have happened overnight that would cause all this? Monday NIght it was OK, Tuesday it was dead? I turn it off every night.

3. There are two lights on the network card, one is solid the blinks when data is sent through?

4. When I tried to re-install the Road Runner software it does a check of your components. It found reference to the Toshiba Cable modem's driver and said it should be removed. I think this is because it could not "SEE" the cable modem since the connection was not there. Does this sound correct?

5. Since I can get e-mail on machine B I really don't want to mess with the RR account?

6. We are not sure if Wsock32.dll is the poblem or DNS is the problem?

7. Again, removing TCP/IP and re-adding did not require any disks, although now I get a network password prompt when I re-boot.

8. Machine B, that's working has ONE TCP/IP entry in the properties list. it does not mention the network card as Machine A does. It just says TCP/IP. ON the advance tab for TCP/IP properties on B "NONE" is in the list, while on Mchine A is says "Allow Binding to ATM"?

9 Is there a place where I can find out what all these entries should be?
0
 
LVL 1

Expert Comment

by:SithLoaded
ID: 12095924
Just to briefly go over the network connections.


                          Cable From Wall
                                     |
                                     |
                             Cable Modem
                                     |
                                     |  <------Ethernet cable?
                                     |
                                 Router
                                     |
                       ________|________
                       |                           |
                       |                           |
                    PC 1                       PC 2

You have a Ethernet cable (Cat 5 or 6) going from the Ethernet port on the cable modem to the internet port on the router, correct?

I ask this, because that modem has a USB jack too.  Do you have any of the computer's connected to the USB jack on the modem?  I would assume you do, because you installed the road runner software.  You do not need the Road Runner software installed if you are using the ethernet jack on the cable modem.  I have Road Runner at home with none of their software installed and it works just fine.  Perhaps the Road Runner software is messing up DNS, because it wants to send requests out the USB port to the cable modem.  I would remove all of the Road Runner software and any mentions to Cable modems in your TCP/IP Properties window.

Then try it.
0
 
LVL 1

Expert Comment

by:SithLoaded
ID: 12095982
Since I can get e-mail on machine B I really don't want to mess with the RR account?

You don't have to use road runner's software to get email.  Use Outlook Express or some other client.  You could also use Road Runner's webmail feature.  You should be able to get the POP3 and SMTP server names from Road Runner support page.


Machine B, that's working has ONE TCP/IP entry in the properties list. it does not mention the network card as Machine A does. It just says TCP/IP. ON the advance tab for TCP/IP properties on B "NONE" is in the list, while on Mchine A is says "Allow Binding to ATM"?

ATM is a layer 2 cell switching protocol, you shouldn't have that enabled for any reason.

Normal Windows 98 installs (at least ones I have used) would have the following listed:

Client for Microsoft Networks
File and Printer Sharing
Name of the network card
TCP/IP Properties of network card


Seems to me it is a DNS problem.  You could rule out the WSOCK.dll problem by doing the following:

Clear your temporary internet cache before doing this.
Open up a browser and instead of typing www.google.com in the address bar...

type: http://64.233.167.104 (google)
http://207.68.173.254 (MSN)

If you can get to those sites then the WSOCK.dll is not a problem.  It boils back down to DNS.  If you can't get to those sites, then you have the .dll issue.
0
 
LVL 1

Expert Comment

by:SithLoaded
ID: 12096008
If it is the .dll software, I would point it to the road runner software.  Most people that have internet problems with cable modems are having problems, because they hooked up the modem with the USB cable and installed the software to make it work or installed the software (not needed) when using the ethernet cable.
0
 

Author Comment

by:hrogers
ID: 12102363
I may have installed the RR software when I first got it because I did not have the Router, extra computer and no need for a network. It may have been hooked up by USB but then switched to the Eternet cable.

It configured as Cable from wall to Cable modem. Ethernet cable from Cable MOdem to router. net work cables from router to the two computers. Is thre a difference between the types of cables? I have not changed any of this before it stopped working

I tried those ip addresses on the address bar but nothing happened.

On the command line I could ping 64.233.167.104 but 207.68.173.254 timed out.

I see a few answers back mention of removing the RR software and the Cable modem software?

I have not done this yet, but remember, it was working Last MOnday even with that installed. The machine does not have to know about RR or the cable modem if it's hooked to a router?

0
 

Author Comment

by:hrogers
ID: 12103103
A note about the network cards:

I re-installed the old card I had and I could still share files and printers. I ran the diag. that comes with it and it failed. I re-installed the new card and it failed it's own LOOPBACK test.

Does this mean the NEW card it bad too? what are the chances of that happening?

This is weird even though with the old card the file and printer sharing work OK but with the new card you only see the current machines shared things not the other comuters. This is bugging me.

How can the old card work with sharing but fail it's own test?

When I brought the new card I looked for 10/100 lan card. The one I got is 10/100 MPS PCI adapter, made by D-link DFE-530TX+

The old card is a Linksys 10/100 Lan card LNE100TX. The router brand is also Linksys....does that matter?
0
 
LVL 1

Accepted Solution

by:
SithLoaded earned 245 total points
ID: 12108811
I would uninstall the Road Runner software.  This could be causing the all of a sudden DNS problems.  I guarantee anyone that is having the WSOCK.dll error problem has their cable modem connected via USB.  I have never heard of that being an issue with ethernet connected devices.

The cables don't have much to do with the situation, unless for some reason you have the modem hooked up via ethernet and USB at the same time.  That's the only time I could see that being the cables, unless the cables were bad.  In that case nothing would work for that device.

As far as the problem just "appearing", I would blame software in those cases.  It is either in the router (very unlikely....you would have to do some configuration to block DNS resolves), the software (road runner) on the PC, or it could possibly be something with the IP configuration.

On the last note, to eliminate the possibility of bad IP addressing or DHCP problems.
I would statically set the following:

IP address:
Subnet mask:
Default Gateway (inside interface of the router):

DNS server: (make this the inside interface of the router)(the configuration in the router should allow you to use the router as a DNS forwarder)(it should be set with the DNS servers from your ISP)


Try that and let me know.
0
 

Author Comment

by:hrogers
ID: 12111268
Oddly enough when I installed Mcaffee internet security software everything works! It found at least 10 files that where autodialers or spyware. I deleted them all. THe only remaining problem is Outllook. The internet works fine, but out gets error from the POP3 server.
0
 
LVL 8

Expert Comment

by:natcom
ID: 12114054
can be any of this

Your connection to your ISP has timed out or been disconnected.
You have ZoneAlarm and the "pass lock" feature is enabled.
You have a firewall program that is blocking access to Outlook Express.
Your email settings in Outlook Express are not configured correctly.
If the error message happens infrequently when sending or receiving email, then the problem can be caused by an email with a large attachment that takes a long time to scan--causing the connection to time out.

or your antivirus program e-mail settings
0

Featured Post

How your wiki can always stay up-to-date

Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
- Increase transparency
- Onboard new hires faster
- Access from mobile/offline

Join & Write a Comment

Introduction Often we come across situations wherein our batch files would be needing to reboot Windows for a variety of reasons. A few of them would be like: (1) Setup files have been updated whose changes can take effect only after a reboot …
Windows 7 does not have the best desktop search built in. This is something Windows 7 users have struggled with. You type something in, and your search results don’t always match what you are looking for, or it doesn’t actually work at all. There ar…
Illustrator's Shape Builder tool will let you combine shapes visually and interactively. This video shows the Mac version, but the tool works the same way in Windows. To follow along with this video, you can draw your own shapes or download the file…
Here's a very brief overview of the methods PRTG Network Monitor (https://www.paessler.com/prtg) offers for monitoring bandwidth, to help you decide which methods you´d like to investigate in more detail.  The methods are covered in more detail in o…

760 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

18 Experts available now in Live!

Get 1:1 Help Now