Windows Forum

Ask something
Discussion Locked

Network Hijacked??

0 helpful
15 replies

by regulus

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

I have a small in-house peer-to peer network using Earthlink DSL, Speedstream Dsl Modem, and Linksys DSL router. I have two 'serious' machines running win XP Pro, fully updated XP, Norton Antivirus & Zone Alarm Pro firewall. Others are 'sandboxes' and not routinely running on the net.
ISSUE: Machine #2 cannot connect to internet / p2p net. Zone Alarm reports 'New Network' with new IP of 169.254.16.227. Attempts to delete the New Network from Zone Alarm give Message 'Cannot delete active Server'. All attempts to reinstall p2p net fail. CAnnot ping out or in. Restoring to previous date ineffective. Unit apparently in server mode - will not interact with p2p.
NEXT: Machine #1 begins the same routine. SVChost attempts contact with 239.255.255.250, port 1900 on completion of boot. (I have net cable pulled). ZA Firewall 'Zones' completely empty. If I boot with net plugged in, I get 'New Network' at address 169.254.x.x, with 'x' being new numbers indicating possible DHCP assignment.
Shutting down 'Server' under services removes the pressence of the net, but then p2p still cannot be re instituted.
I have examined all start-ups in MSconfig etc and can find no program that could accont for start up in 'server' mode.
I do not wish to use Amnerica's (amost) biggest computer dealer's standard cure all of FFR (fdisk, format & restore)
I have been into Network Options and rebuilt p2p numerous times with no result.
Yes, I have run SFC.
Yes, I have MS Messenger svc fully shut down.
How do I shut down the invisible 'rogue' server and get back to p2p???
How do I shut down

15 replies

by jschein

Had a fellow admin get the same problem...

Hijacks are hard to track down manually, however, used www.lavasoftusa.com 's free adaware program (download to a cd along with updated Reg. file).

This program, after updated, will remove the hijack. After scan and removal is complete, reboot. Should be good to go.

Good luck

by beermonster

Hi,
Don't know if this will help, but the 169.254 addesses you are seeing are consistent with XP autocinfiguring an IP address. If the OS starts and is unable to get an addy from dhcp and one isn't specified then it will generate a random address in the 169.254 range and use that. running ipconfig /all will tell you whether or not the address in use is autoconfig'd or not. Autoconfiguration = yes means that autoconfig is switched on, whereas (and I'm going from memory) if an autoconfig'd address is actually in use you'lss see something by the IP address saying so.

by regulus

Poster rated this answer.
Beer Monster, You got me the clue by which I was able to resolve the dilemna(sp?). Although my hardware 'seemed' to be working perfectly, your answer indicated that the results that I was showing indicated that I had an issue. Final resolution was disconnect and reset Router and DSL Modem, reinstall. Restart and go through the setup Net routine again. Yes, memyslfni1969@sbcglobal.net, I did this dozens of times. Then, after that, (still no connection) bring up the routers setup through IE and re-setup the router. Everything worked immediately!!! Strange thing was that I had one sandbox computer that always worked. It was running XP Home instead of XP Pro. But, if the router worked on one port and the others were not physically defective, the other ports 'should' have worked also. In this wierd case, the re-run of the router set up program shook the other ports back into action - or did they? I definately tried port swapping with no results!! I also have absolutely no idea about what initiated this issue. No results from Norton, Adaware, Pest Patrol or anything else pointed to any possible culprit. I thank all of you for your assistance. It is deeply appreciated
REGULUS

by regulus

To above: jschein@mailcity.com

Thank you for response. Yes I tried updated Adaware and Pest Patrol, not effective.

Regulus

by regulus

to above: BeerMonster

Yes, that appears to be exactly my issue. But my problem is that I can't force the unit out of server / network mode, back to p2p. Any suggestions?

by memyslfni1969

This is to long so heres part 1

What the other poster said re auto configuring is partly right

Here is some info found in WindowsXP help files

To configure an incoming connection to use TCP/IP
Open Network Connections.

Click Incoming Connections, and then, under Network Tasks, click Change settings of this connection.

On the Networking tab, click Internet Protocol (TCP/IP), and then click Properties.

If you want incoming users to be able to access the local area network on which the dial-up computer resides, select the Allow callers to access my local area network check box.
Do one of the following:

If you want to automatically assign TCP/IP addresses, click Assign TCP/IP addresses automatically using DHCP.

If you want to specify TCP/IP addresses, click Specify TCP/IP addresses, and do the following:
In From, type the starting IP address.
In To, type the ending IP address.

Based on the addresses you type in From and To, the number of addresses that are allocated is displayed in Total. The starting and ending IP addresses that you choose depend on the originating address space and the number of addresses needed. For more information on defining IP addresses for incoming connections, click Related Topics.

If you want incoming connections to be able to use a specific TCP/IP address, select the Allow calling computer to specify its own IP address check box.
Notes

End Part 1

by memyslfni1969

Part 2 The good Part :)

To open Network Connections, click Start, point to Settings, click Control Panel, and then double-click Network Connections.

Most TCP/IP networks use subnets in order to effectively manage routed IP addresses. The closest matching subnet is calculated for the range that you specified in From and To. The range of addresses in the closest matching subnet may exceed the range that you specified. Unless the addresses specified in From and To are subnet boundaries, the range based on the calculated subnet will be larger than the range that you specified. To avoid this, specify a range that falls on subnet boundaries. For example, if you are using the 10.0.0.0 private network ID for your intranet, a range that falls on subnet boundaries is 10.0.1.168 to 10.0.1.175. Or, if you are using the 192.168.0.0 private network ID for your intranet, a range that falls on subnet boundaries is 192.168.1.0 to 192.168.1.255.
Allowing remote clients to specify their own TCP/IP address is a potential security risk to your network. A client can impersonate a previously connected client and gain access to network resources that were accessed by the other client.

If you select Allow callers to access my local area network or Allow calling computer to specify its own IP address, these changes take effect immediately.

If you select Assign TCP/IP addresses automatically using DHCP, but there is no DHCP server available, random address from the range 169.254.0.1 to 169.254.255.254 are assigned.
Related Topics

This discussion is closed to new replies.