Computer Browser problem in XP

[alisonnic]

I have encountered a baffling problem with Windows networking.

The problem is occuring with a Gateway 4530GZ laptop running XP Home SP2. It's on a LAN with several other computers, all running XP Pro SP1. (A Win98 computer was recently removed from the LAN.) The LAN is connected to the Internet via a dialup 3COM LAN Modem. The LAN modem acts as the DHCP server. There is also a Linksys WiFi router acting as a wireless access point; DHCP in the router is disabled.

The Gateway laptop has been working perfectly on this LAN (and elsewhere) until about three days ago. Now it has lost the ability to access other shares on the LAN, and none of the other computers can access the Gateway's shared folders and files.

The Gateway's event log shows the following:

Event Type: Warning
Event Source: BROWSER
Event Category: None
Event ID: 8021
Date: 2/26/2005
Time: 8:50:08 PM
User: N/A
Computer: MY4330GZ
Description:
The browser was unable to retrieve a list of servers from the browser master \\ELAN on the network \Device\NetBT_Tcpip_{CB7900F1-F846-4752-B3D8-978932D34EE8}. The data is the error code.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 35 00 00 00 5...

Event Type: Error
Event Source: BROWSER
Event Category: None
Event ID: 8032
Date: 2/26/2005
Time: 8:52:08 PM
User: N/A
Computer: MY4330GZ
Description:
The browser service has failed to retrieve the backup list too many times on transport \Device\NetBT_Tcpip_{CB7900F1-F846-4752-B3D8-978932D34EE8}. The backup browser is stopping.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 35 00 00 00 5...


Running net view on the Gateway produces this:

System error 6118 has occurred.

The list of servers for this workgroup is not currently available


If the problem Gateway computer becomes the master browser, then it can get to its own files and it can the other computers (in View Workgroup Computers) but it can't get to their files or folders. All the other computers on the network lose their ability to browse and give the same errors that occur on the problem computer. If the problem Gateway is shut down, to force election of a new master browser, all the other computers recover and return to normal functioning.

I've found several articles which suggest that computer browser problems occur on Windows computers which are multihomed, and to turn off the computer browser on such computers, or disable one of the network interfaces.

The Gateway laptop does have two network interfaces (an RJ45 connection and a WiFi connection) but this has never been a problem before. Also there is only one subnet here, and I never have both interfaces connected at the same time.

Nevertheless, I've tried disabling the RJ45 and using only the WiFi connection. Then I disabled the WiFi connection and enabled the RJ45 connection. No effect. I've stopped and started the browser many times. Still nothing.

There is also a 1394 connection which shows up under Network Connections. I haven't touched this; Windows shows it having Client for Microsoft Networks, Filer and Printer, Sharing, and TCP/IP).

The problem Gateway has ZoneAlarm and Norton Anti-Virus, both up to date, and AV has Auto-Protect turned on. I've tried disabling both, but this didn't help either. Windows Firewall is turned off. I've scanned the entire hard drive with Trend Micro's Housecall and found no viruses.

Internet access (browsing and email via Firefox and Forte Agent, respectively) still work, and it's possible to ping all the other computers from the Gateway, and they can ping it. So the problem is not a physical connection issue, and TCP/IP seems to be working fine. It's confined to file (and print) sharing via Windows Networking.

One unusual thing occured immediately before this problem began occuring. I had taken the laptop to a WiFi hotspot at a local college, where I'd set ZoneAlarm to Internet (so that it would not respond to computer browsing, thus making it invisible to other computers). This was the first time I'd gone to this particular hotspot, though I'd done the same thing at a number of others in the recent past.

However, when I left the hotspot, rather than shutting the laptop down, I'd put it into hibernate mode, and then when I got home to the LAN, I restarted from hibernate mode. Thus the computer went to sleep in one WiFi network, which I rated Internet (ie browsing requests are blocked), and woke up in a different WiFi network, which I rated Trusted (ie browsing requests are allowed). This is something I've never done before (and I won't do again!)

I've perused ZoneAlarm's logs, and it's clear that it did block a number of browsing requests while at the college WiFi network, but it stopped all such blockages after that. So unless it's blocking but not logging its blocking activity, it would appear that ZoneAlarm is not the problem.

Hmm. Just tried running netdiag.exe -v and got this (excerpted from its log):

NetBT name test. . . . . . : Passed
NetBT_Tcpip_{B3F5372A-DC77-40FC-8F90-81029577320D}
LOTUS <00> UNIQUE REGISTERED
HOME <00> GROUP REGISTERED
LOTUS <20> UNIQUE REGISTERED
HOME <1E> GROUP REGISTERED
HOME <1D> UNIQUE REGISTERED
..__MSBROWSE__.<01> GROUP REGISTERED
[WARNING] At least one of the <00> 'WorkStation Service', <03> 'Messenger Service', <20> 'WINS' names is missing.

...and this:

NetBT name test. . . . . . . . . . : Passed
No NetBT scope defined
[WARNING] You don't have a single interface with the <00> 'WorkStation Service', <03> 'Messenger Service', <20> 'WINS' names defined.

I have been trying hard to resolve this problem for several days, and I'm baffled. Any suggestions would be very welcome!

[Archangel122184]

I can't say for sure, Master Browsers usually end up being a domain problem, but given that this is a recent occurance it is more likely it is some sort if malicious software.

Run hijack this and make sure you aren't running any new programs or services. If you have system restore enabled, I suggest that you restore the system to a date before this started happening.

[alisonnic]

Thanks for your response, Archangel.

Is "hijack this" a program? If so, where do I get it?

[alisonnic]

Ok, I located a page for hijack this here:

http://forums.majorgeeks.com/showthread.php?t=35407

I had already run some of the things they suggest, and after reading your post last night I also ran Ad-Aware SE and Spybot Search and Destroy. But they make some suggestions which make running these things more thorough (safe mode and adding some plug-ins) so I will probably do everything again, following their suggestions to the letter.

However, looking back over my own post, just now I decided to pursue a clue from the netdiag log excerpts I included at the end.

I found that the Messenger service was disabled, so I enabled and started it.

Voila! Now I could access the shared folders and files on another computer on the LAN!

However, the other computer didn't show up in View Network Computers (I accessed it via a Search), and net view showed only the local computer.

I decided to wait a few minutes to allow the master browser (probably the other computer at this point) to refresh the browser table.

However, after a few minutes, when I did a net view, I got the same old error, and I could no longer access the other computer.

I stopped and restarted the Messenger service, and then all seemed well again. I could see both computers in View Network Computers, and net view showed both computers.

However, after a few minutes (in which I left a Windows Explorer window open to some folders on the remote computer), when I tried to navigate back up to the View Network Computers page, I got the old error.

A net view still showed both computers, and opening a new instance of View Network Computers worked fine.

Any idea what might be happening? I know you (Archangel) suggested the problem is likely to be malware, but, as my brother pointed out, malware that interferes with networking wouldn't get very far or live very long.

Is it possible that the sequence I followed last week (boot, attach to the college's WiFi hotspot, designate it in ZoneAlarm as Internet zone, then hibernate and reawaken at home in a Trusted zone) could have inadvertently corrupted some setting somewhere?

If necessary, I'll follow the suggestions on the "hijack this" page, and if that fails I'll follow your other suggestion to go back to a system restore point from the day before I visited the college.

But before I tackle what looks to be hours of work (I'm on a dialup connection here, so downloading all the recommended stuff will take quite a while; getting and running Trend Micro's housecall took most of the night), I just want to make sure I'm not blindly taking off on a long journey to repair something that actually has a trivial fix.

Can anyone think of something that might be causing this situation, and if so, what I might need to do to fix it?

Thanks again for any advice and help you might offer!

[alisonnic]

A few more minutes have passed, and I've again lost access to the other computers on the LAN. Both net view and View Network Computers have returned to giving their previous errors. Stopping and restarting the Messenger service doesn't help

[Spider]

A quick change in regedit will take care of that.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\LanmanServer\Parameters\
LMannounce is set to default = 0
If set to 1, will make browser visible to LAN Manager clients and should stop your dropping.