Help - Search - Members - Calendar
Full Version: DHCP releasing and renewing every 25 seconds
Gladiator Security Forum > Malware Help Forum > HELP! Think you are Infected?
oneskywalker
My friend has the same problem described in Carrieant's Gladiator post back on Jun 11 2005. Every 24 or 25 seconds, his loses computer loses its connection to the Internet. The connection comes back up in 4 or 5 seconds. Very irritating. I just spent eight hours and $15 figuring out why this is happening. I am now royally pissed!!! :furious: I was unable to find a solution to the problem anywhere on the Internet. I found several postings (such as Carrieant's) by people who encountered the problem years ago but were unable to solve it.

My friend is running Windows XP on a Dell Dimension 4700 connected to the Internet using a Linksys router which is connected to a Comcast cable modem. The Linksys router has wireless, but my friend was connected via an Ethernet cable to an integrated Intel® PRO/100 VE Ethernet adapter. I say "was" because, thinking there might be a hardware problem with his Ethernet adapter, I bought a new D-Link DFE-530TX+ PCI Fast Ethernet Adapter for $15 and installed it. No joy. crying.gif

Another friend helped my friend install the Linksys router about a month ago. The friend who installed the Linksys also configured the integrated Ethernet adapter for DHCP, which worked fine at the time. The problem with the Internet connection started a few weeks after that, out of the blue. My friend says everything worked fine for a few weeks, then boom! :(

Like Carrieant, after trying a million other things, I finally used Alt-Ctrl-Del to start Windows Task Manager and watched the Processes tab for a while. I noticed that IPCONFIG.EXE ran each time the connection went down. I knew I wasn't running it. uhm.gif

I tried renaming C:\WINDOWS\SYSTEM32\IPCONFIG.EXE to MYCONFIG.EXE, but a new ipconfig.exe magically reappeared in the directory. Sigh. I yearned to know what process was invoking IPCONFIG.EXE. I tried using WMIC to capture a list of all processes when IPCONFIG.EXE was running, but couldn't find WMIC on my friend's computer. Double sigh. He no longer has the Microsoft Windows XP CDs he had when he set the computer up several years ago. Triple sigh. I downloaded PsTools and was able to use pslist -t to capture the process tree when IPCONFIG.EXE was running. winner_first.gif

I discovered that IPCONFIG.EXE was being launched by 2PORTALMON.EXE. I used the Windows Task Manager Processes tab to kill the 2PORTALMON.EXE. The Internet connection quit failing and stayed up solid. Hallelujah! guy_dancin.gif

Some Googling revealed that 2PORTALMON.EXE is a component of 2Wire, but I couldn't find anything suggesting how to get that piece of garbage off my friend's system. It seems to have been installed when a 2Wire 802.11g USB Wireless LAN Card was installed, whatever the heck that is. There are no USB devices connected to his system right now.

When Googling, I get lots of hits on 2Wire because it is one of the things listed by hijackthis.

I wonder how many other people are irritated by this problem as I type this? :furious:
LoPhatPhuud
Try connecting the computer directly to the modem and bypass the router. Then see what happens.
oneskywalker
Hi, LoPhatPhuud. Thanks for the suggestion to connect directly to the cable modem. That was one of the million other things I tried before I figured out that the probem goes away once the 2PORTALMON.EXE process is killed.

BTW, my wife Judi has been trading notes with a 2Wire customer support person, who has been remarkably unhelpful up to now. I don't believe he understands the problem yet. Not sure he ever will. (:-)
LoPhatPhuud
Lack of adequate support is becoming a major problem for a lot of software companies, the smaller ones especially. Most support staffs are overhead and a drain on expenses with little, if any return.

I'll consider this issue as closed for the time being, but please post back if other issues arise.
This is a "lo-fi" version of our main content. To view the full version with more information, formatting and images, please click here.
Invision Power Board © 2001-2009 Invision Power Services, Inc.