Uninstalling VPN Client vers 4.8.01.300 leaves IP stack hosed

pequod2307 · ‎02-13-2008

I had the ciscovpn client vers 4.8.01.300 installed on a Windows XP SP1 computer. Uninstalling VPN Cliemt left my IP stack hosed. After uninstalling the vpn client, I could not:

1. ping the computer from other LAN computers

2. access shared resources on the computer from LAN computers

3. access LAN resources using Netbios names - including map drives, etc..

4. use browser to access websites - trusted and secure as well as "ordinary" ... they'd all time-out

----------

I tried reinstalling the IP stack and winsockets using MS's instructions for Windows XP SP1 - it didn't work and changed nothing.

-----------

Further note: IF I reinstall the vpn client, activate a connection to the vpn concetrator it had been using, then diconnect and turn off the Cisco VPN Service, the computer behaves normally; uninstalling the VPN client at this point produced the same results - the computer wouldn't really conect to LAN resources or allow connections from elsewhere on the LAN.

The machine behaves as if the firewall installed by the VPN Client was left behind and turned on.

-----------

Any clues on how to fix so I can uninstall the vpnclient and have normal operation on the LAN and Internet connectivity.

htarra · ‎02-19-2008

Before you install a new version of the VPN client for Windows, you must first uninstall any earlier versions of the VPN client, and reboot your computer.

http://www.cisco.com/en/US/docs/security/vpn5000/client/windows_mac/client52/user/guide/appA.html#wp997996

pequod2307 · ‎02-19-2008

That does not addressmy issue. I did indeed uninstall the vpn client via add/remove. after I did so, the following is the situation:

1. I cannot use browser to browse websites

2. I cannot connect to resources on my lan via netbios names

3. Other lan computers cannot "see" or ping my computer

4. Re-installing tcp/ip didn't change anything.

How do I fix this?

vyperjohn · ‎02-23-2008

I have had the same experience with XP and VPN 4.8.01.0300 upgrading to 5.0.01.0600. After uninstalling 4.8 and a reboot I can browse for about 10 minutes and the HTTP function stops. VPN and HTTPS are fine. I tried every commandLine trick in the book to restore the TCP stack. The only fix I have found is to roll back to a recient 'restore point' prioy to the removal of 4.8 . I know that this works as I have cycled through the removal of 4.8 and install of 5.0.01.0600 three times now and have to rool back to a point in the HIVE that has 4.8 still installed. I guess the I will not update to 5.0 as it is too much trouble, when the removal of 4.8 causes HTTP to lockup.

pequod2307 · ‎02-28-2008

Maybe we have a clue ...

>> After uninstalling 4.8 and a reboot I can browse for about 10 minutes and the HTTP function stops. <<

This shuld be a clue as to what is happening and maybe a clue on how to fix ... What would cause the HTTP function to stop working? How would we do this manually? Is something hosing up port 80? Question: can you run FTP at command prompt or in the browser using the FTP://xxxxx.xxxxx.xxxxx form after the HTTP function quits?

jkeeffe · ‎02-28-2008

I had this EXACT same issue a couple of months ago with WinXP SP2, where after about a couple minutes port 80 traffic quit working. I could get e-mail, do Citrix, fire up my Cisco VPN client and connect to work. I don't know if this trouble had anything to do with the Cisco VPN client because I don't remember if I uninstalled it or upgraded it.

Anyway I ran Wireshark (you should try this and confirm my results) What I found out was when port 80 quit working, my IP stack started sourcing packets using the IP address of the last web site I had connected to. Here was a typical sequence assuming my local DHCP address is 192.168.1.2

1. browse to Cisco.com -(it works) source IP 192.168.1.2

2. browse to Yahoo.com -(it works) source IP 192.168.1.2

3. browse to microsoft.com -(it works) source IP 192.168.1.2

4. browse to another page on microsoft.com - (DOESN'T WORK!!) source IP 207.46.232.182 (microsoft's IP address)

5. ping yahoo.com - (it works) source IP 192.168.1.2

6. browse to cnn.com - (DOESN'T WORK!!) source IP 207.46.232.182 (microsoft's IP address)

7. get e-mail via smtp - (it works) source IP 192.168.1.2

8. Cisco VPN into work - (it works)

Only a re-boot will clear this up and then only for a couple of minutes. I put in a new ethernet NIC thinking the stack was corrupted but the same problem occurred. I called a local radio computer talk show and the guy said this sounded like a very particular kind of malware that was written specifically to hack port 80 traffic. My antivirus picked up nothing strange.

I ended up having to wipe the drive and re-install the OS. I still don't know what the cause was, but it sure was baffling especially when using a different brand of NIC and the problem was still there.