That's the expected behavior if a firewall restricting unsolicited inbound traffic were enabled. Perhaps Dell's shipping images with the XP firewall enabled. That's a good default, and will become the norm once SP2 is included. To disable XP's firewall,  see this article. But don't connect directly to the Internet without firewall protection.

Jim

Even more data to take into account...

So I'm connected remotely to this computer via winVNC... the DELL computer was booted into safemode and is running winNVC server.

I issued ping -t 69.81...etc from my local machine to the remote DELL machine.

I was getting replies back.

I then rebooted the remote computer.

The replies started to not respond... (ie. the booting process -- normal mode).

Then for about 6 packets the computer came up and I could ping it.  However, then it went started to reject my ping packets.

Does that shed any new light????

Do you know if XP's firewall is turned off when you boot into SAFE MODE w/ NETWORKING?  I only have access to this computer via winVNC and when I booted it into SAFE MODE I already check that option and it was unchecked (or no firewall enabled). 

I didn't know that it was disabled in Safe Mode...but then, prior to SP2, the firewall has to be enabled in the distributed image, because it's not enabled in the MS distribution!

Given all the symptoms (VNC only in safe mode, ping only in safe mode), I'd say it's off - but that's based on your data.

Jim

The only time I've ever encountered a symptom like that, the culprit was a VPN client - Symantec's ("Raptor"'s successor), if I recall correctly. It was firewalling the machine regardless of the VPN client settings, and had to be uninstalled before things got sane. Is there anything like that installed?

Jim

I wish there was some program like that, then it would be obvious... but there isn't.

I even got down to the level of looking in the registry... RUN folder and looked for suspicious program loading.  The only (and I checked every entry) thing that looked like it could be a culprit is DSENTRY.EXE.  However, I removed that key and moved the .exe to another folder.

Still didn't work...

It actually took quite a while to find out that the VPN client was firewalling the machine at startup, without the user's knowledge and without the VPN client autostarting.

There's an enumeration of what starts in the two "safe modes" in HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal or \Network. I looked at mine, and both lists are mindbogglingly long. Since the culprit is probably a late-starting service, based on what you've eliminated so far, I wonder if it leaves any tracks in the event logs?

(edit) I wonder if comparing the output produced by HijackThis when running in safe/network mode and normal mode might enable the process that's causing the symptom to be spotted.

Jim

Message Edited by jimw on 05-14-2004 09:07 AM