Outbound port 80 blocked on XP box

**golfcart** · January 30th, 2009, 01:30 AM

Hi All!

I'm having some trouble with a relatives computer. It's windows XP connected to a DSL modem via ethernet. It seems port 80 is completely blocked.

The computer has a valid IP (192.168.1.*)
DNS is fine. I can ping any site by IP and name.
Email works fine.
FTP works fine.

Both IE and FF cannot access any pages on port 80. I didn't try any ssl (443) pages yet. I cannot connect to the modem via a web browser either so I suspect it is the computer and nothing upstream. Normally http://192.168.1.1 would bring up the modem's interface.

I had a few tools on my flash drive to try:

Hijackthis came up clean.
I used LSPFix to remove all entries (even though none were abnormal).
I used winsockxpfix to replace the tcp/ip stack.

I also reset all web settings and disabled the windows firewall. There is no other firewall installed. I disabled the antivirus (AVG Free). I tried a few other things and so far nothing has worked.

I'm at a loss for ideas and would rather not reinstall the OS. If anybody has any tricks up their sleeve, or has seen this happen recently, please let me know. I've been out of the loop with all the adware/spyware/virus stuff for a while, but the computer is showing no signs of infection besides the broken port 80. There are no strange processes running or anything of that nature.

**GroundZero3** · January 30th, 2009, 05:29 AM

It having a 192.168.1.* means its behind a router.

Did this just start out of the blue and this is why you are loooking at it or was there another reason why you were looking at it?

**golfcart** · January 31st, 2009, 12:32 AM

Originally Posted by GroundZero3

It having a 192.168.1.* means its behind a router.

There is not a router in the sense of a separate device. I guess you could call the DSL modem a gateway/router since it does do NAT.

I'm looking at the problem as if it came out of the blue. The internet worked one day, and the next day it didn't. Nobody is fessing up to doing anything nor are they really savvy enough to properly describe what may have happened. If I had a little bit of a clue as to what happened, I'm sure I could fix it, but I'm going into it blind. All I know for a fact is what I listed earlier. I'm going back over there tomorrow to tinker with it. I ill post back with any new details I discover.

**EXreaction** · January 31st, 2009, 12:50 AM

Have you/can you try a different computer on it?

Have you tried resetting the modem?

**wwatson** · April 20th, 2009, 02:48 AM

I'm having exactly the same problem... 1 laptop cannot connect out on port 80, a second laptop is fine, as is a PC connected directly to a Wireless router with an ethernet cable (both laptops connect wirelessly). The laptop with the problem can ping, port 443 is fine, MSN Messenger is fine, it's just port 80 with the problem...

**RSinger** · August 20th, 2009, 02:28 PM

I to am having the same problem with a laptop at my work. I have tried reseting the TCP\IP Protocol. I have run numerous scans on it. It took off several Trojans and spy/malware. Now my scans come up clean but cannot get out on port 80. I can get out in Safe Mode though. I cannot find any running processes that look out of the ordinary. One of them must be infected though, that's the only explanation I can think of.

The programs i have run are:
AVG Free
Ad-aware
Malwarebytes

**hvogeler** · September 1st, 2009, 01:42 PM

All ports except port 80 work. other computers on the same network work on port 80. Even if I try different connections with the laptop the problem persists. No matter wether I connect thru network cable, wireless or UMTS. Always only http on port 80 is blocked. 443 works and all other ports work.

**GroundZero3** · September 1st, 2009, 02:02 PM

Some network information would be helpful

Do you have the windows firewall enabled or some third party firewall installed?

**RSinger** · September 1st, 2009, 02:10 PM

I was able to fix the problem by running ComboFix. The virus that was blocking the port was able to be removed using this. You shouldn't take any files off unless you have someone who is familiar with the safe files the program can sometimes find look over the log first.

**wwatson** · September 1st, 2009, 04:02 PM

I eventually discovered that it was the Microsoft Family Filter (? this was a while ago now, I think that's what it was called) blocking all connections because it hadn't been updated for a certain length of time. Installing the Microsoft updates to this software fixed the problem...

**hvogeler** · September 2nd, 2009, 03:08 AM

I think the problem is solved. In another forum I found a hint at vsdatant.sys. This is a service that beloings to ZoneAlarm but gets installed by other software as well. I use the Cisco VPN client that seems to install vsdatant.sys. Setting the registry key /HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Services/vsdatant/Start from 2 to 3 seems to solve the problem.
I have the VPN client on my system for years. Why vsdatant.sys changed its behaviour remains a mystery to me.