Solved Fixing Ethernet After BIS 2013 Encroachment

[Gnosis]

I installed BIS 2013. Within a few days I was sending packets but not receiving them. Status was "connected". I could ping 127.0.0.1, ping localhost, ping 192.168.1.1, etc., and get a response, but I could not receive packets, so I could not access the internet. I read of several other people that had this problem, though not all scenarios were after BIS installation. They tried everything under the sun and could not get their ethernet connection (via cable from tower to wireless router) to receive packets, yet, like my LAN, the satellite PC's were connecting. That is the first time I had ever seen my ethernet connection fail without and ISP service issue being the cause, so I knew it would be a bear (pain in the arse).

I tried a few tricks and kept utilizing restore points to backtrack and start over in the event my changes failed. TCP/IP automatic address acquisition would not work after resetting TCP/IP. It would kill the connection altogether. WinSock Fix would not work either. I shut down all BIS functions that I could. NO change. I then uninstalled BIS and then dove in head first without seeking any more similar scenarios via the internet. It was time to fly blind, which works really well sometimes, esp. in wireless and router hardwire connection ethernet issues, which there seems to be much ignorance out there pertinent to. (I am one of the ignorant ones, lol)

After BIS uninstall, no change. I brought Process Explorer in via my USB toolbox stick. I clicked the "services" tab and began to scroll like mad man until I saw "ethernet" in any given line item. The first item like that I came across was: KLSIENET; DRIVER FOR USB ETHERNET ADAPTOR--Status: stopped----Start Type: demand start;
I started that service, and then I stopped it. I got a BSOD immediately. I rebooted via the power supply, fired it back up, and WALLAH, I was online via my ethernet cable. I had to rename the wireless network, set a new password, redo MAC filtering, and reselect the wireless channel I needed to use. Then I was back in business, just like that.

I had to wrestle with one of the satellite PC's a little to get it reconnected, but that is typical on this network, though not all that common.

The only thing I can figure is that somehow BIS caused a MAC address discrepancy via some security protocol, which, as a result, would not let my hardwired PC receive packets. When I stopped and started that service spoken of above, it must have reset a service/function pertinent to the hardwired tower's MAC address. (basically, the router's MAC filtering rules were not able to--read/detect/confirm/deny--the hardwired PC's MAC address. imho)
(I have MAC's entered as to only allow certain devices to attach to this LAN)

Ok. It is time to poke fun at me now, so GO AHEAD.

Router is an outdated Linksys

 

[McLovin]

Might be time to update the router? First thing I would of jumped to would of been Bitdefender, uninstalled it if I had no internet, but MAC addresses are an essential part of security.

 

[Gnosis]

No doubt mate. The router is ancient. I think the latest firmware upgrade I available is over 2 years old. LOL
I was hoping, like you, that when I uninstalled BIS 2013 that my packets would start coming in, but as you saw, that was not the case.

I like specific MAC entries in the router for access because it keeps all those smart phone off my damn internet. It amazes how dumb people are with wireless internet: THEY DON'T HAVE SINCE ENOUGH TO LOCK OUT SMART PHONES. It makes no sense to not lock 'em out since cell towers are a dime a dozen around here. You would think that the ISP would encourage that as to improve PC/Laptop internet speeds via their service, but they are dumb arses too, I guess.

 

[Gnosis]

Something is really off.
You know the story..........A few days after BIS 2013 install, the ethernet was only sending packets, not receiving them, for the hardwired-to-tower PC.
Then I did the fix mentioned above and have used it several times with smoothness after and before reboots. Yesterday I tried to install CIS Free and it installed, but guess what??? I lost my incoming packets again, and could not get email or surf.

I did not even get my CIS icon on the task manager during install for some reason. The "widget" would pop up, and the shortcuts were there, but there was a red icon with an "x" on it where CIS's task manager icon should have been. I clicked, and clicked, and clicked, and right-clicked on CIS's shortcut, but it would not open. So I thought, "No problem. I will use a restore point." I did that and that particular PC would not surf or receive packets, AGAIN. All of the satellite PC's continued working flawlessly online, and otherwise.

So, like before, in my original post, I used Process Hacker and went to that--- KLSIENET realtek ethernet driver---line item and clicked to start, just like before, but this time it threw up a message that said it cannot be started and something about it not existing, or not being able to connect.

At that time the status was still that I was sending some packets (270, roughly) but not receiving any. So i began to look for other ethernet related services. Just up the list form KLSIENET, I saw one that said "IPInIP Tunnel Driver", so I stopped that one and started it, and guess what???!!!!! I got a BSOD AGAIN, rebooted, and surfing and email were back to normal. The only difference was that I did not have to rename my wireless connection, or re-enter any router settings this time.

What gives?

Did BIS corrupt my ethernet driver, thus making it unstable, or is the ethernet port going bad on the PC?

Just like BIS, CIS got really defiant when I tried to disconnect the firewall via the "widget". It would not let me do it. That is the first thing I do when I loose an internet connection, esp. at the hardwired tower.

This particular PC has been using the same router for several years and NEVER, EVER has had anything like this happen. It is ALWAYS online when the rest of the satellites go down, unless lightning strikes the wireless ISP's tower, etc.

 

[Littlebits]

Did you create a system restore point before installing BitDefender? if so can you restore your system?

More then likely you have a network boot driver still left over from uninstalling BitDefender and it is causing you problems.

Try running the BitDefender Removal Tool- http://www.bitdefender.com/support/how-to-uninstall-bitdefender-333.html

Download

Reboot your system and see if it is fixed.

Enjoy!!

 

[Gnosis]

Restore point has not helped in either incident.
Tried BitDefender uninstall when it happened the first time, and uninstall was deemed successful.
1st ethernet connectivity incident occurred two or three days after installing BitDefender IS 2013. I uninstalled BIS 2013 a couple of days after that, first with REVO Pro, and then with BitDefender uninstaller latest edition.

As stated above, I fixed the connectivity issue for the 2nd time. What I did not like about the scenario is that I could not fix the issue the second time the same way that I resolved it the first time. THat is what has me a little concerned, and stumpedl; UNPREDICTABILITY (pertinent to the solutions).

 

[Gnosis]

I checked errors via Event Viewer (system) for the last 30 days. The only trend that stuck out, and began when all this started, was:

"GZFLT FAILED TO LOAD"

 

[Littlebits]

gzflt.sys is a Bitdefender driver just as I suspected.

You will have to manually remove it with Device Manager.
Open Device Manager, click on View and select show hidden devices.

Move down to "Non-Plug and Play Drivers"

Look for any entries of BitDefender and gzflt and select uninstall.

Enjoy!!

 

[Gnosis]

Excellent support, Littlebits.
Thanks for the input.
I shall give it a try.

 

[Gnosis]

Followed your instructions;

I did not see it, nor did I see any BitDefender items.
The only thing that looked suspicious was the entry:

ASPI32!

I am going to run the BitDefender removal tool again, just for the heck of it.

If you don't mind, give me a link for the best one to use to remove BIS 2013 remnants.

 

[Littlebits]

Try running Process Hacker.
Go to the Services tab, look for BitDefender Gonzales (gzflt.sys).
When you find it, I'm not sure how it will be listed, right click and delete it.

Thanks.

 

[Gnosis]

I was successful in deleting it via Process Hacker II.

Listed as: "gzflt.sys"

Now I notice that my ethernet task manager icon, which consists of two little computer screens that light up to signify incoming and outgoing packets, has started acting normal. Now both of the little screens light up simultaneously instead of one before the other, or only one of 'em (sending packets, not receiving)

 

[Gnosis]

All is good now.
Just installed CIS 2013 Premium with no issues.
Thanks for bouncing ideas.

 

[Deleted member 178]

More & more BD is a piece of crap...

 

[Gnosis]

More & more BD is a piece of crap...

That is sad. I was really excited about them at one point.

 

[Ramblin]

Sad stories like this one is a good reason to stop using viruses, excuse me, I mean antiviruses.

Glad you are good now.

Bo

 

[Gnosis]

Sad stories like this one is a good reason to stop using viruses, excuse me, I mean antiviruses

LOL.
Can you say; GRAYWARE?! LOLOL

I would not call it malware, but it IS the WORST grayware I have ever dealt with. I actually got gun shy about AV's while dealing with the aftermath. lol
I thought that I might never download a suite again!

 

[Deleted member 178]

what is funnier, is that other vendors that using BD engine made their products better and more stable ^^

 

[jamescv7]

Bitdefender issues like this would remain as warning when isn't solved by its manufacturer.

So sometimes spending a money must used more than twice enough.

 

[Littlebits]

Left over boot drivers from uninstalled security products can cause more problems then an infection. BitDefender is not the only vendor to do this, but their removal tool should have deleted this gzflt.sys driver. I have had problems in the past with Norton, McAfee, Comodo, Avira, Outpost, PC Tools and others that left behind boot drivers.

It is more common for users who will continue to keep changing their security config, there is no telling how many left over boot drivers that will load and continue to cause problems until they are manually deleted.

Many times users are not aware of what is causing the problems and may think it is their newly installed security products. Left over boot drivers can cause your newly installed security products to appear to be very buggy.

This problem is a perfect example of what I was trying to explain in another post that I made and some of you said I was exaggerating.

I'm glad I was able to help Gnosis remember the Process Hacker trick next time you uninstall a security product. You may have to Google to find the names of the drivers for your uninstalled security products.

Good day.