TCPIP Protocol Driver

[rockhoptec]

I ran into this the past week or so on a few XP machines. The process I have used is copying the netbt.sys from the dllcache to the drivers folder as mentioned above and also had to replace the registry associated with netbt. If interested I can attach the registry fix if anyone wants to take a look at it and see if it helps. I can upload it hear or if more professional PM me and I can send it to you directly.
Like I said I did the registry fix and replaced the netbt.sys rebooted and worked.

 

[SnoSalmon]

Have you tried to re-install SP3 in safe mode?

 

[Mr.Mike]

Well I spoke too soon! I'm having the same problem as OP and none of my methods have worked nor anything he suggested. GRRRR!!!

Maybe you should start a new post.

 

[Appleby]

I ran into this the past week or so on a few XP machines. The process I have used is copying the netbt.sys from the dllcache to the drivers folder as mentioned above and also had to replace the registry associated with netbt. If interested I can attach the registry fix if anyone wants to take a look at it and see if it helps. I can upload it hear or if more professional PM me and I can send it to you directly.
Like I said I did the registry fix and replaced the netbt.sys rebooted and worked.

Please post the registry fix if you can....I think that's what I need now and I'm not exactly sure how to do it?

Talked to customer and they are looking for an excuse to buy a new one anyway and told me to forget about. So it's probably a lost cause now, but I still want to fix it.

Oh and to whoever mentioned it, I did reinstall SP3 and it was of no help. Thanks though.

 

[rockhoptec]

I will upload the fix once I am back in the office today. Should have it uploaded by the end of the day.

 

[Appleby]

Thanks I really want to try it!

 

[cpaul123]

The other file that I had to replace/move was the ipsec.sys. I know how frustrating this one was...so I hope you find a resolution soon. I spent many hours tracking this one down.

 

[Appleby]

Anyone ever come up with a fix for this? I'll PAY for it. I've spent hours and hours on multiple machines, some with success, some with none. I've got another XP machine on the bench tonight with the same problem.

I've tried (I think) everything and I really don't want to have to do a reinstall. This is a business customer's machine and it's loaded with data and multiple GIS programs that would all have to be re-loaded. They are in dire need of this machine and I've already spent about 3 hours on it so far trying to get the internet connection back.

I've Googled and read until my eyes hurt. There are hundreds and hundreds of posts about this all over the net from the last 3 weeks and there seems to be no simple or even sure fire fix yet?

 

[FoolishTech]

Anyone ever come up with a fix for this? I'll PAY for it. I've spent hours and hours on multiple machines, some with success, some with none. I've got another XP machine on the bench tonight with the same problem.

I've tried (I think) everything and I really don't want to have to do a reinstall. This is a business customer's machine and it's loaded with data and multiple GIS programs that would all have to be re-loaded. They are in dire need of this machine and I've already spent about 3 hours on it so far trying to get the internet connection back.

I've Googled and read until my eyes hurt. There are hundreds and hundreds of posts about this all over the net from the last 3 weeks and there seems to be no simple or even sure fire fix yet?

The whole bit with these latest variants of the ZA rootkit amazes me. It seems to infect random drivers and registry entries. Some people fix the issue with success by importing one of several random reg entries for networking services (NetBT, AFD, TCPIP, IPsec, IPnat, etc.) and some fix it by file replacement (tcpip.sys, netbt.sys, etc. etc.)... Every time I run across a new infection point I try to add that to "Reset Networking Interfaces" inside D7, but the list keeps growing.

The only thing I can surmise is that your fix won't be the same for every machine, it'll be pretty random depending on the particular machine you're working with, I'm afraid.

But you may get a lot of mileage by applying all of these various .reg entries and file replacements on every machine.

Google not for the problem, but the solution. Search for the default registry entries that you can just import; .reg file downloads litter the internet...

Alternately you could export the known good keys from registry backups in \system volume information and reimport...

 

[cpaul123]

i agree with foolish...the fix maybe different from machine to machine...i tried a variety of fixes that didnt work. but for me when i saw that the tcpip services were not starting i went to another machine and verified that the specific files were in the correct folders. keep plugging away at it....you will get it appleby.