RE: tcp/ip problem
- From: Norman <Norman@xxxxxxxxxxxxxxxxxxxxxxxxx>
- Date: Fri, 7 Oct 2005 23:23:01 -0700
"wyocowboy" wrote:
> I've read through the posts that show up in google - groups but nothing
> suggested has worked for this customer's machine, so here goes...
>
> Original Symptoms: XP Home SP2 machine that had been working cannot get to
> the internet. There is no s/w firewall installed, and it is connected to the
> internet via DSL, going through a linksys router. Other machines thus
> connected can get to the internet ok, but this one can't. The machine pauses
> after selecting user logon and task manager shows that only part of the
> startup processes are loaded. Several minutes later, the rest of them load.
> Norton AV then displays two successive mostly-blank error dialog referencing
> email scanning proxy on boot up. The latter looks to be a symptom, not the
> problem.
>
> Msconfig showed services.exe being loaded from c:\windows\connectionstatus\
> and this turns out to be a variant of W32Sober, so I removed it manually and
> using the Symantec removal tool. There was another fishy item in msconfig, a
> service named nipientd (no hits on google). In the services applet, the path
> to the executable is blank and nothing is found when using xp search to look
> for nipientd on C: with system/hidden folders included. There are a few
> references to it in the registry as legacy_nipientd, but no indication what
> the executable is. Since the service is disabled and has stayed so, I don't
> consider it part of the remaining problem, although it might have been a
> cause.
>
> If the machine is aquiring an IP address when booting up, it can't be
> displayed. Ipconfig returns "internal error occurred: the request is not
> supported. unable to query host name." A ping attempt returns "error 2." I
> followed the procedure described in kb811259 of deleting the winsock and
> winsock2 keys in the registry and reinstalling tcp/ip by using "have disk"
> and pointing it to \windows\inf directory. No help. Tried a second ethernet
> NIC, no help.
>
> One odd thing that happens during the reinstall of ms tcp/ip is that I get a
> "driver not digitally signed" warning. I have reinstalled ip on several other
> machines and have never seen that.
>
> lspfix.exe (from cexx.org) shows only two of the three network protocol
> handlers present: mswsock.dll and winrnr.dll. rsvpsp.dll is not listed,
> although it is in \system32 along with the others, and all are shown to be
> Microsoft files. System Information only shows two entries in Components -
> Network - Protocol. The two entries listed are MSAFD TCP [tcp/ip] and MSAFD
> TCP [udp/ip]. According to kb811259, there should be 10 entries listed here
> (e.g. rsvp, et al), and if there are less, the winsock2 key is corrupted.
>
> The problem is that deleting the winsock keys and going through the tcp/ip
> reinstall procedure in kb811259 does not correct the problem. A poster in one
> of the hits on google said that he had tried a repair reinstall and it had
> not corrected the problem, although I don't know that he was having the same
> problem (I searched on "unable to query host name"). This makes me wonder if
> the inf or pnf file is corrupted or was replaced by malware.
>
> Since networking and inf files are not protected by system file protection,
> I didn't expect sfc /scannow to find anything, and it didn't. I was unable to
> bring the machine back to the shop because they were running end-of-month
> financials, so I will be visiting with them on Monday. The next thing I am
> going to try is to replace the appropriate inf files and delete the matching
> pnf files before reinstalling tcp/ip.
>
> Anyone else have a more definitive solution?
>
>
>
>
>
>
>
>
>
.
- Prev by Date: Re: Check disk problem
- Next by Date: Re: Cannot change firewall settings
- Previous by thread: Re: Check disk problem
- Next by thread: Re: Cannot change firewall settings
- Index(es):
Relevant Pages
|
Loading
