TCPIP missing!

[TimButton]

Win XP Home SP3

Had on it “VirusRemover 2009” which is malware. It had removed a load of Services. Believe now completely gone: registry entries and program groups deleted by putting drive in another machine and virus checking too. Reapplied SP3, “sff / scannow” completes successfully, Registry Mechanic fixed a load of errors too.

When run “winmsd” under Components/ Network/ Protocol there are no “MSAFD TCPIP” entries, just load of “MSAFD NetBIOS” preceded by 2 “RSVP TCPIP” entries … on other machines I have first in list 2 “MSAFD TCPIP” entries … getting these 2 back would seem to be the solution I’m looking for.

Have run “Netsh in tip reset” & “Netsh winsock reset”

Also, under Device Manager, Show hidden devices, Non PnP drivers, the “TCP/IP Protocol Driver” had red “X” through so I uninstalled, restarted, didn’t show to start with but now back.

As if TCP/IP not installed.
Have copied, individually & manually, load of dll files to system32 folder, and load of sys files to drivers folder.

If anyone knows how to get back the 2 “MSAFD TCPIP” entries please enlighten me!

Thanks in advance!

Backup all your data

then perform a repair install

(Google for exact instructions if needed)

[TimButton]

Trying that now ...

Thanks for the swift reply.

Believe it or not, still same problem. Repair install ran right way through and I had to reactivate at end. Wouldn't get IP address so ran "winsh int ip reset" then "winsh winsock reset" & rebooted.

Still not getting an IP address from DHCP server: first of a few messages is "Event id 1004. The DHCP Client service is shutting down. The following error occurred: the system cannot find the file specified."

Wish I knew what file it was- have copied over ipnat.sys though was already right time-stamp & size. Still nfg.

Anyone know how to get "MSAFD TCPIP" onto a system once it's disappeared?

Thanks Gerry, the errors including "Simptcp" started after I added (to Windows add/remove) Simple TCPIP services, just to see if that helped or gave more errors. In the end I did give up, but that Technet article looks useful reference - thank you!

It would help if you posted complete copies of the Error reports.

You can access Event Viewer by selecting Start, Control Panel,
Administrative Tools, and Event Viewer.

A tip for posting copies of Error Reports! Right click on the Report in
the list and select Properties. In the window, which appears are three
buttons towards the top right of the window. The top one has an arrow
up, underneath is an arrow down and third is a button resembling two
pages. Click the button and close Event Viewer. It is not obvious but
this action places a copy of the report in your Clipboard. Now start
your message (email) and do a paste into the body of the message. Make
sure this is the first paste after exiting from Event Viewer.

[braindamage73]

Thanks for that- not noticed the "copy to clipboard button" before! 'scuse all the text but may be useful to have the lot ... fyi have used AVG when drive in another machine and it reckons it's clean. Cannot install on the problem machine. Installed Spybot ok though and it found and cleaned AntiSpywareMaster and App.FirewallBypass. Run since rebooting and it's showing clean. This was before running the repair install. Many thanks for the help, I can always reinstall from scratch but would be good to fix. Here's all the Event info:-

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 7c 27 00 00 |'..

Event Type: Warning
Event Source: SimpTcp
Event Category: None
Event ID: 10
Date: 17/05/2009
Time: 20:17:19
User: N/A
Computer: SID
Description:
The Simple TCP/IP Services could not find the UDP QOTD port. The UDP QOTD service was not started.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7026
Date: 17/05/2009
Time: 20:17:32
User: N/A
Computer: SID
Description:
The following boot-start or system-start driver(s) failed to load:
hotcore3
ohci1394
RCFOX

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Warning
Event Source: Tcpip
Event Category: None
Event ID: 4226
Date: 17/05/2009
Time: 20:44:28
User: N/A
Computer: SID
Description:
TCP/IP has reached the security limit imposed on the number of concurrent TCP connect attempts.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 00 00 00 00 01 00 54 00 ......T.
0008: 00 00 00 00 82 10 00 80 ....‚..€
0010: 01 00 00 00 00 00 00 00 ........
0018: 00 00 00 00 00 00 00 00 ........
0020: 00 00 00 00 00 00 00 00 ........

Running IPCONFIG in DOS window gives:
“An internal error occurred: The system cannot find the file specified.
Please contact Microsoft Product Support Services for further help.
Additional information: Unable to query host name.”

It might be a problem with WinSoc:
1. Go to microsoft.com and look for Microsoft Knowledge Database article 91509.
2. Go to Watchtower site and search for "Corrupted/Damaged TCP/IP stack.

Note: Internal TCP/IP fixes in XP are often hidden in the GUI (Graphical User Interface) and are therefore hard to get at. And when you do get to them the fixes don't often work, so I don't use them, except for a very limited number of things- and they have to be 'bad' things.

Before you tied anything did you runa good registry cleaner like System Mechanic?

I'd get rid of SP3 for now. Its a business download and lots of people have problems with it. Learn more about SP3 with a Google search.

Then there's tech $upport.

Many thanks to everyone for all the replies: yes, had used Registry Mechanic and Spybot and AVG before all else. I did start at the basics, and as I kept hitting dead-ends had to move to deeper problems, as well as getting a feel for where the problem lay. It has turned into a bit of a science project as I had some time and learnt things along the way. I think after around 9 hours (as you asked!) that it might be some quirk of or damage in the registry, and the time has come to admit defeat.

Additionally, this forum has impressed me with the speed, helpfulness and expertise of its contributors; I'll keep an eye out for any problems I might be able to help with and I expect might also need in future.

Thanks again to all ...

Hi Jose, have to say have now rebuilt ... would still be interested in reading round subject if you could post (just) the link again pls!

I have read a lot of this thread with interest but not much to
contribute, and then I thought about just sticking to something simple
- like ipconfig won't even work. That is pretty straightforward.

If you Google: ipconfig An internal error occurred: The system cannot
find the file specified.

You can follow past frustrations with this issue where it was
sometimes resolved without a reinstall and they have also tried a lot
of the good ideas you have tried and it didn't fix it, but they got it
eventually. Maybe you can be that lucky.

Your search will get several hits to read, but there is one I browsed
where there are at two people with the problem and differing solutions
were found. The people were kind enough to post back when they got it
fixed and how.

It appears to be quite a struggle, but you seem to have dexterity in
troubleshooting and should have no problem following these search
results, so I wish you luck. Surely you have checked the obvious -
malware, etc.

Here is one (1) such result:
Using Google on your events is also a good read.

Well, hopefully somone can come up with a solution that works.

If not, you will need to backup your data and reinstall Windows

My posts from yesterday got crunched as "quoted text" - I did have
some difficulty with them, but if you haven't already bitten the
bullet, I found a link that was good reading with similar problems
that were solved (after a long time).

You may find it faster and more reliable to back up your data, wipe the
drive, and start over.

How many hours have you spent on this so far?

It's likely that there are subtle registry problems that were caused by both
the maware and registry repair apps, and these types of problems are often
not addressed by repair installs.

What it comes down to is whether you are using the PC for some work, or as a
science project.

Tim

I appreciate you have reinstalled but I felt your sequence of Event
Viewer reports a challenge I could not ignore.

Event ID: 4311 is the error giving rise to the TCP/IP. The service is
dependent on two services:
AFD
and
NetBios over Tcp/IP
http://technet.microsoft.com/en-us/l.../bb727013.aspx
NetBios over Tcp/IP is in turn dependent on the Tci/IP Protocol Driver
and IPSEC driver.
http://www.blackviper.com/WinXP/Serv...er_Service.htm

Event ID: 7026
Event Source: Service Control Manager
Drivers failing to load

hotcore3.sys
Paragon Software
I cannot think of an obvious connection to the other problems.

ohci1394
openHCI port driver -Windows System file -this failure could be an
explanation for those errors coming from Event Source: SimpTcp

RCFOX
Sonicwall IPsec driver -Background VPN & Firewall Hardware - another
failure that could be an explanation for those errors coming from Event
Source: SimpTcp

Event ID: 1
Event Source: SimpTcp

http://technet.microsoft.com/en-us/l.../cc975041.aspx

The other Event Warnings from Event Source: SimpTcp are likely to mean
something similar.

Event ID: 4311
Event Source: NetBT
http://www.eventid.net/display.asp?e...=NetBT&phase=1

This might be an important problem to resolve.

Event Source: Dhcp
Event ID: 1004

This occured because the Service is dependent on the NetBT service which
failed.

[gerry]

I suspect that there are few reports about Simple TCP/IP services
because few use it. It is an obscure optional Windows sub-component of
Networking services. It is likely that few users even know of it's
existence. What problem did you think it might help resolve?
http://technet.microsoft.com/en-us/l.../cc725973.aspx

The link refers to Windows Server 2008. You have Windows XP Home Edition
I am not sure whether any of the Windows Server software can be used
with Home Edition?

[knownow]

I had this problem for over a week after ridding myself of an AVGT.exe virus (not to be confused with the AVG antivirus software), I almost gave up and reinstalled windows. But perseverance paid off. I tried every other solution that was given out there and none of it work. This is what I had to do.

1. I had to reboot in safe mode no networking and uninstall/delete my my network devices from the device manager, (control panel, system, hardward, device manager).

2. Reboot in safe mode no networking and reinstall my network devices, I have a dell so I used my dell network application. This added back my network drivers, but gave me yellow exclamations.

3. Not sure if this step is necessary, but I did a regedit find Winsock2 and renamed my Winsock to WinsockOLD and my Winsock2 to Winsock2OLD.

4. Reboot in safe mode no networking, I had to run a free program called Winsock Fix (VB_WinFix 1.2).

5. For good measure I also ran in command prompt (cmd.exe)
netsh int ip reset resetlog.txt

6. I also ran in command prompt (cmd.exe)
netsh winsock reset catalog

7. Now my network connection was set on "Acquiring IP Address...."

8. Then I went to control panel, Administrative Tools, Services, and started my DHCP Client.

9. Went back to CMD.exe (command prompt), typed: ipconfig

hey presto all my items had been assigned the problem was fixed.

=======================================================
1. By the way I got rid of my AVGT virus by finding the where the exe file was located. Opening task manager, and end process. Then quickly going back to the folder and deleting the folder and files (before it restarted).

2. Then I had to edit my registry (regedit) and deleted references to antivirusGT.exe and AVGT.ext (could also be antivirus GT.exe).

3. Becareful here if you have AVG antivirus, some of their references start with AVGT...