How to recover a really dead Windows XP (SP2/SP3) TCP/IP stack
About this article
Author/source: Hublerb – Tech Support Guy
- Complete destruction and restoration of dead TCP/IP stack
- Recovery from fatal failure or partial or complete corruption of TCP/IP
Related error messages / occurances
- IP Driver Error Code 2.
- TCP/IP network transport is not installed error message from active sync.
- TCP/IP driver missing from devmgmt.msc showing hidden devices.
- Ipconfig produces immediate failure message.
- An Internal error occured: The request is not supported.
- Unable to query host name.
- The specified device instance handle does not correspond to a present device message regarding DHCP service in services.msc
- Net start tcpip >>> fails with system error 2, The system cannot find the file specified.
- Ping error: Unable to contact IP driver, error code 2.
- Repair Local Area Connection: Failed to query TCP/IP settings of the connection. Cannot proceed.
-TCP/IP Protocol Driver Service Failed To Start, system cannot find the file specified.
- The TCP/IP Protocol Driver service failed to start due to the following error:The system cannot find the file specified.
Failed repair methods
- Netsh int ip reset resetlog.txt >>> no effect
- Non-full reinstall of TCP/IP using only the have disk method. >>> no effect
- Netsh Winsock reset >>> no effect
- Winsockxpfix >>> no effect
- Reinstalling network card >>> no effect
Solutions
Repair install
1. Insert and boot from your WindowsXP CD
2. At the second R=Repair option, press the R key
3. This will start the repair
4. Press F8 for I Agree at the Licensing Agreement
5. Press R when the directory where WindowsXP is installed is shown. Typically this is C:\WINDOWS
6. It will then check the C: drive and start copying files
7. It will automatically reboot when needed. Keep the CD in the drive.
8. You will then see the graphic part of the repair that is like during a normal install of XP (Collecting Information, Dynamic Update, Preparing Installation, Installing Windows, Finalizing Installation)
9. When prompted, click on the Next button
10. When prompted, enter your XP key
11. Normally you will want to keep the same Workgroup or Domain name
12. The computer will reboot
13. Then you will have the same screens as a normal XP Install
14. Activate if you want (usually a good idea)
15. Register if you want (but not necessary)
16. Finish
Hardcore method when nothing else is working
Step #1
1. Locate the Nettcpip.inf file in %winroot%\inf, and then open the file in Notepad.
2. Locate the [MS_TCPIP.PrimaryInstall] section.
3. Edit the Characteristics = 0xa0 entry and replace 0xa0 with 0×80.
4. Save the file, and then exit Notepad.
5. In Control Panel, double-click Network Connections, right-click Local Area Connection, and then select Properties.
6. On the General tab, click Install, select Protocol, and then click Add.
7. In the Select Network Protocols window, click Have Disk.
8. In the Copy manufacturer’s files from: text box, type c:\windows\inf, and then click OK.
9. Select Internet Protocol (TCP/IP), and then click OK.
Note This step will return you to the Local Area Connection Properties screen, but now the Uninstall button is available.
10. Select Internet Protocol (TCP/IP), click Uninstall, and then click Yes.
11. Restart
Succesfull uninstallation of TCP/IP will remove numerous keys from the registry including:
HKLM/system/CurrentControlSet/services/tcpip
HKLM/system/CurrentControlSet/services/dhcp
HKLM/system/CurrentControlSet/services/dnscache
HKLM/system/CurrentControlSet/services/ipsec
HKLM/system/CurrentControlSet/services/policyagent
HKLM/system/CurrentControlSet/services/atmarpc
HKLM/system/CurrentControlSet/services/nla
These represent various interconnected and interdependant services.
For good measure you should delete the following keys before reinstalling TCP/IP in step #2:
HKLM/system/CurrentControlSet/services/winsock
HKLM/system/CurrentControlSet/services/winsock2
Step #2
Reinstall of TCP/IP
Following the above substep #3, replace the 0×80 back to 0xa0, this will eliminate the related “unsigned driver” error that was encountered during the uninstallation phase.
Return to “local area connection”> properties > general tab > install > Protocol > TCP/IP
You may receive an “Extended Error” failure upon trying to reinstall the TCP/IP, this is related to the installer sub-system conflicting with the security database status.
To check the integrity of the security database
esentutl /g c:\windows\security\Database\secedit.sdb
There may be a message saying database is out of date
First try the recovery option
esentutl /r c:\windows\security\Database\secedit.sdb
If this don’t work for you, you needthe repair option
esentutl /p c:\windows\security\Database\secedit.sdb
Rerun the /g option to ensure that integrity is good and database is up to date.
Now return to the “local area network setup”
Choose install > protocol > TCP/IP and try again
Reboot.
Author / Source: Hublerb – Tech Support Guy
81 Comments »
Leave a Reply
Introduction
__________________________________________
Text from the song Spark by Amy Macdonald
I am the light in the dark
I am the march
I am the spark
Just dry your tears and I’ll be there
Don’t live for anger all this pain
Don’t worry, I’m ok, I’m ok now
Always in our hearts – R.I.P. Donna Buenaventura
__________________________________________
.
Welcome to Smokey’s Security Weblog!
Let’s introduce myself: my (nick)name is Smokey aka Smokey Bear.
Like my board Smokey’s Security Forums, this blog is mainly devoted to Security and all related issues. However, other issues like e.g. major occurances on my forum and social topics will be blogged too.
My board offer free security and malware related Support, Help, Advice and Education forums, however is not limited to such issues. Smokey’s have also forums with comprehensive Microsoft Windows related issues like Microsoft and Windows OS Based Products News, MS Download Center, MSDN Developer Information, software reviews, browser and tools forums, Webware, Social Networks info, Hardware- and Gadgets forums and last but not least a dedicated Windows Drivers, Linux Drivers, Firmware and BIOS Survey & Updates section containing (recently) released Drivers, Firmware and BIOSses, Windows 7 releases included. Note: most info on Smokey’s is real-time and therefore always up-to-date.
As extra service we have a OTL (formerly OTListIt2) Log Analyzing and Malware Removal/Cleaning Help Forum, full qualified OTL Log Analysers/Malware Hunters will be pleased to help you for free to clean your malware infected PC.
Smokey’s host and maintain the Official Jetico Inc. Support Forums, including the following products:
- Jetico Personal Firewall V1
- Jetico Personal Firewall V2
- Jetico BestCrypt for Windows
- Jetico BestCrypt for Linux
- Jetico BestCrypt for Mac
- Jetico BestCrypt Volume Encryption
- Jetico BCArchive
- Jetico BCWipe for Windows
- Jetico BCWipe for UNIX
Disclaimer: information in this blog can be based on (not confirmed) statements of (anonymous) sources, Smokey’s Security Weblog don’t take any responsabilty for the credibility of these sources and their statements. Also, statements and opinions expressed in articles, reviews and other materials herein, reproduced by me, are those of the authors.
The posts/articles in this blog can be supplemented with so called “Possibly related posts” links. Because these links are automatically generated by WordPress.com, Smokey’s Security Weblog have no influence on the links itself and/or content of them. Therefore this Weblog don’t take any responsability for these links and all related issues.
About Copyright and this Blog: it is allowed to reproduce (parts of) posts in this blog if this reproduction is provided with a direct link to the original blog post. It is NOT allowed to copy, use and/or reproduce any image or blog banner.
Blog comments policy: to restrain indecent and off-topic comments and spam, comments are reviewed before publishing. Therefore, delay in comment publishing is unavoidable. Obligatory language of comments is English.
.
My main task
Recommended: Free network protection with OpenDNS
Recommended: F-Secure PC Health Check
Recommended: Dr.Web CureIt! Free Malware Scan
Recommended: Kaspersky Online Antivirus Scan
Recommended: Online Safe Password Generator
Smokey’s is Friend of WOT – Web of Trust
Smokey’s Weblog Google FeedBurner
Add Smokey’s Weblog to your Technorati Favorites
Sunbelt Blog- Thinspo Tumblr Page leads to Fake News Diet Supplement Site March 12, 2013
- Scammers Invite Facebook Users to Test the New PS4, XBox 720 March 7, 2013
- PlanetSide 2: Unauthorised Third-Party Access Shenanigans February 27, 2013
- Valentine’s Day Threats: That Front Called “Love” February 14, 2013
- SIR: Regions with High Piracy Rate Also Have High Malware Infection Rate February 11, 2013
- Email Threats Highlights: US Airways and American Airlines Spam February 8, 2013
- Ransomware Spam Pages on Github, Sourceforge, Others February 7, 2013
- SID 2013: Their Message is Our Mission February 6, 2013
- Oracle Releases Early Patch to Address Java Flaw February 5, 2013
- Tumblr Spamrun gets Personal on Facebook February 4, 2013
- AV-Comparatives Blog
- Real-World Protection Test Factsheet April May 13, 2013
Giveaway of the Day: commercial software for FREE
Advertisement: Link Logger from Binary Visons
Your IP and location
Blog Visitor Statistics
awesome.. had one that was pesky and would not fix no matter what.. did as you stated and it worked..
Method #2 doesn’t work for me, when I select Protocol and click Add I get a “The system cannot find the file specified.” error.
I want to say: Thank you very very much. Been struggeling for 2 days with my broken internet connection. Figured out pretty fast that it had something to do with the TCP/IP but couldn’t find a solution. On the windows support page they offer the same solution as you, but for Windows 2000 (not XP) and not with your explanation about “Extended Error” failure and everything following that. Basically, you saved my day. Thanks again.
You are welcome, satisfied customers are the best customers (;
Thank you so much! This fix (#2) was EXACTLY what I needed to get a friend’s computer back from the dead! They had spy/malware and viruses all over the place (probably should have reloaded, but oh well).
Thanks again! Great info!
Thank you, but I tried both fix and everything went ok, but the problem still here, I still can’t get the internet online, is there any other way?
Tried the original solution and it did allow me to uninstall TCP/IP – Pretty cool.
netsh int ip reset resetlog.txt
netsh winsock reset
But overall this didn’t fix the problem.
I knew that the problem was related to one of the Security Updates for Windows XP.
I identified Security Update for Windows XP (KB917953) as the culprit.
Use Windows Explorer to navigate to the C:Windows “$NtUninstallKB917953$” folder and use the uninstall utility in the folder.
Note: I noticed two other folders related:
“$NtUninstallKB917953$(2)” and
“$NtUninstallKB917953_0$”
I did not have to do anything using those in order to fix the problem.
Hello Smokey,
First of all i would like to thank you to find your advice on the internet, which tool me three whole days to comb the net. But i have a problem still. I can’t even see my network adapter.I tried your advice, but it won’t work for me. I can ping the localhost and get reply back from it. But no success either but repairing the window or using the steps u showed above. Is there anything that you can help me pls….i can’t see my local area connection….i am waiting pls drop a line or two…thx a lot
Nothing works for me
After updating to SP3, my connection status is cable unplug
I’ve try several method, nothing works
fnally, I reinstall XP SP2
but the problem still there ,,
Anyone could help ??
Thank you very much for sharing this invaluable troubleshooting tip. I was stressing over this error for a few days on and off. I almost gave up hope, but then I came to this page and found the solution. Keep up the good work, it is really appreciated, trust me. I am a tech and I can’t count how many times someone like you make my job a bit easier.
Looked promising, but I was disappointed not to see any Network Connections present, so I couldn’t proceed past #1/5.
Please see the following thread on the big problem I am having:
http://www.help2go.com/forum/computer-help/102328-network-devices-fail-start.html#post424430
Regards
Paul
Did everything as mentioned here, which was a great help, but the problem still persisted.
Guess what? MAC address filtering was enabled on the router and the MAC address was blocked from internet access.
So double check before going mental. :p
This described my situation perfectly, and fixed it when no other solution would.
I went with the Hardcore Method, since I did not want to do a Windows Repair. In my case, I had to perform some of the steps listed more manually since when I first uninstalled TCP/IP, my system crashed with a Blue Screen of Death.
After rebooting, I checked to see how many of the listed items had actually been removed from HKLM/system/CurrentControlSet/services/ and manually removed those that were still present using regedit.exe, then rebooted before continuing with Step #2.
Thanks for sharing your insights!
The hard core method worked for me, when nothing else in the world could help. Thanks!
A BIIIIIG “THANK Y O U” dear man You save my life!!
After spending a day with almost trying all the possible
soft and repair options You save my life with Yours
HARDCORE method, couse only this works after cleaning
all the registry keys affected by ADOBE silently installs
theirs whole SHITTY bonjour SHIT to my computer,
making a “bonjour proxy” and no matter what I try the
TCP/IP does not work and also an Internet connection!
After carefully cleaning all registry entries with a
registry editor and Yours truly great help I solve my PC and
my time to reinstall all once again a week of work!
Thank You Man,
With my best warm wishes to You,
Cknubb
I am having trouble with my desktop which has XP installed.It was working ok but after doing a Checkdisc it kept trying to load but never got to the final screen just kept trying to load over and over again,so I rebooted and same thing kept hapening.I am nots able to remember what I done next but I got a message on the screen do not power off I waited for about five minutes or more and as there isplaywas no responce I rebooted and since then the computer will not switch on although I can see by removing the side panel that power is geting to the mother board and the small display on the board is showing 00.Please can you
help.
I really appriciated your great help. It completely solved my problem. Thanks very much
May the author of this help-info come in heaven!
THX a LOT!!
Thank you SOOOOO much for this information. The Hardcore recovery was the only thing that worked to get my work laptop running again. I was pushed some software from my company’s PC Health division, and it completely hosed my TCP/IP stack. I would have had to re-image for certain without your tip. THANKS AGAIN!! A+++
Thank you for the “Hardcore method” – had this really stubborn XP install, swapped the HD and saved it for some fun.
To get the XP install going again, I had to copy backup files tcpip.sys and nettcpip.inf from servicepacks on the XP install, using the method exactly as described, did not work.
Now I can finally format the drive, and put it in use again!
JRH
Network engineer
THANK YOU for the hardcore method. I spent several hours with AT&T Support to no avail and then found your article. I am using XP Pro SP3 and did not have to do the integrity check. Everything is working fine.
Glad you could solve the problem with our help.
I was backing up data to do the inevitable reinstall on my WinXp SP3 system, when I found this site. I was unable to access the internet on the host OS but the VMs installed were able to connect, without a hitch through the same connection. I suspected a DNS issue but it was down to TCP/IP stack. The reset method did not work. Tried the hardcore method. After the final reboot, a torrent program on the host OS was able to connect for about 10 seconds. No connectivity after that. I get a svchost error when I log in and cannot open any programs. Any help will be appreciated. Thanks!
I tried all of the steps you suggested and I still could not get out to the internet. I could ping local servers and access SharePoint but could not get pass the router. I removed all updates from the last auto update and it worked.
Thanks so much!!!!!!!!!
Hardcore method #1 and #2 did the trick.
Thanks again
as per above: Hardcore method when nothing else is working step 1 and step 2 did it!!!!!
You also might want to remind people to make sure their HOSTS file is not stuffed with hacker IP’s/URLS as was the case with my box.
This took days to fix. Thanks to Hublerb!!!!! VERY VERY KEWL FIX
THANKS!! Tried on 3-31-2010 on pc that would not load internet and would not launch firewall, worked perfect.
Hardcore Method:On this Easter Sunday 2010–
Thank you, thank you, thank you.
–Amen
The error message this corrected is not in your list:
It is not possible to disable the connection at this time ….
You are a hero! Following your clear instructions, 5 minutes was all it took to get tcp-ip back up and running. Many thanks.
Ii lost all TCP/IP on WinXP after virus scan and removal using AVIRA. I tried your method and it worked perfectly. I am now back on line and everything is working well. Many thanks for your technical savvy and advie for this fix.
Finally, a solution that worked! I was pulling my hair out!
Thank you. The “Hardcore Method” worked for me. I had a drive-by “Security” type malware installed, removed w/ malwarebytes then promptly lost internet connectivity w/ IE, FF and Chrome. Ran IE Reset Settings and then had intermittent connectivity–70% of the time I’d have to “refresh” the page ‘cuz of “Cannot Display” page errors or the Stylesheet wouldn’t load.
Spent 10 minutes using your “Hardcore Method” and now I’m back in the game! Thank you, thank you, thank you!
I couldnt get past the R for repair part as I forgot my Admin password, however, I found the Hardcore simpler and faster.
Thanks a ton.
Awesome! Thank you very much! It works for me (hardcore + step2).
Thank you very much as well!
After playing with various IP-Configuration my WinXP IP-Stack was completely broken. After reinstalling the Network cards, using “netsh” for ip-reset and winsock-reset and trying out the Winsockxpfix, the DHCP and IP-basics (ping) were working again!
But host query functions (and DNS-lookup) were still dead at all.
I tried the hardcore method with the result that the whole IP-Stack was broken again!
I tried the hardcore methode again, and did additionally uninstall all other network services and network adapters after doing Step #1. After reinstalling, everything was working perfectly!
Thnx soooooooooo much u saved my life.
Result! Spent whole day looking and trying all sorts. Nothing worked till your Hardcore method – tops, Tops, TOPS!!!
Really great!!
I already knew a LOT about XP and its bugs .. (used a workaround with manually removing several registry entries and files) but this worked pretty good and simple ! (computer repair center here)
Thank youuu so muchhh it work like a charmmm..
this is what i need.. thank you..
You sir, are a genius! If I only came across your article earlier.
Sir,
You are perfect at your job. My job is also the same. I Don’t you think you should also start an auto-mailing system? Users will register for your mailing lists and you should e-mail them every new entry in your blog post or a link to that. It will be a more useful idea for increasing the no. of users with you.
Thanks for the kind words.
There are already several ways to subscribe to my weblog so I don’t know what you mean or want.
Is formatting and reinstalling C drive or the XP installed drive, will fix Local area connection problem?
Thanx in advance
I HAVE TRIED THE HARDCORE METHOD , AND IT WORKS.
THANKS A LOT.
ANIT
Can someone confirm (or deny) that his “hardcore” method it better/worst/different than what Microsoft says *IS* the full uninstall/reinstall/default method:
> netsh int ip reset resetlog.txt
Out-freaking-standing. This (the “hardcore” method) has just saved me 5 hours of reinstalling a really big XP installation. I’m sure it will save me and my clients many hours in the future as well.
Thank you!
I can’t do #1 because I’m on a laptop with a preinstalled XP & MS Office config, so I tried the hardcore method and no difference. When I open the wireless connection light that says I;m connected, and go to the Support tab, it’s blank, with no IP address, no Subnet Mask, and no Default Gateway!
Thank you very very much
It is working form me
Thanks alot, it worked for me. I was on it for 3 hours since I saw your comments
Thanks again
Ahhhh…the wonder of google! Hardcore method worked perfectly to restore internet after infection from the rootkit.zeroaccess virus.
Thanks so much!
A virtual Case of Ale for you !
Save my Bacon, tcpip.sys injected with rootkit; the excellent TDSSKILLER from Kaspersky identified and removed the rootkit, no worries, though leaving tcpip.sys totally corrupted, tried a large number of resolutions ** prior to arriving here, went directly to “Hardcore Method” – issue resolved, heart rate back to normal, client smiling …”psssssft” “Cheers!”
=====================
** List of resolution that DID NOT RESOLVE !
* System Restore
* copy of known good tcpip.sys from C:\ to %systemroot%\drivers via recovery console (with a checkdisk /p at each stage)
* sfc /scannow
=================
In a single word…. awesome! What had me spend hours trying to fix was quickly resolved in under 5 minutes!! Great job!!
Unbelievable Fixed a problem I have been working on for 8 hours straight. My client will be very happy I didnt have to reinstall XP and install the 50 or so programs they use. Thanks so much. You’re Awesome.
[...] http://smokeys.wordpress.com/2008/07/20/how-to-recover-a-really-dead-windows-xp-sp2sp3-tcpip-stack/ [...]
Pingback by How to reinstall networking on Windows XP – Solutions To and Through Technology | December 28, 2011 |
VERY GOOD SOLUTION>>>>>> THANK YOU!
This is a perfect solution. :}
Hmm… That worked surprisingly well
I realize this was written in 2008, but if you happen to stop by and read the comments section, thanks a million.
Ditto #54 — worked like a champ on one of our company PCs that I was about to bin. THANK YOU!
THANK YOU! Method #2 worked like a charm as I didnt have access to method #1.
You saved my moms friends PC.
tcp/ip protocol driver failed to start
I
PCONFIG returned an error message
unable to query host name……….
we tried
1. tcp reset
2 with xp tcp/ip repair
3 with hardcore method of reinstalling tcp
it was not successfull
AFTER reinstalliNG SP3 EVERYTHING WORK FINE
thanks, but unfortunately in my case – none of the methods above (I’ve tried them all, including the “hardcore”, SP3 reinstall, etc., didn’t work.
any OTHER ideas, except a new install of windows?
update:
seemed I missed an “ipsec.sys” file – details below
http://www.technofyed.com/showthread.php?tid=424&page=1
Unfortunately now I’m stuck in a “acquiring network address” which will not end.
ipconfig /renew says “the RPC server is unavailable”
any ideas?
the computer was infected with malware, cleaned with avast, but with some consequences it seems.
update 2
seems i have a lot of services, for example DHCP Client, not started and broken.
I’ll run sfc /scannow, and hopefully this will fix it.
Thank you! I’d forgotten about this fix. I also forgot the steps.
Thank you again!
Worked perfectly!
Thank you, thank you and thank you! Thanks to AVG anti-virus, I lost my internet connection! After days of searching for fixes, I’m happy to find your suggestions because it worked. I’ve uninstalled AVG completely and followed your instructions under hardcore method. My system is back in business and I’m connected to the internet again. The firewall is working too.
Tried hardcore method but now my computer hangs after booting on “found new hardware Packet Scheduler Miniport.” ctrl/alt/del doesn’t even work. I now have no computer at all. I’m at my wits end. I would be grateful for any help
step #1 and #2 worked perfectly! thank you
i have the same problem,i tried all but still i cant activate the uninstall button.and there is a “this driver is not digitally signed!” warning
Absolutely amazing! Been banging my head on this issue for days! Finally came across this and the Hardcore method worked like a charm! Thanks so much!
Thanks, it perfectly worked !
Thank you very much! Your instructions are quite clear and worked beautifully.
Many thanks! Worked for my XP MerdiaCenter system.
Thank you for the clear instructions. My system works great now.
you are a god.
i followed your instructions to the letter and…VOILA!
sign me up for your fan club.
-dro
Thanks a lot! “Hardcore method” helped me
Thank you! “Hardcore method” really work!
Amazing, method 2 worked perfectly, thanks man…
Thank you, you saved me from a complete reinstall of Windows! I’ve lost all my connection icons and tcpip response after uninstalling VM VirtualBox. The “Hardcore method” really work!
Maybe quote where you got the article from?
http://support.microsoft.com/kb/325356
It’s obvious you haven’t read my post with demanded attention, source is mentioned. FWIW it’s NOT Microsoft so I don’t know how you come to your (wrong) suggestion.
I was of course originally attracted to this link by the use of the term “hard core” as a heading on the page but was pleased to find that the content was the “real deal” in helping me fix a PC that simply would not talk to the internet. Your advice has instantly elevated me from “old fart next door who still uses XP” to “local PC guru”. Thanks again for some very concise and accurate advice.