Smokey's Security Weblog

veritas odium parit

How to recover a really dead Windows XP (SP2/SP3) TCP/IP stack

About this article

Author/source: Hublerb – Tech Support Guy

- Complete destruction and restoration of dead TCP/IP stack
- Recovery from fatal failure or partial or complete corruption of TCP/IP

Related error messages / occurances

- IP Driver Error Code 2.
- TCP/IP network transport is not installed error message from active sync.
- TCP/IP driver missing from devmgmt.msc showing hidden devices.
- Ipconfig produces immediate failure message.
- An Internal error occured: The request is not supported.
- Unable to query host name.
- The specified device instance handle does not correspond to a present device message regarding DHCP service in services.msc
- Net start tcpip >>> fails with system error 2, The system cannot find the file specified.
- Ping error: Unable to contact IP driver, error code 2.
- Repair Local Area Connection: Failed to query TCP/IP settings of the connection. Cannot proceed.
-TCP/IP Protocol Driver Service Failed To Start, system cannot find the file specified.
- The TCP/IP Protocol Driver service failed to start due to the following error:The system cannot find the file specified.

Failed repair methods

- Netsh int ip reset resetlog.txt >>> no effect
- Non-full reinstall of TCP/IP using only the have disk method. >>> no effect
- Netsh Winsock reset >>> no effect
- Winsockxpfix >>> no effect
- Reinstalling network card >>> no effect

Solutions

Repair install

1. Insert and boot from your WindowsXP CD
2. At the second R=Repair option, press the R key
3. This will start the repair
4. Press F8 for I Agree at the Licensing Agreement
5. Press R when the directory where WindowsXP is installed is shown. Typically this is C:\WINDOWS
6. It will then check the C: drive and start copying files
7. It will automatically reboot when needed. Keep the CD in the drive.
8. You will then see the graphic part of the repair that is like during a normal install of XP (Collecting Information, Dynamic Update, Preparing Installation, Installing Windows, Finalizing Installation)
9. When prompted, click on the Next button
10. When prompted, enter your XP key
11. Normally you will want to keep the same Workgroup or Domain name
12. The computer will reboot
13. Then you will have the same screens as a normal XP Install
14. Activate if you want (usually a good idea)
15. Register if you want (but not necessary)
16. Finish

Hardcore method when nothing else is working

Step #1

1. Locate the Nettcpip.inf file in %winroot%\inf, and then open the file in Notepad.
2. Locate the [MS_TCPIP.PrimaryInstall] section.
3. Edit the Characteristics = 0xa0 entry and replace 0xa0 with 0×80.
4. Save the file, and then exit Notepad.
5. In Control Panel, double-click Network Connections, right-click Local Area Connection, and then select Properties.
6. On the General tab, click Install, select Protocol, and then click Add.
7. In the Select Network Protocols window, click Have Disk.
8. In the Copy manufacturer’s files from: text box, type c:\windows\inf, and then click OK.
9. Select Internet Protocol (TCP/IP), and then click OK.
Note This step will return you to the Local Area Connection Properties screen, but now the Uninstall button is available.
10. Select Internet Protocol (TCP/IP), click Uninstall, and then click Yes.
11. Restart

Succesfull uninstallation of TCP/IP will remove numerous keys from the registry including:

HKLM/system/CurrentControlSet/services/tcpip
HKLM/system/CurrentControlSet/services/dhcp
HKLM/system/CurrentControlSet/services/dnscache
HKLM/system/CurrentControlSet/services/ipsec
HKLM/system/CurrentControlSet/services/policyagent
HKLM/system/CurrentControlSet/services/atmarpc
HKLM/system/CurrentControlSet/services/nla

These represent various interconnected and interdependant services.

For good measure you should delete the following keys before reinstalling TCP/IP in step #2:

HKLM/system/CurrentControlSet/services/winsock
HKLM/system/CurrentControlSet/services/winsock2

Step #2

Reinstall of TCP/IP

Following the above substep #3, replace the 0×80 back to 0xa0, this will eliminate the related “unsigned driver” error that was encountered during the uninstallation phase.

Return to “local area connection”> properties > general tab > install > Protocol > TCP/IP

You may receive an “Extended Error” failure upon trying to reinstall the TCP/IP, this is related to the installer sub-system conflicting with the security database status.

To check the integrity of the security database
esentutl /g c:\windows\security\Database\secedit.sdb

There may be a message saying database is out of date
First try the recovery option
esentutl /r c:\windows\security\Database\secedit.sdb

If this don’t work for you, you needthe repair option
esentutl /p c:\windows\security\Database\secedit.sdb

Rerun the /g option to ensure that integrity is good and database is up to date.

Now return to the “local area network setup”
Choose install > protocol > TCP/IP and try again

Reboot.

Author / Source: Hublerb – Tech Support Guy

Possibly related posts: (automatically generated)

July 20, 2008 - Posted by Smokey | Advisories, General, Uncategorized | , , , , , , , , , , , , , , , , , , , , , , | 17 Comments

17 Comments »

  1. awesome.. had one that was pesky and would not fix no matter what.. did as you stated and it worked..

    Comment by mstbone67a | September 15, 2008 | Reply

  2. Method #2 doesn’t work for me, when I select Protocol and click Add I get a “The system cannot find the file specified.” error.

    Comment by Dan | September 30, 2008 | Reply

  3. I want to say: Thank you very very much. Been struggeling for 2 days with my broken internet connection. Figured out pretty fast that it had something to do with the TCP/IP but couldn’t find a solution. On the windows support page they offer the same solution as you, but for Windows 2000 (not XP) and not with your explanation about “Extended Error” failure and everything following that. Basically, you saved my day. Thanks again.

    Comment by lazylama | October 22, 2008 | Reply

  4. You are welcome, satisfied customers are the best customers (;

    Comment by Smokey | October 22, 2008 | Reply

  5. Thank you so much! This fix (#2) was EXACTLY what I needed to get a friend’s computer back from the dead! They had spy/malware and viruses all over the place (probably should have reloaded, but oh well).

    Thanks again! Great info!

    Comment by Todd | October 27, 2008 | Reply

  6. Thank you, but I tried both fix and everything went ok, but the problem still here, I still can’t get the internet online, is there any other way?

    Comment by Chrys | November 2, 2008 | Reply

  7. Tried the original solution and it did allow me to uninstall TCP/IP – Pretty cool.

    netsh int ip reset resetlog.txt

    netsh winsock reset

    But overall this didn’t fix the problem.

    I knew that the problem was related to one of the Security Updates for Windows XP.

    I identified Security Update for Windows XP (KB917953) as the culprit.

    Use Windows Explorer to navigate to the C:Windows “$NtUninstallKB917953$” folder and use the uninstall utility in the folder.

    Note: I noticed two other folders related:

    “$NtUninstallKB917953$(2)” and

    “$NtUninstallKB917953_0$”

    I did not have to do anything using those in order to fix the problem.

    Comment by Chrys | November 2, 2008 | Reply

  8. Hello Smokey,

    First of all i would like to thank you to find your advice on the internet, which tool me three whole days to comb the net. But i have a problem still. I can’t even see my network adapter.I tried your advice, but it won’t work for me. I can ping the localhost and get reply back from it. But no success either but repairing the window or using the steps u showed above. Is there anything that you can help me pls….i can’t see my local area connection….i am waiting pls drop a line or two…thx a lot

    Comment by Joni | November 4, 2008 | Reply

  9. Nothing works for me
    After updating to SP3, my connection status is cable unplug
    I’ve try several method, nothing works
    fnally, I reinstall XP SP2
    but the problem still there ,,

    Anyone could help ??

    Comment by James | January 3, 2009 | Reply

  10. Thank you very much for sharing this invaluable troubleshooting tip. I was stressing over this error for a few days on and off. I almost gave up hope, but then I came to this page and found the solution. Keep up the good work, it is really appreciated, trust me. I am a tech and I can’t count how many times someone like you make my job a bit easier.

    Comment by Frederick | January 10, 2009 | Reply

  11. Looked promising, but I was disappointed not to see any Network Connections present, so I couldn’t proceed past #1/5.

    :-(

    Please see the following thread on the big problem I am having:

    http://www.help2go.com/forum/computer-help/102328-network-devices-fail-start.html#post424430

    Regards
    Paul

    Comment by RadAct | February 24, 2009 | Reply

  12. Did everything as mentioned here, which was a great help, but the problem still persisted.

    Guess what? MAC address filtering was enabled on the router and the MAC address was blocked from internet access.

    So double check before going mental. :p

    Comment by MasterOfMessengers | March 13, 2009 | Reply

  13. This described my situation perfectly, and fixed it when no other solution would.

    I went with the Hardcore Method, since I did not want to do a Windows Repair. In my case, I had to perform some of the steps listed more manually since when I first uninstalled TCP/IP, my system crashed with a Blue Screen of Death.

    After rebooting, I checked to see how many of the listed items had actually been removed from HKLM/system/CurrentControlSet/services/ and manually removed those that were still present using regedit.exe, then rebooted before continuing with Step #2.

    Thanks for sharing your insights!

    Comment by Yogi | March 26, 2009 | Reply

  14. The hard core method worked for me, when nothing else in the world could help. Thanks!

    Comment by Gary Boberry | May 20, 2009 | Reply

  15. A BIIIIIG “THANK Y O U” dear man You save my life!!
    :) :) :) :) :) :)
    After spending a day with almost trying all the possible
    soft and repair options You save my life with Yours
    HARDCORE method, couse only this works after cleaning
    all the registry keys affected by ADOBE silently installs
    theirs whole SHITTY bonjour SHIT to my computer,
    making a “bonjour proxy” and no matter what I try the
    TCP/IP does not work and also an Internet connection!
    After carefully cleaning all registry entries with a
    registry editor and Yours truly great help I solve my PC and
    my time to reinstall all once again a week of work!

    Thank You Man,

    With my best warm wishes to You,

    Cknubb

    Comment by Cknubb | June 12, 2009 | Reply

  16. I am having trouble with my desktop which has XP installed.It was working ok but after doing a Checkdisc it kept trying to load but never got to the final screen just kept trying to load over and over again,so I rebooted and same thing kept hapening.I am nots able to remember what I done next but I got a message on the screen do not power off I waited for about five minutes or more and as there isplaywas no responce I rebooted and since then the computer will not switch on although I can see by removing the side panel that power is geting to the mother board and the small display on the board is showing 00.Please can you
    help.

    Comment by Mr Peter Penfold | June 26, 2009 | Reply

  17. I really appriciated your great help. It completely solved my problem. Thanks very much

    Comment by zed | July 10, 2009 | Reply


Leave a comment

« Previous | Next »