# TCP/IP and NetBT errors in Event Log - connection to router unavailable



## Gruzz (Dec 11, 2007)

Hi, I'm hoping someone here can help.

First of all, appologies if this is not the best fourm for this problem. It is network related, but I'm not sure if it should go here or under Protocols or somewhere else.

Here is as much information as I can give right now:

I am using Windows XP Home Edition, SP2.

My desktop became infected with what is believed to be a keylogger last week. This appears to have been aimed specifically at users of Final Fantasy XI, and downloaded itself automatically via google ad banners on a web site related to the game. My Firewall did not let it talk to the internet once it was on my computer, but by then it seems the damage was done.

I have prevented the problem application from running at start up with SpyBotS&D and physically deleted it from my system. The registry entries for it still exist (I'm not computer literate enough to go poking around in my registry without guidance), but the app itself is not there to cause harm any more.

I have scanned my system with Spybot and also run HijackThis and reviewed the scan file for any similarly suspect applications in my registry. I can see nothing ammis now.

The problem I have is that this malware seems to have corrupted my TCP/IP protocol. Everything else on my PC appears to be running normally.

Upon turning my PC on, Windows takes a long time to finish loading, and does not show my network connection until several minutes after I can actually start using my descktop.

The connection claims to be connected to something (it's definitely plugged into my router), but my packets in/out stay at 0/0, and Task Manager says I have "No Active Network Adapters".

Igconfig will not run (with any options other than "?"). It returns an internal error stating that "The request is not supported" and "Unable to find host name".

So I had a look in my Event Log, and I get a series of driver errors, complaining that my TCP/IP service failed to start because "The specified driver is invalid".

The first error in the log upon booting up says "Initialization failed because the driver device could not be created", Source: NetBT, EventID: 4311.

I've tried to look for more information on this on various forums (including those here) but not really found anything that helps.

Further things I have tried:

Re-installed the network card drivers
Reset WINSOCK with: netsh int ip reset <log>
Rest TCP/IP stack with: netsh winsock reset catalog
Run WinsockXPFix
(Rebooting as required)

These have made no difference.

Is there a way for me to re-install these protocols/drivers in isolation? Or some other way to repair them? Given that everything else appears to be working I'd rather not face a re-install of Windows.

Any help or feedback would be most appreciated.

Many thanks,
G.


----------



## johnwill (Sep 26, 2002)

*S*tart, *R*un, *devmgmt.msc*

Under *Network adapters*, please tell me all the devices listed. Also, are there any devices anywhere in the Device Manager display with yellow *?* or *!* displayed?


----------



## Gruzz (Dec 11, 2007)

Certainly,

Non-hidden Network Adapters:

1394 Net Adapter
NVIDIA nForce Networking Controller
Neither have any warning symbols against them, and both show as "The device is working properly" in the properties pop-up.

Hidden Network Adapters:

Direct Parallel
NVIDIA nForce Networking Controller - Packet Scheduler Miniport
WAN Minport (IP)
WAN Minport (IP) - Packet Scheduler Miniport
WAN Minport (L2TP)
WAN Minport (PPPOE)
WAN Minport (PPPTP)
Again, no warning signs, and all showing as "working properly" under Properties.

I do have a couple of yellow "!"s next two two hidden items in my Non-Plug and Play Drivers:


IP Network Address Translator
TCP/IP Protocol Driver
Properties for both state: "The device is not present, is not working properly, or does not have all its drivers installed. (Code 24)"


All other entries in Device Manager, hidden or otherwise, are free of any warning symbols.

Cheers,
G.


----------



## johnwill (Sep 26, 2002)

> I do have a couple of yellow "!"s next two two hidden items in my Non-Plug and Play Drivers:
> 
> * IP Network Address Translator
> * TCP/IP Protocol Driver


Well, there's the issue.

*TCP/IP stack repair options for use with Windows XP with SP2.*

*S*tart, *R*un, *CMD* to open a command prompt:

Reset TCP/IP stack to installation defaults. *netsh int ip reset reset.log*

Reset WINSOCK entries to installation defaults: *netsh winsock reset catalog*

Reboot the machine.


----------



## Gruzz (Dec 11, 2007)

Sadly, I have already tried this without sucess.

I get no errors and no messages other than the Reboot request when runing either command. But upon reboot I still have the same symptoms as before.

The first time I ran it the log contained the following:

reset Linkage\UpperBind for {1A3E09BE-1E45-494B-9174-D7385B45BBF5}\NVNET_DEV0057\4&2CAE72C9&0&01. bad value was:
REG_MULTI_SZ =
PSched

reset Linkage\UpperBind for ROOT\MS_NDISWANIP\0000. bad value was:
REG_MULTI_SZ =
PSched

<completed>


Running the commands a second time left the log merely containing the line: <completed>

G.


----------



## johnwill (Sep 26, 2002)

Hmm... I'm looking to see if there's a suggested fix for this issue, haven't found one yet.


----------



## mfurby (Dec 25, 2007)

I am in exaclty the same situation and have tried the same fixes....misery loves company!


----------



## DigitalJedi (Apr 24, 2009)

Evening gentlemen,

Looks like I'm running into almost exactly the same problem as whomever started this thread, I've got a few services that are supposed to be running but arent:

-DHCP Client
-DNS Client
-Google Software Updater
-Google Update Service ( gupdate1c98..... )
-IPSEC Services

And that's all for services, here's a list of devices with notable problems:
-IP Network Address Translator
-Serial
-TCP/IP Protocol Driver

And all three of these devices are showing Code 24 ( Not present, not working, or does not have drivers ) in the devices status window.

The network adapter is an nVidia nForce Networking Controller, and seems ( based on the devices mangler ) operating normally.

I've got a much bigger resetlog than the one posted above, if it will help in resolving this let me know and I'll throw it up, if anyone needs any more technical information on this problem to help me resolve it, please let me know and I'll be glad to find out whatever we need. Thanks for anyones help.


----------



## DigitalJedi (Apr 24, 2009)

I have also already attempted all of the troubleshooting steps listed above
-Reinstalling Drivers
-Resetting TCP/IP Stack
-Resetting Winsock
-Provided Winsock Fix? ( Registry Entries )

Thanks again.


----------



## DigitalJedi (Apr 24, 2009)

If anyone has had a chance to look any further into this problem some information would be greatly appreciated as I have an appointment to try and deal with this again tomorrow, and while this is none of your guys' problem, I could use the help. If all else fails I'll just be rebuilding the system... for the second time in the last two months... and starting from scratch. I appreciate any help anyone can offer.


----------

