Netwok Problem ahter Virus

After virus/spyware clean-up I have no network connectivity and wan mini port devices appear in device manager
Question: I have cleaned up a PC (XP SP3) with  Malwarebytes and after a reboot I have no network connectivity.  The machine was had a virus Reader_s.exe but whilst it was infected it could connect to the internet but after the clean it has no connectivity.

IPConfig returns
An internal error occurred: The request is not supported.

My LAN interface doesn't appear in network connections in Control Panel and when I look in device manager under network adapters I see:
Direct parallel
Packet Scheduler miniport
VIA Rhine II Fast ethernet adapter
VIA Rhine II Fast ethernet adapter - Packet Scheduler miniport
wan miniport (ip)
wan miniport (ip) - packet scheduler miniport
wan miniport (l2tp)
wan miniport (pppoe)
wan miniport (pptp)

All of the above have exclamation marks beside them.

I have uninstalled the drivers then installed updated drivers but the error 7001 still appears with The Network Local Awareness depends on the AFD service which cannot start as it cannot find the required file.

I have tried the windows repair cd but that does not give the repair option.8-((

Any ideas please?

Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

ZuxoAuthor Commented:

I have narrowed the problem down to the AFD service, which reports that the file is missing.

However it is in the windows/system32/drivers folder as it should be as are the TCP/IP and Netbios files.

But the service cannot start, what should that setting be in the registry for that file as it could be an error there perhaps?

ZuxoAuthor Commented:
Hi Again,

Further developments :-

Checked the device manager and have yellow ! against
IPSEC, TCP/IP Protocol, Netbios over TCP and NDIS usermode I/O Protocol

All the above show that they cannot start as they cannot find the files specified.

The files afd.sys, tcpip.sys and netbt.sys are in the windows/system32/drivers folder as they should be according to the registry entries.

It is getting stranger by the minute....

Try resetting the TCP/IP stack:
SolarWinds® Network Configuration Manager (NCM)

SolarWinds® Network Configuration Manager brings structure and peace of mind to configuration management. Bulk config deployment, automatic backups, change detection, vulnerability assessments, and config change templates reduce the time needed for repetitive tasks.

If that doesn't fix it, take also look at LSP-Fix:
Export this from a similar OS build, and import it to this one, and reboot.....

ZuxoAuthor Commented:
Hi Folks,

Thanks for the advice sadly none of that worked.8-((

I copied over all the registry entries which were not finding the files required but the result was the same.

From my observations it would seem that all of the files relating to those services and the lan hardware are not being seen despite being in the correct folders.

In the case of the network drivers, AFD etc they are all in the drivers folder but only those files are not being seen, the rest are working as normal.

So my conclusion is that their is either a file somewhere that is causing a re-direction when the files are looked for or that there is a higher level function that is incorrect before the lower network location in the various registry entries?

If so, were should I look in the registry to check for an error as it may have been caused by the virus.

ZuxoAuthor Commented:

Nearly there now...

The main problem was a missing Ndis.sys file that was completely missing!

Now the last problem is with the TCP/IP Protocol which also reports a wrong or missing driver file.

The file is there and looks ok for date and size.

I have tried scannow but that does not report any errors is there a driver file checker utility?

ZuxoAuthor Commented:
Hi Again,

I have also tried netsh int ip reset logfile.txt

Which found some errors but did not solve the problem as it still displays the system cannot find the file specified.

I have copied over the tcpip.sys file from the windows cd just in case.

Is there another one I should copy as well perhaps the tcpip6.sys?

That one should be fine.....

The reg import stopped the AFD service error in the logs though, right?

Device Manager>View>Show Hidden Devices>Non Plug and Play drivers>Anything remarked as a problem in there?
ZuxoAuthor Commented:
Hi John,

Thanks for the help.

Initially there were several but putting back the Ndis.sys solved all of them bar the TCP/IP.

That is the only one still with a problem.

The error is the system cannot find the specified file.8-((

I have deleted the 2 winsock registry keys and then re-booted and re-installed them, still the same.

Copied over the tcpip.sys file from another pc, checked the registry entry to see if it is looking for the correct file in the right place, it is.

The driver file details are correct for the new file so it is being seen in the control panel, device manager, tcpip, driver details.

Very strange one this...

Any further advice please...?

"The error is the system cannot find the specified file.8-(("

Which Driver/Service?
ZuxoAuthor Commented:
Hi John,

TCP/IP Protocol driver.

Does this key exist in the registry?


Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
ZuxoAuthor Commented:
Hi John,

Yes it does and it is set correctly.

I have solved the problem by using a restore point and then removing a virus that came back so thanks for your help, I will split the points with those who helped.8-))

ZuxoAuthor Commented:
Very difficult problem due to a virus being removed.

There must be a deeper problem that could not be found at this time.

A good try by the experts!
Glad youre fixed....
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Windows Networking

From novice to tech pro — start learning today.