netbt issue after virus removal

I found a pc on our network with a virus (windows xp).  After removing said virus and seeing the damage I noticed it could no longer connect to the network (stuck at limited to no connection).  Checking event log I found DHCP could not start due to a nonexistant dependancy (netbt).  After looking around I found a microsoft article saying to fix it you can remove the netbt dependancy from the regedit by editing the dhcp registry.

After removing the dependacy I booted up to find internet,  exchange server and so on working correctly however network drives were unable to connect.  Looking at the event log I found the following

Error: 7003
The TCP/IP NetBIOS Helper service depends on the following nonexistent service: NetBT

Anyone have any suggestions on how I can restore network operations to reach the proper drives?  I assume netbt was deleted or hidden due to the virus but not sure.
OvertonpAsked:
Who is Participating?

[Webinar] Streamline your web hosting managementRegister Today

x
 
flubbsterConnect With a Mentor Commented:
Copy netbt.sys from a working PC and copy it to c:\windows\system32\drivers

It should not be located anywhere else. There is a known virus that places a copy of netbt.sys in the c:\windows\system32 folder.

So, make sure that there is a good copy in the drivers folder. Once you do this, you can actually put the dependancy back on the DHCP reg entry.
0
 
Darius GhassemCommented:
Reset the TCP\IP stack see if that helps

http://support.microsoft.com/kb/317518
0
 
Gerwin Jansen, EE MVETopic Advisor Commented:
Hello, what virus(es) did you find and clean?
0
The Lifecycle Approach to Managing Security Policy

Managing application connectivity and security policies can be achieved more effectively when following a framework that automates repeatable processes and ensures that the right activities are performed in the right order.

 
johnb6767Connect With a Mentor Commented:
If this key doesn't exist on the machine, export it from a known good working one, and reboot.... If it restores your problems, add it back to the DHCP dependency (along with AFD)......

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NetBT
and
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_NETBT\0000

If the Installed NICs are different you might need to update these subkeys under here for the interfaces....

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NetBT\Parameters\Interfaces
0
 
OvertonpAuthor Commented:
I readded netbt to dependency list and copied a working netbt driver to registry and system folder.

It restored email, internet and so on however network drives are still unavailble.

Heres an application log.

Userenv
Windows cannot obtain the domain controller name for your computer network. (The specified domain either does not exist or could not be contacted. ). Group Policy processing aborted.
0
 
Gerwin Jansen, EE MVETopic Advisor Commented:
Do you have a Gb NIC, in that case, you may have to disable media sensing as described here.
0
 
johnb6767Commented:
What's the error if you map manually?

I would run MalwareBytes and TDSSKiller as a followup, to make sure you are verified clean.....
0
 
OvertonpAuthor Commented:
Here's the actual error.
1058
Userenv

NT AUTHORITY\SYSTEM

Windows cannot access the file gpt.ini for GPO CN={6AC1786C-016F-11D2-945F-00C04fB984F9},CN=Policies,CN=System,DC=samcotech,DC=com. The file must be present at the location <\\samcotech.com\sysvol\samcotech.com\Policies\{6AC1786C-016F-11D2-945F-00C04fB984F9}\gpt.ini>. (The network location cannot be reached. For information about network troubleshooting, see Windows Help. ). Group Policy processing aborted.

I'll run another virus check to make sure everything is gone.
0
 
flubbsterCommented:
Take a look at this when you can. Look at the last post. It seems virtually identical to what you are seeing. Same error code also.

From that post, it may be a corrupted policy that needs to be removed.

http://www.petri.co.il/forums/showthread.php?t=24870
0
 
johnb6767Commented:
{6AC1786C-016F-11D2-945F-00C04fB984F9}

Does this Policy exist in GPMC still?
0
 
johnb6767Commented:
"Here's the actual error."

That should not be an error from mapping a drive....

\\samcotech.com\sysvol\samcotech.com\Policies\{6AC1786C-016F-11D2-945F-00C04fB984F9}\gpt.ini

You cannot brose to this location in Explorer?
0
 
OvertonpAuthor Commented:
Fixed after using a winsock repair program after readding the netbt driver.  Thanks
0
 
OvertonpAuthor Commented:
only part of the issue fix explained.
0
All Courses

From novice to tech pro — start learning today.