[Last Call] Learn how to a build a cloud-first strategyRegister Now

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 431
  • Last Modified:

Can't Acquire IP Via DHCP

Working on a laptop with XP Home.  It had a trojan (agent3.Aqva) that seems to be cleaned up.  The trojan infected the netbt.sys file.  I've run the netsh in ip rest as well as winsockfix.  Also ran combofix in saf and regular mode.  If I enter an IP address manually I have no problems getting online.  It's just when I tell it to automatically acquire and address that it  breaks down.  Any ideas?
0
Sven Mogelgaard
Asked:
Sven Mogelgaard
  • 5
  • 3
  • 3
  • +3
1 Solution
 
John HurstBusiness Consultant (Owner)Commented:
See if you have System File Checker on your machine. Open a Command Prompt and run SFC /SCANNOW at the prompt. Allow to complete and then restart. See if that helps. ... Thinkpads_User
0
 
Kenmcse1969Commented:
If Thinkpad's advise don'e work, then try this.

1) Remove your NIC from device manager and let Windows reinstall the drivers.
0
 
Sven MogelgaardAuthor Commented:
Well, no luck.  Still can't get a DHCP connection.
0
Concerto's Cloud Advisory Services

Want to avoid the missteps to gaining all the benefits of the cloud? Learn more about the different assessment options from our Cloud Advisory team.

 
Sven MogelgaardAuthor Commented:
I also tried deleting the adapter and rediscovering.  No luck.  Arrrrgh!
0
 
John HurstBusiness Consultant (Owner)Commented:
Viruses wreck machines more than we imagine, so it may be better in the long run to just re-install your operating system (back up first, of course).   .... Thinkpads_User
0
 
JT92677Commented:
If there was a DHCP assigned address at one time, your system will likely request the same IP address in the DHCP request header. If the DHCP server sees an existing address, it will not respond with a new address.

The following should assure that the DHCP request does not contain any previous IP address information, allowing the DHCP server to propertly respond to a new request.

Try running CMD

Then ipconfig /release

Then try ipconfig /renew

then look at the results with ipconfig /all


Hope this helps.

Jeff
0
 
Russell_VenableCommented:
Do you have a folder named C:\windows\SoftwareDistrobution\ if so look for a copy of netbt.sys, if found and you still have the recovery console installed. Write down the location you found that driver in that folder and reboot into recovery console. Once inside of recovery console change directory to that folding containing netbt.sys and copy netbt.sys like this copy netbt.sys c:\windows\system32\Drivers\, hit enter and hit 'y' to accept it. Type 'exit' and this will exit the console and you will start back into windows. Test to see if connectivity is restored.
0
 
Sven MogelgaardAuthor Commented:
Hi Russell!

I tried expanding netbt.sys from an install disk, downloaded one and copied from a ServicePack directory in the HD.  I've used WinSockFix, netsh, ComboFix and everything else I can think of.
0
 
Russell_VenableCommented:
Hmm, Lets try the XP Diagnostic tool. It is located here: C:\windows\Network Diagnostic\xpnetdiag.exe.

If you dont have this folder or dont find the tool listed here is the link to download it: Here. This tool when run will test all interfaces and output a xml file that details what it found. the xml file is also placed in the same directory as xpnetdiag program.

A example should look like this

 XML Log
After you run the diagnostic tool you can click on the diagnostics log link it provides and just go to the address bar and copy and past that location in the file upload portion for this forum so we can see the results of the report.
0
 
cantorisCommented:
Check Administrative Tools - Services.
Is the DHCP Client service started?
0
 
JT92677Commented:
Check the DHCP server for your LAN (assuming you have a local DHCP server). For most users it will be the ip block with a "1" at the end, like this  xx.xx.xx.1

On my LAN, I'd use a browser to go to http://192.168.1.1 (if my LAN was still on the typical default class C block for most SOHO routers) and from there, I'd check the DHCP clients list, and any reserved IPs looking for the MAC address of your LAN adapter.

you can get your MAC address at the CMD prompt by typing
arp -a
It will list IP addresses and MAC addresses

Back to the major suggestion: Reboot the DHCP server, or restart it and try again.
Also remove a reserved IP address if there is one associated with your MAC address or machine name and let your computer request an address as though it's a new member of the LAN.

I presume you tried my earlier suggestion which involved flushing the DNS cache on your local laptop.

jeff
0
 
Sven MogelgaardAuthor Commented:
Custmer decided to reformat.
0
 
Sven MogelgaardAuthor Commented:
I've requested that this question be closed as follows:

Accepted answer: 0 points for sven3rd's comment http:/Q_27399613.html#37165070

for the following reason:

No points
0
 
John HurstBusiness Consultant (Owner)Commented:
My post (ID:36978649) suggested exactly what was finally done - reinstall the OS. .... Thinkpads_User
0
 
JT92677Commented:
So did reformatting fix the problem?  I guess we'll never know if it was a network issue, or just that machine.
0

Featured Post

Independent Software Vendors: We Want Your Opinion

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

  • 5
  • 3
  • 3
  • +3
Tackle projects and never again get stuck behind a technical roadblock.
Join Now