Solved

Windows XP - stuck at acquiring network address

Posted on 2013-01-07
35
626 Views
Last Modified: 2013-01-19
Hi,

I have a windows XP media center PC that had a virus.
It could access the internet properly before the virus was cleaned.
After cleaning with Malwarebytes it is stuck at acquiring network address.
If i force a static IP address I am able to ping by IP works.
I am unable to ping by name.
nslookup is unable to get a response from google dns.
I am able to get documents from a local server via IP address.

I am not sure how to fix this IP stack issue - I think that is what it is.

Thanks.
juniorsa.
0
Comment
Question by:juniorsa
  • 14
  • 11
  • 6
  • +3
35 Comments
 
LVL 3

Assisted Solution

by:tsnirone
tsnirone earned 125 total points
ID: 38752519
You could try

http://support.microsoft.com/kb/299357

I would scan for more viruses just to be safe. Normally I use Malwarebytes, Spybot Search&Destroy and a couple of "housecalls"/online scans (Trend Micro, Kaspersky etc)

Also you could try Hijackthis but you should be VERY careful using it since it could damage your system if you delete objects that not are viruses.

Good luck!
0
 

Author Comment

by:juniorsa
ID: 38752549
I can't do anymore scanning online as I can't access the internet.
What do you suggest?
0
 
LVL 12

Assisted Solution

by:DLeaver
DLeaver earned 125 total points
ID: 38752558
Not trying to piggy back on the points here, in fact don't award any to me if this resolves the issue - however to expand on the above if the netsh int ip reset reset.log doesn't work then it is worth running netsh winsock reset, which is discussed in a link from this article

http://support.microsoft.com/kb/811259
0
 
LVL 3

Expert Comment

by:tsnirone
ID: 38752609
I agree with DLeaver "netsh winsock reset," if my link did not work. Also ofcourse he should have points if it works! :)

My bad suggesting online-scanner when you infact cant access internet.

You could try to rerun Malwarebytes and in addition get Spybot S&D and SUPERAntiSpyware (and perhaps hijackthis) on another computer and put it on a usb flash drive or something.

Could you post the content of your hosts file?

Should be here:

C:\<your_windows_folder>\system32\drivers\etc\hosts
0
 
LVL 3

Expert Comment

by:tsnirone
ID: 38752617
also (just in case) try


ipconfig /release
ipconfig /renew

Open in new window

0
 
LVL 3

Expert Comment

by:tsnirone
ID: 38752618
You could also try to disable your network connection and then enable it again.... (sorry for the many posts)
0
 

Author Comment

by:juniorsa
ID: 38752636
I have tried netsh int ip reset reset.log
also
netsh winsock reset
I have run the microsoft fixit
no luck.
I am installing spybot now and will try and run it.
0
 

Assisted Solution

by:juniorsa
juniorsa earned 0 total points
ID: 38752662
I've tried disable /enable
I tried to install another network card
a wireless card
all have the same problem
I've tried ipconfig/release
ipconfig/renew

hosts file is 0 bytes
empty
0
 
LVL 12

Expert Comment

by:DLeaver
ID: 38752703
Can you resolve your own hostname?...

ping -a 127.0.0.1
0
 

Author Comment

by:juniorsa
ID: 38752714
ping -a 127.0.0.1 does reply
0% loss.
0
 
LVL 3

Expert Comment

by:tsnirone
ID: 38752717
you need a localhost entry in your hosts file (the ip DLeaver posted)

http://support.microsoft.com/kb/972034
0
 
LVL 3

Expert Comment

by:tsnirone
ID: 38752718
try

ping localhost
0
 
LVL 3

Expert Comment

by:tsnirone
ID: 38752728
Also check in services (start - run - services.msc) that your "DNS client" is running.

You could also take a peek into Eventviewer to see for any clues.
0
 
LVL 1

Expert Comment

by:Mangi05
ID: 38752870
As mentioned befor by tsnirone you can disable then re-enable the adapter.  I would also make sure that all other adapters are disabled before you re-enable it.  You can also right click and and choose to repair/diagnose the connection.  As this does not always work, I have had it work on a few different occasions.

You can locate the adapters in XP by going to the Start Menu>>Control Panel>>Network Connections.  There you will see the adapters.
0
 

Author Comment

by:juniorsa
ID: 38753178
ran spybot
ran superantispyware
ran malwarebytes
removed all threats possible.

hosts file is fixed
I am able to start dns client
still no IP address
with static IP assigned:

nslookup
server 8.8.8.8
www.yahoo.com

*** [8.8.8.8] can't find www.yahoo.com: No response from server
0
 

Author Comment

by:juniorsa
ID: 38753370
did the enable/disable uninstall - reinstall there are no other adapters enabled.
Tried repair/diagnose.
0
 
LVL 3

Expert Comment

by:tsnirone
ID: 38753616
For some reason you are not able to get the values from your DHCP server. This means not only are you lacking a IP adress, but you also do not know of any DNS server(s). This is why you (if setting ip manually) can ping outside but not able to nslookup. If you added the DNS-server(s) alongside a static ip you should be able to this as well.

You could try this just to verify that your dns-clientside is working?

Are you able to get ip-adress on other pc's on your lan? Could you post "ipconfig /all" from one of them?
0
Complete Microsoft Windows PC® & Mac Backup

Backup and recovery solutions to protect all your PCs & Mac– on-premises or in remote locations. Acronis backs up entire PC or Mac with patented reliable disk imaging technology and you will be able to restore workstations to a new, dissimilar hardware in minutes.

 
LVL 91

Expert Comment

by:nobus
ID: 38753738
try reinstalling the network driver (on another PC - download it)
or use a system restore to a date it was  ok - you must rescan then though
0
 

Author Comment

by:juniorsa
ID: 38754274
I have set the Ip information manually and ping is ok by name buy no dns works.
I've tried the router (which works for other PCs on the netwno luck.
ork) then I tried google 8.8.8.8

ip: 192.168.6.202
netmask 255.255.255.0
gateway 192.168.6.1

dns 8.8.8.8
dns 192.168.6.1

re-installed wireless network adapter using CD that came with the card.
Same thing no DHCP answer, and when I manually configure to above settings it can ping by IP but no dns response from nslookup.

no system restore available.
0
 
LVL 91

Assisted Solution

by:nobus
nobus earned 125 total points
ID: 38754362
then try this method for restore :
http://support.microsoft.com/kb/307545
----------------------------------------------------------------------------------------------
An easier way is to boot from a Bart PE CD (or UBCD4Win CD) and use the file manager for manipulating files. Here  the procedure :
1. rename c:\windows\system32\config\SYSTEM to c:\windows\system32\config\SYSTEM.bak
2. Navigate to the System Volume Information folder.
it contains some restore {GUID} folders such as "_restore{87BD3667-3246-476B-923F-F86E30B3E7F8}".
The restore points are in  folders starting with "RPx under this folder.
3. In such a folder, locate a Snapshot subfolder. This is an example of a folder path to the Snapshot folder:  C:\System Volume Information\_restore{D86480E3-73EF-47BC-A0EB-A81BE6EE3ED8}\RP1\Snapshot
4. From the Snapshot folder, copy the following file to the c:\windows\system32\config folder
 _REGISTRY_MACHINE_SYSTEM
5. Rename _REGISTRY_MACHINE_SYSTEM to SYSTEM
6. Exit Bart PE, reboot and test

Use a fairly recent restore point from at least a day or two prior to problem occurring .

** you can add the other hives also with this procedure

http://www.nu2.nu/pebuilder/       BARTPE
http://www.ubcd4win.com/            UBCD4WIN
0
 

Author Comment

by:juniorsa
ID: 38754549
Hi,
System restore is OFF.
I mentioned this earlier.
I did boot the UBCD and found only today's snapshot.
Thanks,
0
 
LVL 3

Expert Comment

by:tsnirone
ID: 38754646
To atleast get it working so that you can access internet my workaround for this would be to set the IP adress static manually and add the dns-server adresses and make them identical to what you find when you "ipconfig /all" on a PC that is working. If the dns-server is your lan router and it is not working you could try to use the dns-servers for your ISP.

Also you could try to go to Add/remove programs, then go to Windows components and remove all related to network. Then reboot and go back and add it again. (You will need XP CD for this I think)

Here is another tip but I'm NOT sure I've seen it done like that before so make sure you backup your registry:

http://thesourcecomputing.biz/component/content/article/41-tips/92-reseting-windows-winsock-tcpip-stack-.html

Good luck man! :)
0
 
LVL 91

Expert Comment

by:nobus
ID: 38755015
I KNOW that it's off
did you check like suggested?
0
 

Author Comment

by:juniorsa
ID: 38755040
as I already mentioned
I did boot the UBCD and found only today's snapshot.
0
 
LVL 30

Assisted Solution

by:flubbster
flubbster earned 125 total points
ID: 38755047
Please do this:

Open device Manager and click on the View Option. Select "View Hidden Devices"
Expand "Non-Plug and Play Drivers"

Look for any items with a yellow exclamation point. Particularly:
 Netbios over TCP/IP
netbt.sys

Also look in C:\windows\system32 for the following:

    afd.sys
    tcpip.sys
    netbt.sys

To make sure they are not corrupted, you can replace these three files from the ServicePack/i386 folder
0
 
LVL 91

Expert Comment

by:nobus
ID: 38755106
ok, sorry for misunderstanding
0
 

Author Comment

by:juniorsa
ID: 38756192
I tried all this.
Couldn't get a proper cd to copy good files from.
I'm -reinstalling.
Thanks anyways.
0
 
LVL 3

Expert Comment

by:tsnirone
ID: 38756344
Good luck man! :)
0
 

Author Comment

by:juniorsa
ID: 38770484
not sure how to say this question had no solution.
I reinstalled.
Close question and flag it as no solution - no points.
The experience might help someone else?
0
 
LVL 91

Expert Comment

by:nobus
ID: 38771308
why don't you take your responsibility, and close it yourself?
options for closing are found in the help section - top of the page
0
 

Author Comment

by:juniorsa
ID: 38775610
I don't want to award points - everyone was helpful but nothing actually helped.
I only see delete question, there is no option to close a question unless I accept an answer.
That would be misleading.
Not sure what to do.
0
 
LVL 3

Expert Comment

by:tsnirone
ID: 38776537
I have been in similar situation as you juniorsa, I usually just spread out the points to those I feel contributed the most. They did actually spend time to try and help me so ....

Anyways, glad you got it to work finally - even though you had to reinstall.
0
 

Accepted Solution

by:
juniorsa earned 0 total points
ID: 38776945
Thanks that is what I needed.
0
 
LVL 91

Expert Comment

by:nobus
ID: 38777221
juniorsa -  the reason you only see delete, is that they want you to accept an answer
if NOTHING helped -  don't spread points, but accept your OWN answer
of course -  in some cases, some experts may complain that they helped, but usually not, and explaining it is enough

i hope i can help you better with another question !
0
 

Author Closing Comment

by:juniorsa
ID: 38796104
Didn't work but thanks for all the help!
0

Featured Post

Complete VMware vSphere® ESX(i) & Hyper-V Backup

Capture your entire system, including the host, with patented disk imaging integrated with VMware VADP / Microsoft VSS and RCT. RTOs is as low as 15 seconds with Acronis Active Restore™. You can enjoy unlimited P2V/V2V migrations from any source (even from a different hypervisor)

Join & Write a Comment

Are you unable to synchronize your OST (Offline Storage Table) file with Microsoft Exchange Server? Is your OST file exceeding 2 GB size limit? In Microsoft Outlook 2002 and earlier versions, there is a 2 GB size limit for the OST file. If the file …
We have adopted the strategy to use Computers in Student Labs as the bulletin boards. The same target can be achieved by using a Login Notice feature in Group policy but it’s not as attractive as graphical wallpapers with message which grabs the att…
Internet Business Fax to Email Made Easy - With eFax Corporate (http://www.enterprise.efax.com), you'll receive a dedicated online fax number, which is used the same way as a typical analog fax number. You'll receive secure faxes in your email, fr…
In this tutorial you'll learn about bandwidth monitoring with flows and packet sniffing with our network monitoring solution PRTG Network Monitor (https://www.paessler.com/prtg). If you're interested in additional methods for monitoring bandwidt…

746 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

10 Experts available now in Live!

Get 1:1 Help Now