Automatic Updates Causing Problems?

[support]

In two separate instances and locations, I have now run into the same
problem with Windows XP machines. I'm inclined to think that it is
because of something that is incompatible with the latest round of
"patch Tuesday" updates, but I cannot be sure. It seems almost virus-
like in the damage that it has done, so I need to narrow it down.
Here is the issue: a Windows XP Pro machine in a Windows Server 2003
Domain cannot access network resources, surf the internet, etc. The
only common programs between the two machines are Symantec Antivirus
Corporate Edition.
When I go to Command Line and try "ipconfig" I get the following
message: "Windows IP Configuration An internal error occurred: The
request is not supported. Please contact Microsoft Product Support
Services for further help. Additional information: Unable to query
host name."
If I "ping localhost" I get "Unable to contact IP driver, error code
2".
I have attempted "netdiag /test:winsock /v" and received the message:
"Failed to get information for a network adapter. The error occurred
was: The pipe is being closed (232)[FATAL] Cannot find TCP/IP
configuration from the registry".
I have removed and re-installed the TCPIP protocol using the
instructions from the Microsoft KB. I have run "sfc /scannow"
I have checked "msinfo32" under Components, Network, Protocol and seen
nothing out of place.
I have run "netsh winsock reset", "netsh winsock reset catalog",
"netsh int ip reset c:\ip_reset.txt" with reboots inbetween each
command. I have run LSPfix and WinsockXPfix to see if there are any
issues to no avail.
I reloaded one machine and it worked, but I'm running out of attempts
to fix this issue. Any help would be appreciated.

 

[c340pilot]

I am experiencing the exact same situation. Windows XP Pro machine
with AVG anti-virus installed. I have automatic updates downloading,
but not the automatic reboot. Rebooted this morning at 10am and all
hell broke loose. I lost all connectivity and it appears that the TCP/
IP protocol is completely hosed. I have tried all the same things you
have tried including uninstalling the TCP/IP protocol, NIC drivers,
etc., etc., without any success.

I am 100% certain that one of the "fixes" has screwed my machine.
Thanks a lot Microsoft. I have spent 7 hours trying to resolve it
without any success. Any help would be GREATLY appreciated.

 

[support]

Found the solution. Hope this works for you too. I basically had to
replace the TCPIP.SYS file using the Windows Repair function. I found
these instructions here: http://forums.scotsnewsletter.com/lofiversion/index.php/t9743.html

There is also now another place with this information
http://www.owenwebs.com/blog/index.cfm/2007/8/17/Virus-caused-TCPIP-Problems

Here are the instructions:
To fix the problem, you have to replace TCPIP.SYS with a good copy.
Reinstalling Windows will not allow you to replace it. Starting in
Safe Mode Command Prompt won't give you the ability to rename or
delete TCPIP.SYS. Starting Windows from the CD and using the Repair
Console will also fail unless you follow this set of steps.

1. Get a copy of TCPIP.SYS by searching "TCPIP.SYS" on your machine,
looking in hidden files and folders. You'll get a bunch of hits. Right
click the files and check the preferences to get the most recent
version that has Revision data from Microsoft. The one in C:\windows
\system32\drivers is not gonna have any file data associated with it,
even though it is exactly the same size as the good file.

2. Put the copy of TCPIP.SYS on the root of your C: drive. I had a
problem when I made a folder for it, so I recommend just copying it
directly to root.

3. Restart your computer with a Windows XP CD (WIN2000 would also
work, I think) and select the Repair console function. Log in as
Administrator (better know your administrator password!).

4.Navigate to C:\windows\system32\drivers. You will be able to see the
TCPIP.SYS file there is you type in DIR, but you won't be able to
delete or rename it.

5. Type in "CHKDSK /P". This runs a disk check on your hard drive and
fixes errors whether the System thinks you need it or not.

6. Type "del TCPIP.SYS" and press Return.

7. Type in "CHKDSK /P" and run the disk check again (yes, I tried to
do do this without this step the first time and it didn't work).

8. Type in "copy C:\TCPIP.SYS". You should get a message that this
completed correctly.

9. Type in "CHKDSK /P" one last time just to be sure (I didn't confirm
that this was required, but why waste all the previous effort?)

10. Type in "Exit" and let the computer restart. Your internet access
should be restored, the Windows Firewall will work, and ipconfig
should be able to config IP.

 

[support]

I thought I would add what else I've found about this issue - I may
have found the actual cause. Every machine that I've done this work
on has been a Dell Optiplex of some sort (don't know why I didn't
notice it before). In every case, when I finally replace the
tcpip.sys file and reboot the machine, I log on and open Internet
Explorer. Each time, the Internet Explorer "run once" page pops up
asking me to set the settings for the first time. The machines got
hosed just after attempting to install Internet Explorer 7 (or an IE7
security update - I'm not sure yet). In any case, I'm done with this
issue.

 

[Guest]

I experience the same problem after I installed 80+ updates on XP Pro. The
TCPIP.SYS was corrupted. I disable System Restore; I stopped the TCPIP
service, deleted the file and replaced it in C:\WINDOWS\system32\drivers and
C:\WINDOWS\system32\dllcache, voila! Do not forget to re-enable System
Restore.

The question is what and why is one of Ms Update corrupt the TCPIP.SYS