G
Guest
I've read through the posts that show up in google - groups but nothing
suggested has worked for this customer's machine, so here goes...
Original Symptoms: XP Home SP2 machine that had been working cannot get to
the internet. There is no s/w firewall installed, and it is connected to the
internet via DSL, going through a linksys router. Other machines thus
connected can get to the internet ok, but this one can't. The machine pauses
after selecting user logon and task manager shows that only part of the
startup processes are loaded. Several minutes later, the rest of them load.
Norton AV then displays two successive mostly-blank error dialog referencing
email scanning proxy on boot up. The latter looks to be a symptom, not the
problem.
Msconfig showed services.exe being loaded from c:\windows\connectionstatus\
and this turns out to be a variant of W32Sober, so I removed it manually and
using the Symantec removal tool. There was another fishy item in msconfig, a
service named nipientd (no hits on google). In the services applet, the path
to the executable is blank and nothing is found when using xp search to look
for nipientd on C: with system/hidden folders included. There are a few
references to it in the registry as legacy_nipientd, but no indication what
the executable is. Since the service is disabled and has stayed so, I don't
consider it part of the remaining problem, although it might have been a
cause.
If the machine is aquiring an IP address when booting up, it can't be
displayed. Ipconfig returns "internal error occurred: the request is not
supported. unable to query host name." A ping attempt returns "error 2." I
followed the procedure described in kb811259 of deleting the winsock and
winsock2 keys in the registry and reinstalling tcp/ip by using "have disk"
and pointing it to \windows\inf directory. No help. Tried a second ethernet
NIC, no help.
One odd thing that happens during the reinstall of ms tcp/ip is that I get a
"driver not digitally signed" warning. I have reinstalled ip on several other
machines and have never seen that.
lspfix.exe (from cexx.org) shows only two of the three network protocol
handlers present: mswsock.dll and winrnr.dll. rsvpsp.dll is not listed,
although it is in \system32 along with the others, and all are shown to be
Microsoft files. System Information only shows two entries in Components -
Network - Protocol. The two entries listed are MSAFD TCP [tcp/ip] and MSAFD
TCP [udp/ip]. According to kb811259, there should be 10 entries listed here
(e.g. rsvp, et al), and if there are less, the winsock2 key is corrupted.
The problem is that deleting the winsock keys and going through the tcp/ip
reinstall procedure in kb811259 does not correct the problem. A poster in one
of the hits on google said that he had tried a repair reinstall and it had
not corrected the problem, although I don't know that he was having the same
problem (I searched on "unable to query host name"). This makes me wonder if
the inf or pnf file is corrupted or was replaced by malware.
Since networking and inf files are not protected by system file protection,
I didn't expect sfc /scannow to find anything, and it didn't. I was unable to
bring the machine back to the shop because they were running end-of-month
financials, so I will be visiting with them on Monday. The next thing I am
going to try is to replace the appropriate inf files and delete the matching
pnf files before reinstalling tcp/ip.
Anyone else have a more definitive solution?
suggested has worked for this customer's machine, so here goes...
Original Symptoms: XP Home SP2 machine that had been working cannot get to
the internet. There is no s/w firewall installed, and it is connected to the
internet via DSL, going through a linksys router. Other machines thus
connected can get to the internet ok, but this one can't. The machine pauses
after selecting user logon and task manager shows that only part of the
startup processes are loaded. Several minutes later, the rest of them load.
Norton AV then displays two successive mostly-blank error dialog referencing
email scanning proxy on boot up. The latter looks to be a symptom, not the
problem.
Msconfig showed services.exe being loaded from c:\windows\connectionstatus\
and this turns out to be a variant of W32Sober, so I removed it manually and
using the Symantec removal tool. There was another fishy item in msconfig, a
service named nipientd (no hits on google). In the services applet, the path
to the executable is blank and nothing is found when using xp search to look
for nipientd on C: with system/hidden folders included. There are a few
references to it in the registry as legacy_nipientd, but no indication what
the executable is. Since the service is disabled and has stayed so, I don't
consider it part of the remaining problem, although it might have been a
cause.
If the machine is aquiring an IP address when booting up, it can't be
displayed. Ipconfig returns "internal error occurred: the request is not
supported. unable to query host name." A ping attempt returns "error 2." I
followed the procedure described in kb811259 of deleting the winsock and
winsock2 keys in the registry and reinstalling tcp/ip by using "have disk"
and pointing it to \windows\inf directory. No help. Tried a second ethernet
NIC, no help.
One odd thing that happens during the reinstall of ms tcp/ip is that I get a
"driver not digitally signed" warning. I have reinstalled ip on several other
machines and have never seen that.
lspfix.exe (from cexx.org) shows only two of the three network protocol
handlers present: mswsock.dll and winrnr.dll. rsvpsp.dll is not listed,
although it is in \system32 along with the others, and all are shown to be
Microsoft files. System Information only shows two entries in Components -
Network - Protocol. The two entries listed are MSAFD TCP [tcp/ip] and MSAFD
TCP [udp/ip]. According to kb811259, there should be 10 entries listed here
(e.g. rsvp, et al), and if there are less, the winsock2 key is corrupted.
The problem is that deleting the winsock keys and going through the tcp/ip
reinstall procedure in kb811259 does not correct the problem. A poster in one
of the hits on google said that he had tried a repair reinstall and it had
not corrected the problem, although I don't know that he was having the same
problem (I searched on "unable to query host name"). This makes me wonder if
the inf or pnf file is corrupted or was replaced by malware.
Since networking and inf files are not protected by system file protection,
I didn't expect sfc /scannow to find anything, and it didn't. I was unable to
bring the machine back to the shop because they were running end-of-month
financials, so I will be visiting with them on Monday. The next thing I am
going to try is to replace the appropriate inf files and delete the matching
pnf files before reinstalling tcp/ip.
Anyone else have a more definitive solution?