Win2K TCPIP Protocol Driver gone - need it back

[yetilucas]

I came home day one to find my Win2K Server continually rebooting. I never could read the error, it only stayed up a part of a second. I used the Win2KServer CD and repaired the OS. My DNS Server would not run. I downloaded the Microsoft Installer and reinstalled the DNS server.

When I rebooted, quite shortly the mouse started responding very slowly. I tried to get some windows updates and the first it did was the new verification update. I rebooted and went to bed. I tried to download some other updates but the computer stopped on downloading 15 of 17.

Day two, the mouse was still slow. I got some updates the antivirus software told me i had a virus. F-Prot told me I had W32/Poebot.D@bd. Could never find out what that was. Connected over the network and Symantec told me it had Trojan.Dropper and Backdoor.IRC.Bot. I rebooted to safe mode and ran the antivirus software and removed these. I removed an entry from the registry telling one of them to runonce. I rebooted and downloaded some updates. Right away some started installing, must have been those i had downloaded the night before. The system gave me an error that a service had not started. This turned out to be TCPIP. It says that "A device attached to the system is not functioning".

In all my reading, I read something that said to go to the Administrative Tools, Computer Management, Device Manager, View, Show Hidden Devices, Non-Plug and Play, and then right click on TCP/IP and delete. Then reinstall TCPIP.

How the heck do I reinstall the TCPIP Protocol driver?

Now, this is not the TCPIP that you get when you go to a network connection and click Add, Protocol. TCPIP is there, but the device driver for the TCPIP Protocol is not loading at boot. I need that back. I have also tried a couple of the "winsock repair" programs.

Please help, my web server, dns server and mail server are all off line.

 

[SimonDavies]

I would try removing the tcpip protocol and restarting the machine, I would then look at adding the protocol again.

By rights what that should do is refresh the installation of TCPIP (in it's entirety) meaning you don't need to do anything else.

I would also have a look at your hosts file just to make sure that you have had an impact with that as well (sometimes virus' over write that so that you can't get to specific security related websites).

What AV\Firewall are you running on your W2K machine?

 

[yetilucas]

I did remove it.

I did restart it.

What I am asking is how to re-install it.

I am running F-Prot AV, no firewall.

This is a server, not a workstation. The errors are in the event logs, a list of about a dozen services failed to start because TCP/IP Portocol Driver service failed. Now as it can't be found.

 

[SimonDavies]

Have you done a spyware sweep? Have you checked your HOSTS and SERVICES files for corruptions? A silly question, if you removed and readded the protocol, you did also put back the static ip address and dns \ gateway settings didn't you?

Can you please post the error messages along with their error codes?

It sounds like you have more of a problem than just the IP protocol missing. One last thing I would try (although I have only done this on a workstation and not a server) is to fully remove the NIC and everything associated with the network, restart the machine and add it all back in. I will say again that normally by removing the protocol stack and adding it back 'should' put back all of the files required.

 

[yetilucas]

Thanks for the help.

BUT

It is not the protocol that goes with the nic card. It is the TCPIP Protocol Driver "service".

I have reinstalled server and all is fine again. I was trying to avoid a full reinstall (upgrade).

 

[SimonDavies]

I understand that, normally by removing the Protocol and re adding it you refresh everything associated with it, that would normally include the protocol driver. NT4 was prone to having similar problems and usually the only fix options available were removing the NIC and everything in it's entirety or rebuilding the PC.

 

[anken]

I had a similar situation like this last year, my final decision was to reinstall Windows 2000 from scratch. If you have access to your data on the server, I would save'em and do a clean install. It is painfull I know, but in some case...

 

[yetilucas]

Thanks to all that tried.

But

There is a TCPIP driver for the nic cards and whatnot.

There is also a TCPIP protocol driver SERVICE. It is listed under "Non-Plug and Play" devices in the device manager. You have to turn on the "show hidden devices". I never knew that was there before. Once I deleted this, as I was told to do. I could not find anyway to get it back. Every time I booted, the TCPIP service could not be started as it could not be found. In the registry, TCPIP was listed as in c:\winnt\system32\drivers\tcpip.sys and was there. The service just would not start and allow anything to use tcpip. I did the part with the nic cards. Did the part about adding new hardware and adding TCPIP (that was strange and worked as it was suppose to) but still no service would start.

I just reinstalled windows 2000 server on the same machine and it upgraded (downgraded) the system. I had downloaded service pack 4, so i added it before adding IE6 and then going online and doing what amounted to 21 more updates.

It is running just fine right now. Hopefully it won't get hacked again as it did before.

Once again, thanks to all that tried to help. I studied many forums for answers and many help files and microsoft.com and so forth, but nothing worked other than the reinstall.

 

[DanielHaglund]

Something to think about.

Set up a good backup routine and follow it.

Do an image of the server next time you reinstall it and all its components (+ uptated etc). Can be done with software as Norton Ghost or similar. Then when someting like this happens, back up what you can or need then reinstall the server with the image and you are back on track.

/Daniel.