[hemburyr]

1. Reboot XP into Safe Mode

2. Delete the following files - c:\windows\system32\drivers\tcpip.sys & c:\windows\system32\dllcache\tcpip.sys

3. From your original XP CD or i386 folder on local HDD find the following file - tcpip.sy_ and then expand this file to locations above eg expand c:\i386\tcpip.sy_ c:\windows\system32\drivers\tcpip.sys

4. When both files have been replaced reboot the PC.

[hemburyr]

Source files = original XP CD

So you would probably need to run something like the following -

< drive letter of CD >:\i386\winnt32 /unattend

[trevorjmason]

Many hugs 'n' kisses to "hublerb" for alternative options to the M$ way of doing things when refreshing the TCP stack and Winsock.

While this in itself didn't fix my entire problem, I know it didn't do any harm - and I am prepared for next time.

Final set of hugs 'n' kisses to "hemburyr" for the final suggestion that did resolve the last of my issues following a very nasty trojan infection.

Great work guys. Keep up the good work - as I know you will

[HugoP]

I could get NO tcp ip - when I typed ipconfig /all I got an error message
I tried ALL fixes for 3 days straight - reset EVERYTHING, nothing worked, and was just about to reinstall XP and then.......

Finally the answer was so simple I am kicking myself - spyware/virus had replaced the tcpip.sys file with a new file.

Just delete tcpip.sys in system/drivers and the backup file created by the spyware (tcpip.sys.flg in my case)- it will automatically reset this file to the original (2004) file.

SIMPLE!!!!!!!!

Hugo

[joeker455]

I have been working on a similar problem for 2 days now. All of a sudden my computer will not connect to the internet. I have tried several of the things suggested here however I have not yet tried what you did. I know where to find the tcpip.sys file however where do I find the file created by the spyware if there is one?

[HugoP]

Hi Joeker
The spyware tcpip was in the same directory and just had a different file extention tcpip.sys.flg in my case - maybe do a search for anything called tcpip.
If you delete the proper windows version it should automatically re-create it straight away with the archived windows version, or you could try re-installing the latest service pack.
Anyway keep an eye on the date of tcpip.sys - if it is a unique date to the rest of the components in the system32/drivers you've probably got a spyware version.