1. Computer problem? Tech Support Guy is completely free -- paid for by advertisers and donations. Click here to join today! If you're new to Tech Support Guy, we highly recommend that you visit our Guide for New Members.

Cannot Access Internet after Virus Removal - Netbt.sys, NetBios missing - Error 1075

Discussion in 'Virus & Other Malware Removal' started by Lumpola, Oct 4, 2011.

Thread Status:
Not open for further replies.
Advertisement
  1. Lumpola

    Lumpola Thread Starter

    Joined:
    Oct 4, 2011
    Messages:
    60
    After a Trojan attack, I used Kaspersky Virus Remover to remove them. It seems to have been successful, but now I can't access the internet. :mad:

    Below are clues to resolving the problem. I just don't know what to do next.

    Can you help? I'm using XP sp3. :eek:

    =================

    The following files are present in /Windows/System32/Drivers folder...
    * afd.sys
    * tcpip.sys
    * netbt.sys (It was missing; so I copied to here from ServicePackFiles/i386)

    =================

    CMD /K SC QC DHCP reported this...

    [SC] GetServiceConfig SUCCESS

    SERVICE_NAME: dhcp
    TYPE : 20 WIN32_SHARE_PROCESS
    START_TYPE : 2 AUTO_START
    ERROR_CONTROL : 1 NORMAL
    BINARY_PATH_NAME : C:WINDOWS\system32\svchost.exe -k netsvcs
    LOAD_ORDER_GROUP : TDI
    TAG : 0
    DISPLAY_NAME : DHCP Client
    DEPENDENCIES : Tcpip
    : Afd
    : NetBT
    SERVICE_START_NAME : LocalSystem

    =================

    In Device Manager,
    * AFD Networking Support Environment is running successfully
    * TCP/IP Protocol Driver is running successfully
    * NetBios over Tcpip - DOES NOT EXIST

    =================

    In services when attempting to Start these services

    * DHCP Client Properties (Local Computer) and
    * TCP/IP NetBIOS Helper

    I got these errors...

    * Could not start the DHCP Client service on Local Computer
    * Could not start the TCP/IP NetBIOS Helper service on Local Computer
    * Error 1075: The dependency service does not exist or has been marked for deletion.
    * Under the dependencies tab: No Dependencies in either box.

    =================

    Start, Run, SFC /SCANNOW
    It did ask for the XP disc and apparently installed some files.
    No joy.

    =================

    I've run Winsock MicrosoftFixit50203. No joy.

    =================

    The following Services are Started except for those marked:
    • COM+ Event System (for WZC issues)
    • Computer Browser
    *** DHCP Client - CANNOT START - Error 1075 - See above
    • DNS Client
    • Network Connections
    • Network Location Awareness
    • Remote Procedure Call (RPC)
    • Server
    *** TCP/IP Netbios helper - CANNOT START - Error 1075 - See above
    • Wireless Zero Configuration (XP wireless configurations)
    • WLAN AutoConfig (Vista wireless configurations)
    • Workstation

    =================

    IPCONFIG /ALL yielded this information...

    C:\Documents and Settings\Barry>ipconfig /all

    Windows IP Configuration

    Host Name . . . . . . . . . . . . : ASUS
    Primary Dns Suffix . . . . . . . :
    Node Type . . . . . . . . . . . . : Unknown
    IP Routing Enabled. . . . . . . . : No
    WINS Proxy Enabled. . . . . . . . : No

    Ethernet adapter Comcast High Speed Cable:

    Connection-specific DNS Suffix . : hsd1.tn.comcast.net.
    Description . . . . . . . . . . . : ASUSTeK/Broadcom 440x 10/100 Integra
    ted Controller
    Physical Address. . . . . . . . . : 00-E0-18-B0-6F-CC
    Dhcp Enabled. . . . . . . . . . . : Yes
    Autoconfiguration Enabled . . . . : Yes
    IP Address. . . . . . . . . . . . : 0.0.0.0
    Subnet Mask . . . . . . . . . . . : 0.0.0.0
    IP Address. . . . . . . . . . . . : fe80::2e0:18ff:feb0:6fcc%4
    Default Gateway . . . . . . . . . :
    DHCP Server . . . . . . . . . . . : 192.168.1.1
    DNS Servers . . . . . . . . . . . : 68.87.68.166
    68.87.74.166
    fec0:0:0:ffff::1%1
    fec0:0:0:ffff::2%1
    fec0:0:0:ffff::3%1
    NetBIOS over Tcpip. . . . . . . . : Disabled

    Tunnel adapter Teredo Tunneling Pseudo-Interface:

    Connection-specific DNS Suffix . :
    Description . . . . . . . . . . . : Teredo Tunneling Pseudo-Interface
    Physical Address. . . . . . . . . : FF-FF-FF-FF-FF-FF-FF-FF
    Dhcp Enabled. . . . . . . . . . . : No
    IP Address. . . . . . . . . . . . : fe80::ffff:ffff:fffd%5
    Default Gateway . . . . . . . . . :
    NetBIOS over Tcpip. . . . . . . . : Disabled

    C:\Documents and Settings\Barry>nbtstat -n
    Failed to access NetBT driver -- NetBT may not be loaded

    C:\Documents and Settings\Barry>

    =================

    SYSTEM INFO

    Tech Support Guy System Info Utility version 1.0.0.1
    OS Version: Microsoft Windows XP Home Edition, Service Pack 3, 32 bit
    Processor: Intel(R) Pentium(R) 4 CPU 2.80GHz, x86 Family 15 Model 2 Stepping 9
    Processor Count: 1
    RAM: 2047 Mb
    Graphics Card: NVIDIA GeForce 6200 , 512 Mb
    Hard Drives: C: Total - 117796 MB, Free - 88659 MB; D: Total - 152625 MB, Free - 71069 MB; S: Total - 715402 MB, Free - 93111 MB;
    Motherboard: ASUSTeK Computer INC., P4GE-V, REV 1.xx, xxxxxxxxxxx
    Antivirus: Avanquest SystemSuite, Updated: Yes, On-Demand Scanner: Disabled
     
  2. Lumpola

    Lumpola Thread Starter

    Joined:
    Oct 4, 2011
    Messages:
    60
    Looks like it's time to reinstall XP. :( Boo!
     
  3. clb

    clb

    Joined:
    Oct 6, 2011
    Messages:
    1
    Hi Lumpola,

    I got exactly the same problem as you, probably went through the same website as you as I made exactly the same tests. And still not able to find a solution... As my computer is a corporate one, and I have to change country to make it repair, I would like to find a solution by myself...
    By the way, the name of the file which was infected is netbt.sys, right ? (And not betbt.sys as it is written in the title).
    Sorry, this post does not help you, but I hope someone will come to rescue us.
     
  4. Lumpola

    Lumpola Thread Starter

    Joined:
    Oct 4, 2011
    Messages:
    60

    Sorry you're also having the same problem.

    Yes, the title should have read "Netbt.sys." I'd make a correction, but the edit button is now gone from my post.

    I tried replacing a missing Netbt fork in the registry from another XP computer. No joy. I'm sure there are other issues with the registry that I don't understand.

    It looks right now like a reinstall is the only thing that's going to correct this.


     
  5. thesweetdevilguy

    thesweetdevilguy

    Joined:
    Nov 9, 2005
    Messages:
    10
    hi there..

    sorry to be ignorant just assuming that you have replaced the file have you tried registring it

    Click Start, Run and type regsvr32 netbt.sys , and then press Enter

    if this does not work .. you could repair your operating system .. Normally it is the same screen when you format the drive..

    caution : please back your data and try it i hope it works
     
  6. thesweetdevilguy

    thesweetdevilguy

    Joined:
    Nov 9, 2005
    Messages:
    10
    hi there..

    sorry to be ignorant just assuming that you have replaced the file have you tried registring it

    Click Start, Run and type regsvr32 netbt.sys , and then press Enter

    if this does not work .. you could repair your operating system .. Normally it is the same screen when you format the drive..

    caution : please back your data and try it i hope it works

    sorry i am writing the same thing ... hope this helps.. if it does not a complete format will be needed..
     
  7. thesweetdevilguy

    thesweetdevilguy

    Joined:
    Nov 9, 2005
    Messages:
    10
  8. Lumpola

    Lumpola Thread Starter

    Joined:
    Oct 4, 2011
    Messages:
    60
    thesweetdevi,

    I tried registering Netbi.sys as you suggested. Got...

    LoadLibrary("netbr.sys") failed - The specified module could not be found.

    I'll read up on your Microsoft link and let you know.

    Thanks!
     
  9. Cookiegal

    Cookiegal Administrator Malware Specialist Coordinator

    Joined:
    Aug 27, 2003
    Messages:
    110,867
    The registry entries for this NetBT service are probably messed up. There are likely still malware issues remaining as well but first let's try fixing the Internet connection.

    Go to Start - Run and copy and paste the following:

    regedit /e C:\look.txt "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NetBT"

    You won't see anything happen and it will only take a second. You will find the report it creates at C:\look.txt. Please open it in Notepad and then copy and paste the report here.
     
  10. Lumpola

    Lumpola Thread Starter

    Joined:
    Oct 4, 2011
    Messages:
    60
    thesweetdevi,

    Sorry the Microsoft link didn't resolve the issue.
     
  11. Lumpola

    Lumpola Thread Starter

    Joined:
    Oct 4, 2011
    Messages:
    60
    Cookiegal,

    I followed your instructions, but no file was created. I even did a search for look.txt. No joy.

    Please note that I did an import of "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NetBT" from another XP computer since it was missing from mine and attempted to register as it per thesweetdevi with no joy either (see above).

    I can go back to the original damaged registry file if needed via System Restore.

    Thanks for your help.

    What's next?
     
  12. Cookiegal

    Cookiegal Administrator Malware Specialist Coordinator

    Joined:
    Aug 27, 2003
    Messages:
    110,867
    The look.txt file would be in C:

    Do you have a copy of the file you imported?

    Do you know your way around the registry? If so, can you take a look to see if this key exists?

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NetBT
     
  13. Lumpola

    Lumpola Thread Starter

    Joined:
    Oct 4, 2011
    Messages:
    60
    > The look.txt file would be in C:

    I looked in C: and did a search on look.txt just to me sure I hadn't missed it. It doesn't exist.

    > Do you have a copy of the file you imported?

    Yes and I just realized I imported ControlSet010 rather than CurrentControlSet. Shall I go back to my original file? I marked the change with System Restore.

    > Do you know your way around the registry?

    I'm not an expert, but I can get around fairly well.

    > If so, can you take a look to see if this key exists?
    > HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NetBT

    It does NOT exist.
     
  14. Lumpola

    Lumpola Thread Starter

    Joined:
    Oct 4, 2011
    Messages:
    60
    That should be ControlSet001 not 010.
     
  15. Cookiegal

    Cookiegal Administrator Malware Specialist Coordinator

    Joined:
    Aug 27, 2003
    Messages:
    110,867
    Please upload the registry file that you imported as a zip file attachment so I can take a look at it.
     
  16. Sponsor

As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 733,556 other people just like you!

Loading...
Thread Status:
Not open for further replies.

Short URL to this thread: https://techguy.org/1020678

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Dismiss Notice