Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Event Viewer Error 1002 & Warning 1003 - The DHCP server sent a DHCPNACK message


  • This topic is locked This topic is locked
10 replies to this topic

#1 midimusicman79

midimusicman79

  • Members
  • 787 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Norway
  • Local time:10:48 PM

Posted 28 February 2015 - 08:52 AM

Hi, all!

 

I have MS Win XP Pro SP3, and during bootup I am receiving the following Event Viewer Log Error and Warning: 1002 and 1003. I have a ZyXEL P-2812HNU-F3 wireless router and a D-Link AirPlus Xtreme G DWL-G132 Wireless USB Adapter(rev.A).

 

In an attempt to resolve this issue on my own, I have already tried the following ipconfig commands: /showdns, /flushdns, /release and /renew, but unfortunately to no avail.

 

Sadly it turned out to be somewhat risky to run ipconfig /release and ipconfig /renew, as the Event Viewer Log afterwards showed that the Adobe Flash Player Update Service had trouble running, and therefore sent hourly repeating start and stop messages. And hence of course uninstallation and reinstallation was required to resolve the issue.

 

I have also ran FSS and Farbar MiniToolBox, of which logs both came back clean. And I will post these logs upon request. I also have Net Adapter Repair All in One.

 

But now, as to the possible culprit; I suspect malware, however the malware itself has been removed, as I have ran approximately 40 anti-spyware programs, thus eliminating somewhat 300-400 threats totally. So, IMHO my computer is close to spyware-free. I remember having had this particular problem ever since I first started the removal of spyware.

 

However, I do not have any problems connecting to and browsing the Internet, it is just these error messages that are bothering me. I understand that this is a minor issue, but I would really like to know if there is anything at all to do to fix it.

 

 

Event Type: Error
Event Source: DHCP
Event Category: None
Event ID: 1002
Date: 2015-02-26
Time: 11:09:36
User: N / A
Computer: EGEN-6B8E11F08C
Description:
IP address lease 10.0.0.99 for the network card with network address 00134676C8E3 was denied by the DHCP server 10.0.0.138 (The DHCP server sent a DHCPNACK message). For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.


Event Type: Warning
Event Source: DHCP
Event Category: None
Event ID: 1003
Date: 2015-02-26
Time: 11:09:36
User: N / A
Computer: EGEN-6B8E11F08C
Description:
The computer cannot renew the address from the network (from the DHCP server) network adapter with network address 00134676C8E3. The following error occurred: The operation was canceled by the user. Your computer will continue to try to retrieve an address on its own from the network address server (DHCP). For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

 

Any help would be greatly appreciated!

 

Thank you very much in advance!

 

Regards,

midimusicman79


Edited by hamluis, 28 February 2015 - 04:42 PM.
Moved from XP to Am I Infected - Hamluis.

MS Win 10 Pro 64-bit, EAM Pro/EEK, MB 3 Free, WPP, SWB Free, CryptoPrevent Free, NVT OSA and Unchecky, WFW, FFQ with CanDef, uBO, Ghostery, Grammarly Free and HTTPS Ew. Acronis TI 2018, K. Sw. Upd. AM-tools: 9-lab RT BETA, AdwCleaner, Auslogics AM, aswMBR, Avira PCC, BD ART, catchme, Cezurity AV, CCE, CKS, ClamWin P., Crystal Sec., DDS, DWCI, EMCO MD, eScan MWAV, ESS/EOS, FGP, FMTB, FRST, F-SOS, FSS, FreeFixer, GMP, GMER, hP BETA, HJT, Inherit, JRT, K. avz4, KVRT, K. TDSSKiller, LSP-Fix, MB 3 Free, MBAR BETA, MA Stinger, NMC, NoBot, NPE, NSS, NVT MRF (NMRF), OTL, PCC, QD, RCS, RSIT, RKill, Rs, SC, SR, SAP, SVRT, SAS, SL, TMHC, TSA ART, UHM, Vba32 AR, VRS, WR (AiO), Xvirus PG, ZAM, ZHPC, ZHPD and Zoek. I have 23 Years of PC Experience. Bold = effective.


BC AdBot (Login to Remove)

 


#2 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 73,530 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:04:48 PM

Posted 03 March 2015 - 01:12 PM

I suspect a memory issue.. but lets do this scan first.

cvMlKv6.pngESET Online Scanner
  • Hold down Control and click on this link to open ESET Online Scanner in a new window.
  • Click the esetonlinebtn.png button.
  • For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
  • Click on esetsmartinstaller_enu.exe to download the ESET Smart Installer. Save it to your desktop.
  • Double click on the esetsmartinstaller_enu.png icon on your desktop.
  • Check "YES, I accept the Terms of Use."
  • Click the Start button.
  • Accept any security warnings from your browser.
  • Under scan settings, check "Scan Archives" and "Remove found threats"
  • Click Advanced settings and select the following:
    • Scan potentially unwanted applications
    • Scan for potentially unsafe applications
    • Enable Anti-Stealth technology
  • ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
  • When the scan completes, click List Threats
  • Click Export, and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
  • Click the Back button.
  • Click the Finish button.
  • NOTE: Sometimes if ESET finds no infections it will not create a log.

How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#3 midimusicman79

midimusicman79
  • Topic Starter

  • Members
  • 787 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Norway
  • Local time:10:48 PM

Posted 06 March 2015 - 10:01 AM

Hi, boopme.

 

Thanks for the prompt reply, sir! :)

 

My apologies for not answering sooner, but on Wednesday I was scanning my computer with ESET Online Scanner as requested, namely my local C: drive, removable D: drive and extra internal K: drive, which actually took several hours to complete, thus basically causing me to run out of time.

 

On Thursday I had a yearly dental appointment, which I had to keep.

 

Today I have scanned my backup L: drive, with lots of data on it.

 

FWIW / FYI, my computer is nine years old, and therefore online scans run fairly slowly.

 

Anyway, neither scans found any threats. :thumbup2: However, there were no logs created.

 

I suspect a memory issue.. but lets do this scan first.

 

Please elaborate the first phrase. Although, bear in mind that I have ECC memory on my computer.

 

Do you want me to post the logs from FSS and Farbar MiniToolBox?

 

I am awaiting your next step. :busy:

 

Regards,

midimusicman79


Edited by midimusicman79, 07 March 2015 - 08:58 AM.

MS Win 10 Pro 64-bit, EAM Pro/EEK, MB 3 Free, WPP, SWB Free, CryptoPrevent Free, NVT OSA and Unchecky, WFW, FFQ with CanDef, uBO, Ghostery, Grammarly Free and HTTPS Ew. Acronis TI 2018, K. Sw. Upd. AM-tools: 9-lab RT BETA, AdwCleaner, Auslogics AM, aswMBR, Avira PCC, BD ART, catchme, Cezurity AV, CCE, CKS, ClamWin P., Crystal Sec., DDS, DWCI, EMCO MD, eScan MWAV, ESS/EOS, FGP, FMTB, FRST, F-SOS, FSS, FreeFixer, GMP, GMER, hP BETA, HJT, Inherit, JRT, K. avz4, KVRT, K. TDSSKiller, LSP-Fix, MB 3 Free, MBAR BETA, MA Stinger, NMC, NoBot, NPE, NSS, NVT MRF (NMRF), OTL, PCC, QD, RCS, RSIT, RKill, Rs, SC, SR, SAP, SVRT, SAS, SL, TMHC, TSA ART, UHM, Vba32 AR, VRS, WR (AiO), Xvirus PG, ZAM, ZHPC, ZHPD and Zoek. I have 23 Years of PC Experience. Bold = effective.


#4 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 73,530 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:04:48 PM

Posted 09 March 2015 - 01:49 PM

Hi sorry for my delay now.. Had a furnace issue and needed sometime to do it..

Ok, lets look at those 2 logs to be sure. If nothing we go back to the other forum and have them check things.
How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#5 midimusicman79

midimusicman79
  • Topic Starter

  • Members
  • 787 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Norway
  • Local time:10:48 PM

Posted 10 March 2015 - 10:10 AM

Hi again, boopme!

 

Thanks for replying, and glad to hear that you have fixed it. :)

 

Here are the logs:

 

(Sorry for my somewhat bad English in the second log - had to use Google Translate in a hurry.)

 

The errors in the first log are due to ESET Smart Security, which unfortunately blocks the connections regardless of being disabled or not.

 

Looks like we may have found the actual culprit, namely the file: pnrpnsp.dll :thumbup2:

 

Guess I must have overlooked these entries at first glance.

 

Regards,

midimusicman79

 

 

FSS log:

 

Farbar Service Scanner Version: 17-01-2015
Ran by Torbjoern Martin (administrator) on 10-03-2015 at 11:59:07
Running from "C:\Documents and Settings\Torbjoern Martin\Desktop"
Microsoft Windows XP Professional Service Pack 3 (X86)
Boot Mode: Normal
****************************************************************

Internet Services:
============

Connection Status:
==============
Localhost is accessible.
LAN connected.
Attempt to access Google IP returned error. Google IP is unreachable
Attempt to access Google.com returned error: Google.com is unreachable
Attempt to access Yahoo.com returned error: Yahoo.com is unreachable


Windows Firewall:
=============

Firewall Disabled Policy:
==================
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall"=DWORD:0


System Restore:
============

System Restore Policy:
========================


Security Center:
============


Windows Update:
============

Windows Autoupdate Disabled Policy:
============================


Other Services:
==============


File Check:
========
C:\WINDOWS\system32\dhcpcsvc.dll => File is digitally signed
C:\WINDOWS\system32\Drivers\afd.sys => File is digitally signed
C:\WINDOWS\system32\Drivers\netbt.sys => File is digitally signed
C:\WINDOWS\system32\Drivers\tcpip.sys => File is digitally signed
C:\WINDOWS\system32\Drivers\ipsec.sys => File is digitally signed
C:\WINDOWS\system32\dnsrslvr.dll => File is digitally signed
C:\WINDOWS\system32\ipnathlp.dll => File is digitally signed
C:\WINDOWS\system32\netman.dll => File is digitally signed
C:\WINDOWS\system32\wbem\WMIsvc.dll => File is digitally signed
C:\WINDOWS\system32\srsvc.dll => File is digitally signed
C:\WINDOWS\system32\Drivers\sr.sys => File is digitally signed
C:\WINDOWS\system32\wscsvc.dll => File is digitally signed
C:\WINDOWS\system32\wbem\WMIsvc.dll => File is digitally signed
C:\WINDOWS\system32\wuauserv.dll => File is digitally signed
C:\WINDOWS\system32\qmgr.dll => File is digitally signed
C:\WINDOWS\system32\es.dll => File is digitally signed
C:\WINDOWS\system32\cryptsvc.dll => File is digitally signed
C:\WINDOWS\system32\svchost.exe => File is digitally signed
C:\WINDOWS\system32\rpcss.dll => File is digitally signed
C:\WINDOWS\system32\services.exe => File is digitally signed


Extra List:
=======
Epfwndis(21) epfwtdi(23) Gpc(3) IPSec(5) NetBT(6) PSched(7) Tcpip(4) Tcpip6(8)
0x1700000005000000010000000200000003000000040000000800000017000000160000001400000006000000070000000A000000090000000B0000000C0000000D0000000E0000000F0000001000000011000000120000001300000015000000
IpSec Tag value is correct.

**** End of log ****

 

 

Farbar MiniToolBox log:

 

MiniToolBox by Farbar Version: 03/09/2015

Ran by Torbjoern Martin (administrator) on 10-03-2015 at 14:57:01

Running from "C:\Documents and Settings\Torbjoern Martin\Desktop
Microsoft Windows XP Professional Service Pack 3 (X86)
Model: System Product Name Manufacturer: System manufacturer
Boot Mode: Normal
****************************************************************************

========================= Flush DNS: ====================================

Windows IP Configuration

DNS resolver cache was cleared.

========================= IE Proxy Settings: ===============================

Proxy is not enabled.
No Proxy Server is set.

"Reset IE Proxy Settings": IE Proxy Settings were reset.

========================= FF Proxy Settings: ===============================

"Reset FF Proxy Settings": Firefox Proxy settings were reset.

========================= Hosts content: ==================================

127.0.0.1 localhost
127.0.0.1 localhost

========================= IP Configuration: =================================

1394 NIC = 1394 connection (Connected)
1394 NIC = 1394 Connection 2 (Connected)
D-Link AirPlus G DWL-G132 Wireless USB Adapter (Rev.) = Wireless Network Connection 9 (Connected)


# ----------------------------------
# IP Configuration interface
# ----------------------------------
pushd interface ip


# IP Configuration interface "Wireless Network Connection 9"

set address name = "Wireless Network Connection 9" source = dhcp
set dns name = "Wireless Network Connection 9" source = dhcp registry = PRIMARY
set wins name = "Wireless Network Connection 9" source = dhcp


popd
# End of the IP configuration interface


Windows IP Configuration

        Host Name. . . . . . . . . . . : EGEN-6b8e11f08c
        Primary DNS suffix. . . . . . . :
        Node Type. . . . . . . . . . . . : Unknown
        IP routing enabled. . . . . . . : No
        WINS Proxy enabled. . . . . . . : No
        Search List DNS suffix. . . . : Lan

 

Wireless Ethernet card Network Connection 9:

        Connection-specific DNS Suffix: lan
        Description. . . . . . . . . . : D-Link AirPlus G DWL-G132 Wireless USB Adapter (Rev.)
        Physical Address. . . . . . . . . : 00-13-46-76-C8-E3
        DHCP enabled. . . . . . . . . . Yes
        Automatic configuration enabled: Yes
        IP address. . . . . . . . . . . : 10.0.0.99
        Subnet Mask. . . . . . . . . : 255.255.255.0
        IP address. . . . . . . . . . . : Fe80 :: 213: 46ff: fe76: c8e3% 5
        Default Gateway. . . . . . . . : 10.0.0.138
        DHCP server. . . . . . . . . . . : 10.0.0.138
        DNS servers. . . . . . . . . . . : 130.67.15.198
                                           193.213.112.4
                                           10.0.0.138
                                           fec0: 0: 0: ffff :: 1% 1
                                           fec0: 0: 0: ffff :: 2% 1
                                           fec0: 0: 0: ffff :: 3% 1
        Lease agreement received. . . . . . 10 March 2015 8:52:27
        Lease agreement expires . . . . . : 11 March 2015 8:52:27


Tunnel Cards Teredo Tunneling Pseudo-Interface:

        Connection-specific DNS Suffix:
        Description. . . . . . . . . . : Teredo Tunneling Pseudo-Interface
        Physical Address. . . . . . . . . : 00-00-FB-CE-AF-2A-1D-E6
        DHCP enabled. . . . . . . . . . : No
        IP address. . . . . . . . . . . : 2001: 0: 5ef5: 79fd: 0: fbce: af2a: 1de6
        IP address. . . . . . . . . . . : Fe80 :: ffff: ffff: FFFD% 4
        Default Gateway. . . . . . . . : ::
        NetBIOS over TCP / IP. . . . . . . : Disabled


Tunnel Short Automatic Tunneling Pseudo-Interface:

        Connection-specific DNS Suffix: lan
        Description. . . . . . . . . . : Automatic Tunneling Pseudo-Interface
        Physical Address. . . . . . . . . : 0A-00-00-63
        DHCP enabled. . . . . . . . . . : No
        IP address. . . . . . . . . . . : Fe80 :: 5efe: 10.0.0.99% 2
        Default Gateway. . . . . . . . :
        DNS servers. . . . . . . . . . . : Fec0: 0: 0: ffff :: 1% 1
                                           fec0: 0: 0: ffff :: 2% 1
                                           fec0: 0: 0: ffff :: 3% 1
        NetBIOS over TCP / IP. . . . . . . : Disabled

Server: ns11.e.nsc.no
Address: 130.67.15.198

Name: google.com
Addresses: 148.123.29.84, 148.123.29.99, 148.123.29.114, 148.123.29.104
148.123.29.108, 148.123.29.88, 148.123.29.103, 148.123.29.89, 148.123.29.123
148.123.29.93, 148.123.29.109, 148.123.29.98, 148.123.29.113, 148.123.29.94
148.123.29.119, 148.123.29.118

Pinging google.com [148.123.25.44] with 32 bytes of data:

Reply from 148.123.25.44: bytes = 32 time = 46ms TTL = 56
Reply from 148.123.25.44: bytes = 32 time = 46ms TTL = 56

Ping statistics for 148.123.25.44:
    Packages: sent = 2, received = 2, lost = 0 (0% loss),

Average time for return in milliseconds:
    minimum = 46ms, Maximum = 46ms, Average = 46ms

Server: ns11.e.nsc.no
Address: 130.67.15.198

Name: yahoo.com
Addresses: 206.190.36.45, 98138253109, 98.139.183.24

Pinging yahoo.com [98,138,253,109] with 32 bytes of data:

Reply from 98138253109: bytes = 32 time = 205ms TTL = 46
Reply from 98138253109: bytes = 32 time = 202ms TTL = 46

Ping statistics for 98138253109:
    Packages: sent = 2, received = 2, lost = 0 (0% loss),

Average time for return in milliseconds:
    minimum = 202ms, Maximum = 205ms, Average = 203ms

Pinging 127.0.0.1 with 32 bytes of data:

Reply from 127.0.0.1: bytes = 32 time <1ms TTL = 64
Reply from 127.0.0.1: bytes = 32 time <1ms TTL = 64

Ping statistics for 127.0.0.1:
    Packages: sent = 2, received = 2, lost = 0 (0% loss),

Average time for return in milliseconds:
    minimum = 0ms, Maximum = 0ms, Average = 0ms

============================================================================
Interface List
0x1 ........................... MS TCP Loopback interface
0x10003 ... 00 13:46 76 c8 e3 ...... D-Link AirPlus G DWL-G132 Wireless USB Adapter (Rev.) - Mini Port Packet Scheduler
============================================================================
============================================================================
Active routes:
Networkmask Subnet Mask Gateway Interface Metrics
          0.0.0.0 0.0.0.0 10.0.0.138 10.0.0.99 25
         10.0.0.0 255.255.255.0 10.0.0.99 10.0.0.99 25
        10.0.0.99 255,255,255,255 127.0.0.1 127.0.0.1 25
   10,255,255,255 255,255,255,255 10.0.0.99 10.0.0.99 25
        127.0.0.0 255.0.0.0 127.0.0.1 127.0.0.1 1
      169.254.0.0 255.255.0.0 10.0.0.99 10.0.0.99 20
        224.0.0.0 240.0.0.0 10.0.0.99 10.0.0.99 25
  255,255,255,255 255,255,255,255 10.0.0.99 10.0.0.99 1
Std. Gateway: 10.0.0.138
============================================================================
Fixed routes:
  No
========================= Winsock entries ==================================

Catalog5 01 C:\WINDOWS\system32\mswsock.dll [246784] (Microsoft Corporation)
Catalog5 02 C:\WINDOWS\system32\winrnr.dll [16896] (Microsoft Corporation)
Catalog5 03 C:\WINDOWS\system32\mswsock.dll [246784] (Microsoft Corporation)
Catalog5 04 C:\WINDOWS\system32\pnrpnsp.dll [58880] (Microsoft Corporation)
ATTENTION: The LibraryPath should be "%SystemRoot%\system32\pnrpnsp.dll"

Catalog5 05 C:\WINDOWS\system32\pnrpnsp.dll [58880] (Microsoft Corporation)
ATTENTION: The LibraryPath should be "%SystemRoot%\system32\pnrpnsp.dll"


Catalog5 06 C:\Program Files\Bonjour\ mdnsNSP.dll [121704] (Apple Inc.)
Catalog9 01 C:\WINDOWS\system32\mswsock.dll [246784] (Microsoft Corporation)
Catalog9 02 C:\WINDOWS\system32\mswsock.dll [246784] (Microsoft Corporation)
Catalog9 03 C:\WINDOWS\system32\mswsock.dll [246784] (Microsoft Corporation)
Catalog9 04 C:\WINDOWS\system32\mswsock.dll [246784] (Microsoft Corporation)
Catalog9 05 C:\WINDOWS\system32\mswsock.dll [246784] (Microsoft Corporation)
Catalog9 06 C:\WINDOWS\system32\mswsock.dll [246784] (Microsoft Corporation)
Catalog9 07 C:\WINDOWS\system32\mswsock.dll [246784] (Microsoft Corporation)
Catalog9 08 C:\WINDOWS\system32\mswsock.dll [246784] (Microsoft Corporation)
Catalog9 09 C:\WINDOWS\system32\mswsock.dll [246784] (Microsoft Corporation)
Catalog9 10 C:\WINDOWS\system32\mswsock.dll [246784] (Microsoft Corporation)
Catalog9 11 C:\WINDOWS\system32\mswsock.dll [246784] (Microsoft Corporation)
Catalog9 12 C:\WINDOWS\system32\mswsock.dll [246784] (Microsoft Corporation)
Catalog9 13 C:\WINDOWS\system32\mswsock.dll [246784] (Microsoft Corporation)
Catalog9 14 C:\WINDOWS\system32\mswsock.dll [246784] (Microsoft Corporation)
Catalog9 15 C:\WINDOWS\system32\mswsock.dll [246784] (Microsoft Corporation)
Catalog9 16 C:\WINDOWS\system32\mswsock.dll [246784] (Microsoft Corporation)
Catalog9 17 C:\WINDOWS\system32\mswsock.dll [246784] (Microsoft Corporation)
Catalog9 18 C:\WINDOWS\system32\mswsock.dll [246784] (Microsoft Corporation)
Catalog9 19 C:\WINDOWS\system32\mswsock.dll [246784] (Microsoft Corporation)
Catalog9 20 C:\WINDOWS\system32\mswsock.dll [246784] (Microsoft Corporation)
Catalog9 21 C:\WINDOWS\system32\mswsock.dll [246784] (Microsoft Corporation)
Catalog9 22 C:\WINDOWS\system32\mswsock.dll [246784] (Microsoft Corporation)
Catalog9 23 C:\WINDOWS\system32\mswsock.dll [246784] (Microsoft Corporation)
Catalog9 24 C:\WINDOWS\system32\mswsock.dll [246784] (Microsoft Corporation)
Catalog9 25 C:\WINDOWS\system32\mswsock.dll [246784] (Microsoft Corporation)
Catalog9 26 C:\WINDOWS\system32\mswsock.dll [246784] (Microsoft Corporation)
Catalog9 27 C:\WINDOWS\system32\mswsock.dll [246784] (Microsoft Corporation)
Catalog9 28 C:\WINDOWS\system32\mswsock.dll [246784] (Microsoft Corporation)
Catalog9 29 C:\WINDOWS\system32\mswsock.dll [246784] (Microsoft Corporation)
Catalog9 30 C:\WINDOWS\system32\mswsock.dll [246784] (Microsoft Corporation)
Catalog9 31 C:\WINDOWS\system32\mswsock.dll [246784] (Microsoft Corporation)
Catalog9 32 C:\WINDOWS\system32\mswsock.dll [246784] (Microsoft Corporation)
Catalog9 33 C:\WINDOWS\system32\mswsock.dll [246784] (Microsoft Corporation)
Catalog9 34 C:\WINDOWS\system32\mswsock.dll [246784] (Microsoft Corporation)
Catalog9 35 C:\WINDOWS\system32\rsvpsp.dll [92672] (Microsoft Corporation)
Catalog9 36 C:\WINDOWS\system32\rsvpsp.dll [92672] (Microsoft Corporation)

========================= Event log errors: ================================

Application errors:
==================
Error: (06/03/2015 11:15:08 AM) (Source: WmiAdapter) (User: BUILTIN)
Description: Cannot open service.

Error: (02/27/2015 3:03:05 PM) (Source: Application Error) (User:)
Description: Error in memory area -1760236204.
Wep key exchange did not establish a secure connection installation for 802.1x authentication. The current setting is marked as failed, and the wireless connection will be disconnected.

Error: (02/27/2015 3:02:47 PM) (Source: Application Error) (User:)
Description: Faulting application tcpview.exe, version 3.5.0.0, faulting module ntdll.dll, version 5.1.2600.6055, fault address 0x00010f1e. Processing media-specific event for [tcpview.exe! Ws!]

Error: (02/27/2015 3:01:44 PM) (Source: Application Error) (User:)
Description: Error in memory area -1760236204.
WEP key exchange did not establish a secure connection installation for 802.1x authentication. The current setting is marked as failed, and the wireless connection will be disconnected.

Error: (02/27/2015 3:01:30 PM) (Source: Application Error) (User:)
Description: Faulting application tcpview.exe, version 3.5.0.0, faulting module ntdll.dll, version 5.1.2600.6055, fault address 0x00010f1e. Processing media-specific event for [tcpview.exe! Ws!]

Error: (02/21/2015 0:19:32 PM) (Source: Windows Search Service) (User:)
Description: Unable to start the update because there is no access to content sources. Correct the errors and try to update again. Context: Windows Application, System Index catalog

Error: (02/21/2015 0:15:03 PM) (Source: Windows Search Service) (User:)
Description: Unable to initialize the program. Context: Windows Application Details: Cannot read the content index. (0xc0041800)

Error: (02/21/2015 0:15:03 PM) (Source: Windows Search Service) (User:)
Description: Unable to initialize Collector object. Context: Windows Application, System Index catalog Details: Cannot read the content index. (0xc0041800)

Error: (02/21/2015 0:15:03 PM) (Source: Windows Search Service) (User:)
Description: Unable to initialize plugin <Search.TripoliIndexer>. Context: Windows Application, System Index catalog Details: Cannot read the content index. (0xc0041800)

Error: (02/21/2015 0:15:02 PM) (Source: Windows Search Service) (User:)
Description: The search has detected corrupted data files in the index. The service will attempt to fix this problem automatically rebuild the index. Context: Windows Application, System Index catalog Details: 0xc0041801 (0xc0041801)


System errors:
=============
Error: (10/03/2015 9:00:20 AM) (Source: Service Control Manager) (User:)
Description: Timeout (30000 milliseconds). Waiting for a transaction response from the service wuauserv.

Error: (10/03/2015 9:00:00 AM) (Source: Service Control Manager) (User:)
Description: Timeout (30000 milliseconds). Waiting for a transaction response from the service RasAuto.

Error: (10/03/2015 8:56:10 AM) (Source: Service Control Manager) (User:)
Description: The service iPod service can not be started due to the following error: %%1053

Error: (10/03/2015 8:56:10 AM) (Source: Service Control Manager) (User:)
Description: Timeout (30000 milliseconds). Waiting for service iPod service to connect.

Error: (10/03/2015 8:55:18 AM) (Source: DCOM) (User: EGEN-6b8e11f08c)
Description: DCOM got error "%%1053" when attempting to start the service iPod Service with argument "" to run the server: {063D34A4-BF84-4B8D-B699-E8CA06504DDE}

Error: (03/08/2015 0:24:17 PM) (Source: Service Control Manager) (User:)
Description: Service Application Layer Gateway Service can not be started due to the following error: %%1053

Error: (03/08/2015 0:23:10 PM) (Source: Service Control Manager) (User:)
Description: Timeout (30000 milliseconds). Waiting for service Application Layer Gateway Service to connect.

Error: (03/08/2015 0:20:03 PM) (Source: DHCP) (User:)
Description: IP address lease 10.0.0.99 for the network card with network address 00134676C8E3 was
denied by the DHCP server 10.0.0.138 (DHCP server sent a DHCPNACK message).

Error: (03/07/2015 0:24:44 PM) (Source: DHCP) (User:)
Description: IP address lease 10.0.0.99 for the network card with network address 00134676C8E3 was
denied by the DHCP server 10.0.0.138 (DHCP server sent a DHCPNACK message).

Error: (06/03/2015 11:15:55 AM) (Source: Service Control Manager) (User:)
Description: Timeout (30000 milliseconds). Waiting for a transaction response from the service Shared Access.


Microsoft Office Sessions:
=========================
Error: (06/03/2015 11:15:08 AM) (Source: WmiAdapter) (User: BUILTIN)
Description:

Error: (02/27/2015 3:03:05 PM) (Source: Application Error) (User:)
Description: -1760236204

Error: (02/27/2015 3:02:47 PM) (Source: Application Error) (User:)
Description: tcpview.exe3.5.0.0ntdll.dll5.1.2600.605500010f1e

Error: (02/27/2015 3:01:44 PM) (Source: Application Error) (User:)
Description: -1760236204

Error: (02/27/2015 3:01:30 PM) (Source: Application Error) (User:)
Description: tcpview.exe3.5.0.0ntdll.dll5.1.2600.605500010f1e

Error: (02/21/2015 0:19:32 PM) (Source: Windows Search Service) (User:)
Description: Context: Windows Application, System Index catalog

Error: (02/21/2015 0:15:03 PM) (Source: Windows Search Service) (User:)
Description: Context: Windows Application Details: Cannot read the content index. (0xc0041800)

Error: (02/21/2015 0:15:03 PM) (Source: Windows Search Service) (User:)
Description: Context: Windows Application, System Index catalog Details: Cannot read the content index. (0xc0041800)

Error: (02/21/2015 0:15:03 PM) (Source: Windows Search Service) (User:)
Description: Context: Windows Application, System Index catalog Details: Cannot read the content index. (0xc0041800) Search.TripoliIndexer

Error: (02/21/2015 0:15:02 PM) (Source: Windows Search Service) (User:)
Description: Context: Windows Application, System Index catalog Details: 0xc0041801 (0xc0041801)


========================= Devices: =================================

Name: Multimedia Controls
Description: Multimedia Controls
Class Guid: {4D36E97E-E325-11CE-BFC1-08002BE10318}
Manufacturer:
Service:
Device ID: PCI \ VEN_1131 & DEV_7133 & SUBSYS_81881043 & REV_D0 \ 4 & CF81C54 & 0 & 08F0
Problem: This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and simply click "Enable Device". This starts the Enable Device wizard. Follow the Instructions.

Name: Mass Storage Controller
Description: Mass Storage Controller
Class Guid: {4D36E97E-E325-11CE-BFC1-08002BE10318}
Manufacturer:
Service:
Device ID: PCI \ VEN_1283 & DEV_8211 & SUBSYS_81381043 & REV_11 \ 4 & CF81C54 & 0 & 20F0
Problem: This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and simply click "Enable Device". This starts the Enable Device wizard. Follow the Instructions.

Name: _NEC DVD_RW ND 3550A
Description: CD-ROM drive
Class Guid: {4D36E965-E325-11CE-BFC1-08002BE10318}
Manufacturer: (Standard CD-ROM drives)
Service: cdrom
Device ID: IDE \ CDROM_NEC_DVD_RW_ND-3550A ____________________ 1.05 ____ \ 5 & 20F2915F & 0 & 0.0.0
Problem: This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and simply click "Enable Device". This starts the Enable Device wizard. Follow the Instructions.

Name: _NEC DVD_RW ND 3550A
Description: CD-ROM drive
Class Guid: {4D36E965-E325-11CE-BFC1-08002BE10318}
Manufacturer: (Standard CD-ROM drives)
Service: cdrom
Device ID: IDE \ CDROM_NEC_DVD_RW_ND-3550A ____________________ 1.04 ____ \ 5 & 20F2915F & 0 & 0.1.0
Problem: This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and simply click "Enable Device". This starts the Enable Device wizard. Follow the Instructions.

Name: Intel ® PRO / 1000 PM Network Connection - Mini Port Packet Scheduler
Description: Mini Port Packet Scheduler
Class Guid: {4D36E972-E325-11CE-BFC1-08002BE10318}
Manufacturer: Microsoft
Service: PSched
Device ID: ROOT \ MS_PSCHEDMP \ 0002
Problem: This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and simply click "Enable Device". This starts the Enable Device wizard. Follow the Instructions.

Name: Marvell Yukon 88E8001 / 8003/8010 PCI Gigabit Ethernet Controller - Miniport Packet plan
Description: Mini Port Packet Scheduler
Class Guid: {4D36E972-E325-11CE-BFC1-08002BE10318}
Manufacturer: Microsoft
Service: PSched
Device ID: ROOT \ MS_PSCHEDMP \ 0003
Problem: This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and simply click "Enable Device". This starts the Enable Device wizard. Follow the Instructions.

Name: Nokia N95 8GB
Description: Nokia N95 8GB
Class Guid: {EEC5AD98-8080-425F-922A-DABF3DE3F69A}
Manufacturer: Nokia
Service: WUDFRd
Device ID: ROOT \ WPD \ 0000
Problem: This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and simply click "Enable Device". This starts the Enable Device wizard. Follow the Instructions.

========================= Memory info: =====================================

Percentage of memory in use: 36%
Total physical RAM: 2047.04 MB
Available physical RAM: 1309.98 MB
Total Page File: 3944.28 MB
Available Page File: 3300.3 MB
Total Virtual: 2047.88 MB
Available Virtual: 1972.59 MB

========================= Partitions: ======================================

2 Drive c: () (Fixed) (Total: 217.04 GB) (Free: 184.87 GB) NTFS
3 Drive d: (KINGSTON) (Removable) (Total: 0.93 GB) (Free: 0.37 GB) FAT
4 Drive k: (Extra_Volume) (Fixed) (Total: 232.88 GB) (Free: 231.3 GB) NTFS
5 Drive l: (BB) (Fixed) (Total: 232.88 GB) (Free 167 GB) NTFS

========================= Users: ===========================================

User accounts for \\ EGEN-6b8e11f08c

Administrator
ASPNET
Guest
Help Assistant
IUSR_EGEN-6B8E11F08C
IWAM_EGEN-6B8E11F08C
SUPPORT_388945a0
Torbjern Martin

========================= Restore Points ===================================

03/10/2015 11:48:25 SysStat-2

**** End of log ****


Edited by midimusicman79, 11 March 2015 - 06:15 AM.

MS Win 10 Pro 64-bit, EAM Pro/EEK, MB 3 Free, WPP, SWB Free, CryptoPrevent Free, NVT OSA and Unchecky, WFW, FFQ with CanDef, uBO, Ghostery, Grammarly Free and HTTPS Ew. Acronis TI 2018, K. Sw. Upd. AM-tools: 9-lab RT BETA, AdwCleaner, Auslogics AM, aswMBR, Avira PCC, BD ART, catchme, Cezurity AV, CCE, CKS, ClamWin P., Crystal Sec., DDS, DWCI, EMCO MD, eScan MWAV, ESS/EOS, FGP, FMTB, FRST, F-SOS, FSS, FreeFixer, GMP, GMER, hP BETA, HJT, Inherit, JRT, K. avz4, KVRT, K. TDSSKiller, LSP-Fix, MB 3 Free, MBAR BETA, MA Stinger, NMC, NoBot, NPE, NSS, NVT MRF (NMRF), OTL, PCC, QD, RCS, RSIT, RKill, Rs, SC, SR, SAP, SVRT, SAS, SL, TMHC, TSA ART, UHM, Vba32 AR, VRS, WR (AiO), Xvirus PG, ZAM, ZHPC, ZHPD and Zoek. I have 23 Years of PC Experience. Bold = effective.


#6 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 73,530 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:04:48 PM

Posted 10 March 2015 - 10:36 AM

Great, lets see how it is after this.....

Please click Start > Run, type inetcpl.cpl in the runbox and press enter.
Click the Connections tab and click the LAN settings option.
Verify if "Use a proxy..." is checked, if so, UNcheck it and click OK/OK to exit.
Now check if the internet is working again.

OR

Go to Start ... Run and type in cmd
A dos Window will appear.
Type in the dos window: netsh winsock reset
Click on the enter key.

Reboot your system to complete the process.
How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#7 midimusicman79

midimusicman79
  • Topic Starter

  • Members
  • 787 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Norway
  • Local time:10:48 PM

Posted 11 March 2015 - 10:10 AM

Hi again, boopme.

 

I tried both methods; it turns out that I do not have any proxy. :thumbup2:

 

But unfortunately neither of them seem to work, because the problems persist; the warning 1003 occurred again today, and the errors in the Farbar MiniToolBox log are still present as well. :(

 

I logged the output for the netsh command before and after the reset, in order to see if there were any difference in amount of text, but there was no such difference, in case that matters.

 

Could I try the commands net stop "dns client", net start "dns client", nbtstat -R, nbtstat -RR or is anything else recommendable? (Found these on Google.)

 

(And BTW, does it matter that the Peer Name Resolution Protocol is not running automatically?)

 

Regards,

midimusicman79


Edited by midimusicman79, 12 March 2015 - 09:54 AM.

MS Win 10 Pro 64-bit, EAM Pro/EEK, MB 3 Free, WPP, SWB Free, CryptoPrevent Free, NVT OSA and Unchecky, WFW, FFQ with CanDef, uBO, Ghostery, Grammarly Free and HTTPS Ew. Acronis TI 2018, K. Sw. Upd. AM-tools: 9-lab RT BETA, AdwCleaner, Auslogics AM, aswMBR, Avira PCC, BD ART, catchme, Cezurity AV, CCE, CKS, ClamWin P., Crystal Sec., DDS, DWCI, EMCO MD, eScan MWAV, ESS/EOS, FGP, FMTB, FRST, F-SOS, FSS, FreeFixer, GMP, GMER, hP BETA, HJT, Inherit, JRT, K. avz4, KVRT, K. TDSSKiller, LSP-Fix, MB 3 Free, MBAR BETA, MA Stinger, NMC, NoBot, NPE, NSS, NVT MRF (NMRF), OTL, PCC, QD, RCS, RSIT, RKill, Rs, SC, SR, SAP, SVRT, SAS, SL, TMHC, TSA ART, UHM, Vba32 AR, VRS, WR (AiO), Xvirus PG, ZAM, ZHPC, ZHPD and Zoek. I have 23 Years of PC Experience. Bold = effective.


#8 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 73,530 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:04:48 PM

Posted 11 March 2015 - 01:23 PM

Go to Start ... Run and type in cmd
A dos Window will appear.
Type in the dos window: see below
Click on the enter key.

Reboot your system to complete the process.

If needed : type these one line at a time, press enter after each line. See if it works after each.


netsh interface ipv4 reset
netsh interface ipv6 reset
ipconfig /flushdns
How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#9 midimusicman79

midimusicman79
  • Topic Starter

  • Members
  • 787 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Norway
  • Local time:10:48 PM

Posted 12 March 2015 - 09:51 AM

Hi again, boopme!

 

Firstly I tried netsh interface ipv4 reset, which gave me the error message: Could not find the following command: interface ipv4 reset.

Nextly I tried netsh interface ipv6 reset, which ran successfully(, and reported in its log: OK).

Lastly I tried ipconfig /flushdns, which also ran successfully, and reported: Windows IP Configuration - The DNS Resolver cache was cleared.

 

I rebooted the computer after each line, but the event viewer log showed that error 1002 occurred again both today (Thursday) and Friday. I then ran Farbar MiniToolBox, but the errors in the log were still intact. :(

 

One thing being noteworthy is that the DHCP errors only occur every morning as I am booting the computer, but never when rebooting, even several times during the day. Sometimes the 1003 warning, other times the 1002 error, and else maybe both.

 

I started RegEdit and looked at the actual registry entries myself, and the specific error is that the LibraryPath is C:\WINDOWS\system32\ rather than %SystemRoot%\system32\, as Farbar MiniToolBox correctly reports.

 

Unfortunately, I should also mention that I am getting another event viewer log error 4128 now, which however is a program error, not a system error: This started yesterday, but at first I thought it might be random, but now I realize that it is repeating itself on every boot. I think it could be related to our troubleshooting, but I am not sure. :unsure:

 

Event Type: Error
Event Source: Ci
Event Category: CI Service
Event ID: 4128
Date: 2015-03-11
Time: 11:30:05
User: N / A
Computer: EGEN-6B8E11F08C
Description:
Discovered error 3221225529 in content index at c:\inetpub\catalog.wci. For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

 

How to fix this? / Anything else to try?

 

Regards,

midimusicman79


Edited by midimusicman79, 13 March 2015 - 09:01 AM.

MS Win 10 Pro 64-bit, EAM Pro/EEK, MB 3 Free, WPP, SWB Free, CryptoPrevent Free, NVT OSA and Unchecky, WFW, FFQ with CanDef, uBO, Ghostery, Grammarly Free and HTTPS Ew. Acronis TI 2018, K. Sw. Upd. AM-tools: 9-lab RT BETA, AdwCleaner, Auslogics AM, aswMBR, Avira PCC, BD ART, catchme, Cezurity AV, CCE, CKS, ClamWin P., Crystal Sec., DDS, DWCI, EMCO MD, eScan MWAV, ESS/EOS, FGP, FMTB, FRST, F-SOS, FSS, FreeFixer, GMP, GMER, hP BETA, HJT, Inherit, JRT, K. avz4, KVRT, K. TDSSKiller, LSP-Fix, MB 3 Free, MBAR BETA, MA Stinger, NMC, NoBot, NPE, NSS, NVT MRF (NMRF), OTL, PCC, QD, RCS, RSIT, RKill, Rs, SC, SR, SAP, SVRT, SAS, SL, TMHC, TSA ART, UHM, Vba32 AR, VRS, WR (AiO), Xvirus PG, ZAM, ZHPC, ZHPD and Zoek. I have 23 Years of PC Experience. Bold = effective.


#10 midimusicman79

midimusicman79
  • Topic Starter

  • Members
  • 787 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Norway
  • Local time:10:48 PM

Posted 17 March 2015 - 07:43 AM

Hi again, boopme!
 

I apoligize if you think of me as hopeless and / or if I have offended you regarding the error 4128, which BTW luckily seems to have got fixed on its own. :thumbup2:

 

After having been waiting for a while without any answer, I decided to start fixing the problems on my own. As a result of this, while performing research on Google, I stumbled upon some old FRST log Winsock error entries in several of my prior malware forum help requests, that actually matched the Winsock error entries in the Farbar MiniToolBox log. So I decided to create a fixlist.txt which I consequently ran FRST with, and the pnrpnsp.dll errors were fixed! :thumbup2: And no offence, but yes, I know that FRST is not permitted in this forum, and that I therefore have broken the forum rules by running it, but so be it!

However, the warning 1003 and the error 1002 are still present, which BTW undoubtedly indicates that these are unrelated to the pnrpnsp.dll errors.

And the more I think about the DHCP errors, the more convinced I get about them being quite normal and not really a cause for concern.

Thank you for your help. Feel free to optionally close topic. :)

Regards,
midimusicman79

 

 

FRST Fix log:

 

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 11-03-2015
Ran by Torbjoern Martin at 2015-03-13 16:02:36 Run:1
Running from C:\Documents and Settings\Torbjoern Martin\Desktop
Loaded Profiles: Torbjoern Martin (Available profiles: Torbjoern Martin & Administrator)
Boot Mode: Normal

==============================================

Content of fixlist:
*****************
Winsock: Catalog5 04 C:\WINDOWS\system32\pnrpnsp.dll [58880] (Microsoft Corporation)
Winsock: Catalog5 05 C:\WINDOWS\system32\pnrpnsp.dll [58880] (Microsoft Corporation)
Reboot:
*****************

Winsock: Catalog5 entry 000000000004\\LibraryPath  was set successfully to %SystemRoot%\system32\pnrpnsp.dll
Winsock: Catalog5 entry 000000000005\\LibraryPath  was set successfully to %SystemRoot%\system32\pnrpnsp.dll


The system needed a reboot.

==== End of Fixlog 16:02:36 ====


Edited by midimusicman79, 17 March 2015 - 09:31 AM.

MS Win 10 Pro 64-bit, EAM Pro/EEK, MB 3 Free, WPP, SWB Free, CryptoPrevent Free, NVT OSA and Unchecky, WFW, FFQ with CanDef, uBO, Ghostery, Grammarly Free and HTTPS Ew. Acronis TI 2018, K. Sw. Upd. AM-tools: 9-lab RT BETA, AdwCleaner, Auslogics AM, aswMBR, Avira PCC, BD ART, catchme, Cezurity AV, CCE, CKS, ClamWin P., Crystal Sec., DDS, DWCI, EMCO MD, eScan MWAV, ESS/EOS, FGP, FMTB, FRST, F-SOS, FSS, FreeFixer, GMP, GMER, hP BETA, HJT, Inherit, JRT, K. avz4, KVRT, K. TDSSKiller, LSP-Fix, MB 3 Free, MBAR BETA, MA Stinger, NMC, NoBot, NPE, NSS, NVT MRF (NMRF), OTL, PCC, QD, RCS, RSIT, RKill, Rs, SC, SR, SAP, SVRT, SAS, SL, TMHC, TSA ART, UHM, Vba32 AR, VRS, WR (AiO), Xvirus PG, ZAM, ZHPC, ZHPD and Zoek. I have 23 Years of PC Experience. Bold = effective.


#11 hamluis

hamluis

    Moderator


  • Moderator
  • 56,385 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:03:48 PM

Posted 19 March 2015 - 01:22 PM

OP posted new topic in XP forum regarding warnings...where such are being addressed.

 

This topic is closed to avoid confusion.

 

Louis






0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users