I mounted the hard drive to a computer with Microsoft Forefront and started a full scan which found many virus's. I just auto checked remove on all of them and rebooted into safe mode. After I had booted into safe mode to run malwarebytes only to find the machine couldn't connect to the network.
"DHCP" Service wouldn't start because of missing dependency.
While not not sure what virus cased it started looking at DHCP Dependencies: Tcpip, Afd, NetBT.
I wish I could say it was then I noticed that the NetBT service was missing entirely from the machine at this point. But can not as instead I started digging to AFD service. After no luck even remotely messing with AFD I noticed that NetBT didn't even exist any more. It was gone.
"C:\Windows\system32\drivers\netbt.sys" was missing as well.
Searching Google for how to re-install NetBT was at best unhelpful. I found many posts talking about settings and file restore. But no posts on how to completely restore the service if it was gone.
As such here's how I did it.
- Obtain and place a copy of "C:\Windows\system32\drivers\netbt.sys" in that path. If its missing and no local backup exists you can download the correct service pack the machine is running and extract the service pack and then from the i386 folder. It will be named netbt.sy_ so copy it and then rename it to netbt.sys.
- I exported the Registry service for NetBT from another machine running Windows XP Service Pack 3 and imported into the machine to replace the missing NetBT service.
- HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NetBT
