Malware Trashed Network Adapter

Topic

New Reply

On WinXP Home Edition, my nephew was infected with malware that we finally got removed, but we still cannot access the internet. AT&T support said that it was a problem with the Network Adapter since everything with the DSL modem and lines were in working order. In Control Panel | Network Connections when we right-click on Local Area Connection | LAN or High Speed Internet (which shows the status as “Connected”), and then click on Repair, we get an error “Failed to query TCP/IP settings of the connection.” Any suggestions on how we can access the internet?

The computer is connected to a router, and all the other computers on the network can access the internet through the router with no problems.

Robert

Reply | Quote

Replies

On WinXP Home Edition, my nephew was infected with malware that we finally got removed, but we still cannot access the internet. AT&T support said that it was a problem with the Network Adapter since everything with the DSL modem and lines were in working order. In Control Panel | Network Connections when we right-click on Local Area Connection | LAN or High Speed Internet (which shows the status as “Connected”), and then click on Repair, we get an error “Failed to query TCP/IP settings of the connection.” Any suggestions on how we can access the internet?

The computer is connected to a router, and all the other computers on the network can access the internet through the router with no problems.

Robert

Look for a little utility program called WinsockFix. It can often resolve such problems.

Reply | Quote

Thanks for the tip, JJ. Unfortunately the WinsockFix utility did not solve the problem and we still cannot connect to the internet. Any other ideas?
Robert

Reply | Quote

Thanks for the tip, JJ. Unfortunately the WinsockFix utility did not solve the problem and we still cannot connect to the internet. Any other ideas?
Robert

1. In Properties for the network connection, uninstall TCP/IP, reboot the PC, then reinstall TCP/IP.

2. If that doesn’t work, go to Device Manager, uninstall the network adapter, then reboot the PC (Windows will “discover” the adapter and reinstall it). As insurance, when you go to Device Manager, write down the full name of the adapter: if Windows can’t find a driver for it on reboot, you can use another PC to search for a driver.

Reply | Quote

Robert,

Hopefully, after following JJ’s advice, you are now able to connect to the Internet. But if not, try the following. I am assuming the problem PC and your others that are connecting okay are connected to the router via Ethernet and not wireless.

Open a Command Prompt window and type in ‘ping 127.0.0.1’ without the quote marks, and press the Enter key. This pings the computer on which you issued the command. It is your loopback address. If your ping is successful, then your NIC is working. If you do not get a successful ping, then your NIC is not working properly, and if you have already installed a new driver, then the NIC will probably need to be replaced.

Enter the command ‘Net View’ without quotes to see if your computer can see the others on your network. You should receive results listing the names of all the computers currently powered up.

Enter the command ‘ipconfig /all’ without quotes, (but include the space between the ‘g’ and the ‘/’). Make a note of the following information:

Default Gateway (this is your routers IP address)

DHCP Server IP address (this assigns IP adresses to your networked computers)

DHCP Enabled – should be yes.

Autoconfiguration Enabled – should be yes.

DNS Server IP addresses (the server(s) that resolve domain names to IP addresses)

IP address of the PC running the command

Subnet mask

Enter the same ‘ipconfig /all’ command on at least one other computer connected to the router via Ethernet. The Default Gateway IP address, the DHCP Server address, DNS Server addresses, and the network mask should all match the ones on the PC having the connection difficulty. DHCP should be on and set to Automatic. Also note the IP address on the PC having difficulty, and the other one you run ipconfig on. If any of these parameters are different (except the PC IP address – each PC is assigned a unique one) on your problem PC, then something has changed them, and they need to be returned to the correct settings.

If all settings prove to be correct, or have been corrected, try pinging the other PC you ran ipconfig on to see if you can send and receive packets. Type into the Command Prompt ‘ping {IP address} where {IP address} is exactly the IP address as listed in the ipconfig command results. For example, ‘ping 192.168.1.145’ without quote marks. If all is well, you should be set to go. You can also ping the other computer using the computer name revealed when you ran the Net Stat command. This will show that DNS is working properly. DNS takes a domain name, such as that of the other computer name, and resolves it to its numeric IP address. If DNS is not working correctly, you would not be able to connect to sites on the Internet.

Reply | Quote

[
Robert,

Open a Command Prompt window and type in ‘ping 127.0.0.1’ without the quote marks, and press the Enter key. This pings the computer on which you issued the command. It is your loopback address. If your ping is successful, then your NIC is working.

This is not true. A local host ping primarily tests the TCP/IP stack.

Regards,
David

Just because you don't know where you are going doesn't mean any road will get you there.

Reply | Quote

”Open a Command Prompt window and type in ‘ping 127.0.0.1’ without the quote marks, and press the Enter key. This pings the computer on which you issued the command. It is your loopback address. If your ping is successful, then your NIC is working.”

This is not true. A local host ping primarily tests the TCP/IP stack.
Regards,
David

Thank you David for pointing that out, as I my earlier statement on the loopback ping was very much incomplete. If the loopback test fails, it shows the IP stack is not responding as expected. The three conditions most likely to cause the loopback failure are corrupt TCP drivers, a failed network adapter (NIC), or some other service interfering with IP. If the loopback ping is successful, then the NIC is working, but if the loopback fails all three possibilities must be checked to determine which one is the culprit.

Reply | Quote

Malware often sets up a proxy server that no longer functions after malware removal. Go to Control Panel>Internet Options>Connections tab>Lan Settings button. Make sure “Use a proxy server….” is not checked.

Jerry

Reply | Quote

One of my favorite fixes is built right into Windows XP SP2.

1. open a command prompt
2. type netsh winsock reset.
3. when the command completes, restart your computer.

Reply | Quote

All very good advice. But a few things in addition may need to be done. I had a problem with a Microsoft Update or else their Remote Assist program, and two misconfigurations showed up:

(1) In Services, the WorkStation Service had disappeared. And, (2) In the Windows XP Pro 32-bit Registry, instead of the Path for making a Network connection being labeled WorkStation, it had become labeled Server. This stopped Secunia PSI dead when it tried to use IE8 to make a Secure (remote) Server Call. Restoring the correct Name label and Path data to the offending Registry Key took care of this error.

You may also need to reinstall the Client for Microsoft Networks. About.com has this article on how to do this . Before doing this installation, take the additional step that if the Client is already installed, highlight it, and choose Uninstall. Reboot. then go through the instructions for the reinstall as listed in the article. There may be some sense in uninstalling other clients which may appear in the same box under your Networking Properties, and reinstalling these as well, rebooting in between each change. Eventually, after two more reboots, my WorkStation Service reappeared and I was back up and running with Secunia PSI.

Maybe some of this will help in this case if all else has failed.

Also available is the Windows XP Repair Console, if you can get your hands on a full retail Windows XP Install Disk. It can be anybody’s disk, as the Product Code is not needed to do a repair. Just do a Repair Reinstall and even missing Windows components may reappear.

One thing to consider in malware cleanup is having backup copies of clean versions of your critical System and Networking files. Comodo, AVG, Super Antispyware, and Avast all can make safe copies, to be used to restore damages which malware can cause to these files. This is something to consider when choosing an antivirus or anti-spyware program or suite.

Also, empty your browser’s Hosts File, and let Windows reset the data. Malware often creates bogus entries here which may foul up Networking even after a successful cleanup. And you may need to redo the setup of your ISP’s specific Network Profile and log-in data, if these are needed for your setup. Usually, ISP’s provide a CD or DVD for this setup.

-- rc primak

Reply | Quote

Thank you very much – to everyone – for all the suggestions, but we are still not able to correct the problem. Apparently the system got trashed more than we realized. So, we are now making preparations to back up data and do the “restore system to factory condition” routine. This seems to be the best solution – and a good way to get a clean system after all the updates are done.

Thanks again to everyone for all the help.

Robert

Reply | Quote

Sounds like everyone is getting complicated here! The first thing I would do is reinstall the driver after a serious malware infection, the current driver is probably corrupted! If that doesn’t resolve it, it’s an issue with the TCP/IP stack in the OS. Probably caused by the malware problem. If that’s the case, you’re looking at a reinstall of the operating system, or doing a “repair” from the install disk. The fact that you have “connectivity” but then don’t seem to have it indicates to me that the driver is corrupted. Reinstall it.

Reply | Quote