1. Computer problem? Tech Support Guy is completely free -- paid for by advertisers and donations. Click here to join today! If you're new to Tech Support Guy, we highly recommend that you visit our Guide for New Members.

Solved: Wireless not working after malware removal

Discussion in 'Networking' started by addielleyes, Nov 1, 2010.

Thread Status:
Not open for further replies.
Advertisement
  1. addielleyes

    addielleyes Thread Starter

    Joined:
    Oct 15, 2010
    Messages:
    9
    Hey

    So my hp tablet (windows xp) was infected with fake virus alerts which would not allow me to connect to the internet.

    The malware has been removed, but I still cannot connect to wireless at any location (others can). Wired ethernet works. Right now my laptop is connected to a wireless router via an ethernet cable.

    I can "see" wireless networks. When I try to connect, I am told I am connected, but I can't do anything and become disconnected in about 5 seconds. The connection continues to "connect" and "disconnect" every 5-10 seconds, although I still can't use the internet either way.
    When I "repair" connection, I am told the ip address cannot be renewed. I have renewed the ip address manually in command prompt, but that doesn't change anything.

    When I run ipconfig/all in command prompt, I get this (minus the host name):

    Windows IP Configuration
    Host Name . . . . . . . . . . . . :
    Primary Dns Suffix . . . . . . . :
    Node Type . . . . . . . . . . . . : Hybrid
    IP Routing Enabled. . . . . . . . : No
    WINS Proxy Enabled. . . . . . . . : No
    Ethernet adapter Wireless Network Connection:
    Media State . . . . . . . . . . . : Media disconnected
    Description . . . . . . . . . . . : Intel(R) PRO/Wireless 2200BG Network
    Connection
    Physical Address. . . . . . . . . : 00-16-6F-94-32-DB
    Ethernet adapter Local Area Connection:
    Connection-specific DNS Suffix . :
    Description . . . . . . . . . . . : Broadcom NetXtreme Gigabit Ethernet
    Physical Address. . . . . . . . . : 00-16-D4-06-E1-08
    Dhcp Enabled. . . . . . . . . . . : Yes
    Autoconfiguration Enabled . . . . : Yes
    IP Address. . . . . . . . . . . . : 10.0.0.9
    Subnet Mask . . . . . . . . . . . : 255.255.255.0
    Default Gateway . . . . . . . . . : 10.0.0.1
    DHCP Server . . . . . . . . . . . : 10.0.0.1
    DNS Servers . . . . . . . . . . . : 10.0.0.1
    Lease Obtained. . . . . . . . . . : Monday, November 01, 2010 3:03:20 PM
    Lease Expires . . . . . . . . . . : Tuesday, November 02, 2010 3:03:20 P
    M

    Help will be very appreciated!
     
  2. addielleyes

    addielleyes Thread Starter

    Joined:
    Oct 15, 2010
    Messages:
    9
    Update: I have also reset Winsock to defaults and made sure the DNS server is being retrieved automatically.

    no differences
     
  3. etaf

    etaf Wayne Moderator

    Joined:
    Oct 2, 2003
    Messages:
    55,931
    What windows version are you running

    there may still be a virus on the PC _ But assuming the PC is clean for the moment

    would you post back the following


    ------------------------------------------------------------------------
    {Device Manager}
    Post back the results in device manager
    If you cannot access the internet with this PC, then you will need to copy the program across to the faulty PC
    Start > control Panel {Vista set to classic view}> system > {Vista, device manager on left hand side} {XP hardware Tab, device manager button} >
    windows 7
    start > control panel> System and Security> Device Manager

    network adaptors, click on the + > post back the devices listed there
    are there any ! ? or X


    post a screen shot of the device manager - network adapters

    To post a screen shot of the active window, hold the Alt key and press the PrtScn key. Open the Windows PAINT application and Paste the screen shot. You can then use PAINT to trim to suit, and save it as a JPG format file.
    To upload it to the forum, open the full reply window and use the Manage Attachments button to upload it here
    ------------------------------------------------------------------------


    ------------------------------------------------------------------------
    {run Xirrus Wi-Fi Inspector} Download and install
    If you cannot access the internet with this PC, then you will need to copy the program across to the faulty PC

    http://www.xirrus.com/library/wifitools.php
    Direct link to the program is here http://www.xirrus.com/library/wifi_download_redirect.php
    Then run and install the program
    if you get an error - You need NET Framework installed for the WiFi Inspector to function.

    Run the program

    post a screen shot of the program running - if there are a lot of networks showing can you click on "networks" top lefthand area - so we can see all the network information, and also post which network "Adapter Name" (1st column) is yours on the list

    To post a screen shot of the active window, hold the Alt key and press the PrtScn key. Open the Windows PAINT application and Paste the screen shot. You can then use PAINT to trim to suit, and save it as a JPG format file.
    To upload it to the forum, open the full reply window and use the Manage Attachments button to upload it here.
    ------------------------------------------------------------------------
     
  4. addielleyes

    addielleyes Thread Starter

    Joined:
    Oct 15, 2010
    Messages:
    9
    As I said, I'm running XP.

    Network Adapters (see attachment):
    -Broadcom NetXtreme Gigabit Ethernet
    -Intel(R) PRO/Wireless 2200BG Network Connection

    ^^ no special icons

    I'm connected to internet with the infected laptop using an ethernet cable plugged into a wireless router.

    Xirrus:
    See attachment
    I took the screenshot right when I first started "connecting" (not). After 5-10 seconds everything on top just says N/A.

    I'm trying to connect to "BEmore."


    Also, the above ipconfig/all was when I was wired/connected.
    This is when I am disconnected and attempting to connect to wireless:

    Windows IP Configuration
    Host Name . . . . . . . . . . . . :
    Primary Dns Suffix . . . . . . . :
    Node Type . . . . . . . . . . . . : Hybrid
    IP Routing Enabled. . . . . . . . : No
    WINS Proxy Enabled. . . . . . . . : No
    Ethernet adapter Local Area Connection:
    Media State . . . . . . . . . . . : Media disconnected
    Description . . . . . . . . . . . : Broadcom NetXtreme Gigabit Ethernet
    Physical Address. . . . . . . . . : 00-16-D4-06-E1-08
    Ethernet adapter Wireless Network Connection:
    Media State . . . . . . . . . . . : Media disconnected
    Description . . . . . . . . . . . : Intel(R) PRO/Wireless 2200BG Network
    Connection
    Physical Address. . . . . . . . . : 00-16-6F-94-32-DB
     

    Attached Files:

  5. etaf

    etaf Wayne Moderator

    Joined:
    Oct 2, 2003
    Messages:
    55,931
    At least the adapter can see the wireless networks

    try removing wireless profiles - see below
    try a tcp /ip repair - see below

    take the wireless security off the router and see if it will connect that way

    what firewall do you have or have had on the PC ?

    Wireless Profiles
    http://mgmcc.forumotion.net/networking-tutorials-f17/removing-an-existing-wireless-profile-t109.htm
    - XP
    http://www.tp-link.com/support/showfaq.asp?id=186
    - delete the preferred networks
    start> control panel> network connections> right click on the wireless connection> listed wireless networks tab in the preferred network list click on each one and - remove button

    you will then have to enter the wireless security key for any networks you connect to
    ------------------------------------------------------------------------

    TCP/IP stack repair options for use with Windows XP with SP2/SP3.

    Start, Run, CMD to open a command prompt:

    In the command prompt window that opens, type type the following commands:

    Note: Type only the text in bold for the following commands.

    Reset TCP/IP stack to installation defaults, type: netsh int ip reset reset.log

    Reset WINSOCK entries to installation defaults, type: netsh winsock reset catalog

    Reboot the machine.
    ------------------------------------------------------------------------
     
  6. addielleyes

    addielleyes Thread Starter

    Joined:
    Oct 15, 2010
    Messages:
    9
    removing wireless profiles does nothing
    tcp/ip repair does nothing (yes, I rebooted)

    The router I'm using isn't mine (so I can't mess with it), but I've tried to connect to many wireless networks, protected and unprotected, with no success, and others can connect to this one so I don't think that's the problem.

    I've not installed any firewalls, so I just have the Windows Firewall that came with the laptop.
     
  7. etaf

    etaf Wayne Moderator

    Joined:
    Oct 2, 2003
    Messages:
    55,931
    Did you get demo versions of Norton/Mcafee etc on the Laptop when purchased ?

    and no errors given when entered

    So wireless has never worked - some laptops have a physical switch to turn wireless on/off OR using the Fn + one of the F keys to toggle the wireless on/off

    post back
    ------------------------------------------------------------------------
    {Device Manager}
    Post back the results in device manager
    If you cannot access the internet with this PC, then you will need to copy the program across to the faulty PC
    Start > control Panel {Vista set to classic view}> system > {Vista, device manager on left hand side} {XP hardware Tab, device manager button} >
    windows 7
    start > control panel> System and Security> Device Manager

    network adaptors, click on the + > post back the devices listed there
    are there any ! ? or X


    post a screen shot of the device manager - network adapters

    To post a screen shot of the active window, hold the Alt key and press the PrtScn key. Open the Windows PAINT application and Paste the screen shot. You can then use PAINT to trim to suit, and save it as a JPG format file.
    To upload it to the forum, open the full reply window and use the Manage Attachments button to upload it here
    ------------------------------------------------------------------------
    ------------------------------------------------------------------------
    {run Xirrus Wi-Fi Inspector} Download and install
    If you cannot access the internet with this PC, then you will need to copy the program across to the faulty PC

    http://www.xirrus.com/library/wifitools.php
    Direct link to the program is here http://www.xirrus.com/library/wifi_download_redirect.php
    Then run and install the program
    if you get an error - You need NET Framework installed for the WiFi Inspector to function.

    Run the program

    post a screen shot of the program running - if there are a lot of networks showing can you click on "networks" top lefthand area - so we can see all the network information, and also post which network "Adapter Name" (1st column) is yours on the list

    To post a screen shot of the active window, hold the Alt key and press the PrtScn key. Open the Windows PAINT application and Paste the screen shot. You can then use PAINT to trim to suit, and save it as a JPG format file.
    To upload it to the forum, open the full reply window and use the Manage Attachments button to upload it here.
    ------------------------------------------------------------------------

    ------------------------------------------------------------------------
    {ipconfig /all}
    If you cannot access the internet with this PC, then you will need to paste the results into something like notepad and then copy onto a machine that can access the internet and post results here
    We would like to see the results from ipconfig /all post back the results here
    -> Start
    -> (XP - enter the following in the RUN box)
    cmd /k ipconfig /all
    -> (Vista or Windows 7 - enter the following in the Search box)
    cmd /k ipconfig /all

    A black box will appear on the screen -
    rightclick in the box
    select all
    enter
    control key + C key - to copy

    then reply here and
    control key + V to paste
    ------------------------------------------------------------------------
     
  8. addielleyes

    addielleyes Thread Starter

    Joined:
    Oct 15, 2010
    Messages:
    9
    My laptop is 4 years old and was reloaded in May, so any remnants of a demo version would be gone.


    The tcp/ip repair in command prompt yielded no errors.

    The wireless worked fine prior to the malware infection.
    The wireless is definitely on, as indicated by a bright blue light.


    The 3 things you asked me to do after that I have already done and posted above.

    Thanks
     
  9. etaf

    etaf Wayne Moderator

    Joined:
    Oct 2, 2003
    Messages:
    55,931
    post back the services running


    From a Johnwill post

    post back the status - started/stopped and automatic/manual
    Check your Services are Started on all PCs:
    • COM+ Event System (for WZC issues)
    • Computer Browser
    • DHCP Client
    • DNS Client
    • Network Connections
    • Network Location Awareness
    • Remote Procedure Call (RPC)
    • Server
    • TCP/IP Netbios helper
    • Wireless Zero Configuration (XP wireless configurations only)
    • WLAN AutoConfig (Vista wireless configurations only)
    • Workstation

    Note: You can check the services in Control Panel, Administrative Tools, Services.

    All of these services should be started, and their startup type should be automatic (or perhaps manual).

    If a service is not running, open it's properties and check the dependencies. Check each of the dependencies and see which one is preventing the service from running. Checking the event log is also a good idea here, there may be clues to what is failing.

    ------------------------------------------------------------------------
     
  10. addielleyes

    addielleyes Thread Starter

    Joined:
    Oct 15, 2010
    Messages:
    9
    COM+ Event System: started, manual
    Computer Browser: (blank), automatic
    DHCP Client: started, automatic
    DNS Client: started, automatic
    Network Connections: started, manual
    Network Location Awareness: started, manual
    Remote Procedure Call: started, automatic
    Server: started , automatic
    TCP/IP NetBIOS Helper: started, automatic
    Wireless Zero Configuration: started, automatic
    Workstation: started, automatic

    The only one not started is "Computer Browser."
    It depends on "Server" and "Workstation," which are both started and automatic. I looked at the event log, but there is a lot of data there and I really don't know what to look for.

    I started "Computer Browser" and got the following message: "The Computer Browser service on Local Computer started and then stopped. Some services stop automatically if they have no work to do, for example, the Performance Logs and Alerts services."
     
  11. etaf

    etaf Wayne Moderator

    Joined:
    Oct 2, 2003
    Messages:
    55,931
    running out of ideas now
    it maybe worth reloading the wireless driver from the PC manufacturers website

    Do you know what malware / Virus you had
     
  12. addielleyes

    addielleyes Thread Starter

    Joined:
    Oct 15, 2010
    Messages:
    9
    I tried reloading the wireless driver, and unfortunately nothing has changed!

    The virus was a fake Microsoft Security Essentials alert. It prevented every other program from running, including the Task Manager.

    (Sorry for the long delay, I just switched jobs.)
    Thank you again for your help!
     
  13. etaf

    etaf Wayne Moderator

    Joined:
    Oct 2, 2003
    Messages:
    55,931
    would explain further

    I suspect this is a malware issue

    Can you connect to your modem/router by cable and see if it works by cable and post back an ipconfig /all
     
  14. addielleyes

    addielleyes Thread Starter

    Joined:
    Oct 15, 2010
    Messages:
    9
    WOW

    The problem has been solved.

    I haven't posted in a while because something similar to the aforementioned malware issue happened to my computer again. This time it was a fake infection alert system called "Antivirus Action." It would not allow me to open any programs whatsoever except for itself, claiming that the items I was attempting to open were infected.
    I followed all the steps on bleepingcomputer to remove it.
    http://www.bleepingcomputer.com/virus-removal/remove-antivirus-action

    Steps 18-20 give instructions to replace the windows HOSTS file (in order to return to default settings), which is located by default in this folder C:\Windows\System32\Drivers\etc

    I followed exactly and now the wireless works perfectly!

    Thanks for trying to help.
    It seems this could be recommended to anyone using windows (for personal use) who has connection problems following malware removal.
     
  15. etaf

    etaf Wayne Moderator

    Joined:
    Oct 2, 2003
    Messages:
    55,931
    (y) thanks for letting us know
    No , each machine needs to be reviewed by the Malware gurus on our site - we do not put any generic virus removal advice as that could actually make the PC unusable
     
  16. Sponsor

As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 733,556 other people just like you!

Loading...
Thread Status:
Not open for further replies.

Short URL to this thread: https://techguy.org/959895