# Solved: Lost network and internet connection after virus removal



## BurghRocks (Aug 12, 2010)

Hi all,

Been driving myself mad for nearly 24hrs now trying to fix this.

I had picked up one of those fake antivirus viruses last night which I believe that I have cleaned. The problem now is that my ethernet adapter (built Realtek Gigabit built into my Asus mobo) now will not connect to the internet. I'm actually very careful about these things however I think a combination of my downloading the Android SDK and Java dev kits, and installing them, opened me up to something from Facebook.
At any rate, Microsoft Security Essentials listed it as the Obfuscator.JM trojan but had no additional details on it. My searches had turned up no additional information. To remove it, I did the following:
1. Ran MSE in Safe Mode. Deleted or Quarantined anything found.
2. Performed AVG virus scan off of bootable disk, nothing found
3. Checked startup files with MSCONFIG
4. Checked files found as questionable by a rootkit program, some unknowns were deleted that I know were not valid files
5. Ran Malwarebytes and got rid of questionable files.

After some reboots sprinkled in between the above steps there were no longer any suspicious files found and nothing out of the ordinary in my registry or startup files. The problem now is that I can not get a network connection. Its not wireless and it had worked perfectly up until last nights virus. To try and fix it, I did the following:

1. Went into Internet Options and ensured that I was not running through a proxy server. (I was but I changed it back).
2. Checked the hosts files and the only thing in there are comments
3. Flushed the DNS, which was successful
4. Uninstalled and reinstalled my ethernet card
5. Performed a system restore to a point few days earlier (checked the virus locations found earlier and they was nothing, viruscans show nothing)
6. Formatted the hard drive and reinstalled Windows 7.
7. Reset the router
8. Also, before the reinstall and everything I plugged a netbook in using the same ethernet cable as the problem pc is using and it worked fine on the netbook so I know its not a cable issue.
9. Ethernet card is listed as working fine in device manager.
10. ipconfig /all lists everything as media disconnected.
11. All other pc's and devices on this network are working fine, have a couple laptops, ipod, etc.

Nothing is working. I've finally gone back to an old restore point from a few days ago after the reinstall failed to fix the problem. I can browse the pc just fine, its just that the ethernet icon in the bottom right tries to connect for a few seconds, then it goes to a red x. A minute later it will try again and then fail again. 
The Windows auto diagnose says that a cable is unplugged but thats just not true, Ive redone it a dozen times now.

At my wits end, any help would be greatly appreciated. Attaching ipconfig /all results.

Thanks,
Burgh


----------



## JohnWill (Oct 19, 2002)

Well, it looks like you have a few issues. Let's reset the stack first.

*TCP/IP stack repair options for use with Vista or Windows 7.*

Start, All Programs\Accessories and *right click* on Command Prompt, select "*Run as Administrator*" to open a command prompt.

In the command prompt window that opens, type type the following commands, each followed by the Enter key:

Reset WINSOCK entries to installation defaults: *netsh winsock reset catalog*

Reset IPv4 TCP/IP stack to installation defaults. *netsh int ipv4 reset reset.log*

Reset IPv6 TCP/IP stack to installation defaults. *netsh int ipv6 reset reset.log*

Reboot the machine.

Next, we need to insure that IPv4 is really enabled, it appears disabled from your IPCONFIG.

*Enable IPv4:*

1. Hold the Windows key and type R, enter "*ncpa.cpl*" (without the quotes) and press Enter
2. Right click on each network connection and select "Properties"
3. Place a checkmark from the box next to "Internet Protocol Version 4 (TCP/IPv4)
4. Click OK to exit the dialog

_NOTE: You should do this for each network connection._

If they're already enabled, ignore this step.

With the cable connected to your router/modem, please do this.

Try these simple tests.

Hold the *Windows* key and press *R*, then type *CMD* (_COMMAND for W98/WME)_ to open a command prompt:

In the command prompt window that opens, type type the following commands one at a time, followed by the _*Enter*_ key:

*NOTE:* For the items below in *red* surrounded with *< >*, see comments below for the actual information content, they are value substitutions from the previous IPCONFIG command output! Do NOT type <computer_IP_address> into the command, that won't work. Also, the < and > in the text is to identify the parameters, they are also NOT used in the actual commands.

Do NOT include the <> either, they're just to identify the values for substitution.

IPCONFIG /ALL

PING <computer_IP_address>

PING <default_gateway_address>

PING <dns_servers>

PING 74.125.45.100

PING yahoo.com

Right click in the command window and choose *Select All*, then hit *Enter* to copy the contents to the clipboard.
Paste the results in a message here.

*<computer_IP_address>* - The *IP Address* of your computer, obtained from the IPCONFIG command above. _(For Vista/Win7, the IPv4 Address)_

*<default_gateway_address>* - The IP address of the *Default Gateway*, obtained from the IPCONFIG command above.

*<dns_servers>* - The IP address of the first (or only) address for *DNS Servers*, obtained from the IPCONFIG command above.

If you are on a machine with no network connection, use a floppy, USB disk, or a CD-RW disk to transfer a text file with the information to allow pasting it here.


----------



## TerryNet (Mar 23, 2005)

I don't understand how you have "gone back to an old restore point from a few days ago" after "6. Formatted the hard drive and reinstalled Windows 7."

The ipconfig /all shows no IPv4 ...

Click on the networking icon in the notification area - Network and Sharing Center - Change adapter settings - right click on your connection - Properties - if Internet Protocol Version 4 is not listed Install it; if listed but not selected then select it; if it's already installed and selected I don't know what's going on.


----------



## JohnWill (Oct 19, 2002)

That's what the reset is for Terry.  You're late again...


----------



## BurghRocks (Aug 12, 2010)

John/Terry,

Thank you both for the replies. To answer your question Terry about the restore point, I had the restores saved on an external USB hard drive so when the format and reinstall did not work, I booted to the Windows CD and told it to restore off of the usb drive. Figured that since it did not solve the problem at least I wouldn't have to also reinstall all my programs.

I'm including a new ipconfig file as well as a screenshot of my connection properties. I don't believe that the ipconfig changed even with the stack reset. IPv4 is/was already enabled but I followed the steps outlined anyways just in case. What I could not do was to ping anything. I'm connected (wired) to the router, it's always been that way, but it wont assign me an ip address. I had previously tried pinging the 74.125.45.100 as I had been looking through some of the past threads you had helped with John but it quickly failed all 4 attempts.

I only have the one connection listed under my network connections screen, its the "Local Area Network" and it just constantly loops from "Enabled" to "Identifying" to "Network Cable Unplugged". It stays on the enabled and identifying states for less than a second each and then says its unplugged for a few seconds before looping again. It's like its trying to connect to the network but something is stopping it.

As I stated earlier, I've tested the cables and I also plugged to a different port on the router, neither of those worked. When I plug in my netbook though to test it works just fine wired (I disable wireless on the netbook).

Thanks again,
Burgh


----------



## JohnWill (Oct 19, 2002)

Did you do the stack reset? If so, try booting in *Safe Mode with Networking* and see if that changes the symptoms.


----------



## BurghRocks (Aug 12, 2010)

Hi John,

I did perform the stack reset and it did not change anything. Additionally, a boot into safe mode does not solve the issue either, it still continues to loop.

Thanks,
Bill


----------



## JohnWill (Oct 19, 2002)

Have you reloaded the drivers?


----------



## BurghRocks (Aug 12, 2010)

For the NIC? If so, then yes, I even tried some updated drivers off of the manufacturers site but the same issue.


----------



## TerryNet (Mar 23, 2005)

The NIC is certainly indicating that it's defective, but I hesitate to say that given the malware issues you had.

After installing Windows fresh did you get the "cable unplugged" and did you do an ipconfig /all, and was it essentially the same as either of the ones you've shown us? If so, I'll suggest that the NIC is defective.


----------



## BurghRocks (Aug 12, 2010)

Hi Terry,

After the install I did get the same cable unplugged message. Once I saw that the behavior was the same, with the looping and all, I did not bother to perform additional tests, I just rebooted and restored the pc.

I have a new card coming overnight and should be here tomorrow. I'll throw that in and see if there is any difference and update this thread. Are there any suggestions on things to clean up before installing the new card other than uninstalling the old one and disabling it in bios?

Burgh


----------



## JohnWill (Oct 19, 2002)

That's all you should have to do. Truthfully, you don't even have to do that, but I would just for a clean slate.


----------



## BurghRocks (Aug 12, 2010)

Well I uninstalled the old card and removed it from bios and put the new card in and everything seems like its back to normal. Done full scans with MSE and Malwarebytes and its all showing ok. Is it possible that a virus or malware could have destroyed an onboard nic? I didn't think that it was but my system is only 4 months old and there were no problems with it up until the virus hit so I have no other explanation. I'll mark this as solved but I have my reservations that it actually is solved. Thanks John and Terry for the help, its much appreciated.


----------



## TerryNet (Mar 23, 2005)

I don't think malware could, or would want to, do physical harm to a NIC. Probably the NIC died and the timing makes it hard to accept that is what happened.


----------



## JohnWill (Oct 19, 2002)

I hate it when that happens.


----------

