Member Avatar for weeds2323

I attempted to remove some malware by myself and believe I successfully removed it, however I am unable to connect to the internet despite having a wireless connection that says connected. There are no packets being sent or received, and all the info under support tab (up address, subnet mask, default gateway) are blank. I also have no ping.executive in my processes anymore, which I think may be the issue

Any help would be greatly appreciated

  • 5 Contributors
  • 12 Replies
  • 257 Views
  • 2 Months Discussion Span
  • Latest Post Latest Post by crunchie

Dani AI

Generated

Good direction from to run a service-level scan and from to collect logs — those are the right first steps. The symptom "wireless says connected but Support shows no IP/subnet/gateway" usually means DHCP or the TCP/IP/Winsock stack was damaged (malware often breaks those registry entries or LSPs), not the radio itself. Reformatting is a last resort; most of these cases are repairable. ()

Do these simple, offline steps first (open a Command Prompt as Administrator on the affected XP box). They collect logs and attempt non‑destructive repairs:

mkdir C:\Logs
ipconfig /all > C:\Logs\ipconfig.txt
sc query Dhcp > C:\Logs\dhcp.txt
ipconfig /release
ipconfig /renew
netsh int ip reset C:\Logs\resetlog.txt
netsh winsock reset

After running the resets, reboot and check the Support tab again. The netsh int ip reset and netsh winsock reset commands are the supported fixes for corrupt TCP/IP and Winsock on XP (winsock reset needs at least XP SP2; if that is not available the KB shows manual registry recovery steps). (support.microsoft.com)

If ping.exe or other system tools are missing or commands fail, run System File Checker to restore protected files: sfc /scannow (it may ask for the XP install media or matching service-pack files). If SFC cannot run or files are gone, copy the specific executable from a trusted machine with the same XP edition and Service Pack, place it into C:\Windows\System32, and reboot — but only do that if the Service Pack matches. Also verify the PATH contains %SystemRoot%\System32 with echo %PATH%. (learn.microsoft.com)

If the problem persists, post the files created in C:\Logs (ipconfig.txt, dhcp.txt, resetlog.txt) plus the FSS/Service‑scanner output and your XP service pack and antivirus name. That gives helpers the exact info they asked for and lets them point to a minimal repair (or confirm a reformat is truly necessary).

Recommended Answers

All 12 Replies

Member Avatar for jholland1964

We need a lot more information, logs of removal programs used, names of the infections, locations of the infections, operating system, anti-virus program, firewall. Without all of that information we will not be able to suggest a solution.

Member Avatar for weeds2323

I am only able to connect to the internet using my phone, so I don't really know how to post logs, and don't really know much about logs anyways. I am running XP, and had the virus that disguises itself as Windows security center. I used super spyware, CCleaner, and Malewarebytes, and I think eradicated the virus. However, the ping.exe process was apparently ended and I can't access the internet anymore.

Member Avatar for jholland1964

How do you normally connect to the internet, dial up, broadband, wireless? Do you know the names of the infections removed?

Edited by jholland1964 because: n/a
Member Avatar for PhilliePhan

Please download and run Farbar Service Scanner
-- Check Include All Files and hit scan. It should produce a log. Please post the FSS.txt for us.

You will need to use a flash drive to transfer FSS and the resulting logs.
Once we see which service was infected, we should be able to get you back online to continue the cleaning process...

Cheers :)
PP

Member Avatar for skilly

easiest thing to do is erase your computer, back up what is important to you, then find somebody who can take care of the situation(i can)

Edited by skilly because: n/a
commented: too drastic at this point -3
Member Avatar for jholland1964

easiest thing to do is erase your computer, back up what is important to you, then find somebody who can take care of the situation(i can)

This truly is not helpful. If you read the information posted by PhilliePhan this situation can very possibly be remedied by the steps he is outlining.

While it is possible that you could help the poster after he has erased his computer, I could also, but neither of us are likely in his location, so that isn't going to do the poster much good.

We rarely recommend a reformat of the computer if at all possible and it is recommended only as a last resort. By reading PhilliePhan's post alone one can tell that point has certainly not been reached in this case.

weeds2323, I strongly recommend that you ignore the advice given by skilly and do follow the instructions given to you by PP. He will lead you the rest of the way.

Member Avatar for PhilliePhan

There is absolutely no need to reformat the computer to fix this problem. We just need to find what service was infected and what registry keys were compromised.

-- One could argue, though, that after any sort of rootkit infection a reformat is the best course of action. But, that applies to the malware involved and not the connectivity issue.

The FSS.txt ought to show us where the problem lies.

Cheers :)
PP

Member Avatar for skilly

by philphan->There is absolutely no need to reformat the computer to fix this problem.


I agree, but perhaps the user is not as skillful as you & your peers. I still stand by my original recommendation(easiest because it is the easiest to understand and do)

Member Avatar for skilly

actually, perhaps your browser is set to 'work offline' or something similar, this happened to my neighbor 1 month ago. but i had to walk over and check his computer in order to find out(just easier than over the phone) ;-)

Member Avatar for PhilliePhan

I agree, but perhaps the user is not as skillful as you & your peers. I still stand by my original recommendation(easiest because it is the easiest to understand and do)

Actually, if the FSS.txt can pinpoint the issue, the OP may be able to download a file to flash drive, transfer it to ill computer and double-click it and reboot and presto - back online.

Simple and non-destructive.

Member Avatar for skilly

exactly as i thought. OP has still not responded

-edit- check the OP's profile for last login, they probably never even read my recommendation...

2 posts, both in this thread

Edited by skilly because: more
Member Avatar for crunchie

Your point?

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.