need computer help

[JoshexProxy]

yes my computer is running.

no there is no red x over my internet icon.

my wifi devices can all see wifi networks, but attempting to connect results in "the connection was unsuccessful"

no I have not tried a direct connection via wire because no one knows the username or password it's all in the router.

I have recently removed a virus called netfilter.sys which adwcleaner flagged as a third party tracking program, however after it's removal I got limited connectivity to the internet.

The more I dug into it the more it looked like netfilter had woven it's way into the net drivers and devices and deleted the original net programs replacing them completely. looking in device manager I saw a slew of net device copies, even some which had not been connected to the computer in years all listed with (netfilter device) after them, so I ended up completely eradicating the registry entries with netfilter in them, it wasn't easy a few had been entered by the SYSTEM account. but I got rid of them and all the netfilter devices in device manager vanished. but still no net.

I replaced the drivers for the devices I use from the manufacturer's website but still have no net and windows trouble shooter still says there's a problem with the drivers for the devices. I am 100% sure it's no the device drivers, but some internal windows components that netfilter had it's way with that are refusing to function for a clean device.

I am running windows 7 ultimate 32bit. if anyone here has a clean system and knows what files, drivers and/or registry entries I need to input to get my wifi back please help or send me a copy of yours. I need windows net drivers, and possibly a new TC/IP copy from what I can see, but someone here may know more.

thankyou ahead of time for any help given.

Edit; I will be willing to pay via paypal for any help that enables me to get my netback without completely reinstalling windows (I really don't want to have to refind and reinstall all my software.)

[Arcana]

The only netfilter.sys malware I'm aware of is a browser hijack malware.  I don't think removing it should have hosed your networking completely, but browser hijack software has been used to install other nasty things.  Maybe your antivirus software found lots of other stuff and damaged something in the process of cleaning up the mess.

I'm not sure what you mean by not having the user name or password to make ethernet connections, but if you are connecting to the internet via wifi, there's often two different wifi configuration programs you can use: one provided by the wifi adapter manufacturer and a generic one that comes with Windows itself.  The only thing that comes to mind if you are having trouble after reinstalling the wifi drivers and software is that I've often had issues when my system tried to run both at the same time.  Either you use the vendor one or the windows one, but not both at the same time.  If one is running, kill the other.

If it is a missing Windows component, then Windows 7 usually can fix that with the troubleshooting wizard.  If it can't, it would be difficult to tell what the problem was without significant technical information.  Does the WLAN see the correct SSID?  Does it actually connect to that SSID?  When you ipconfig /all do you see the wireless adapter, and does it show you acquiring IP address information?

[Ironwolf]

Malwarebytes.

Pull it down onto a flash drive and load it - it will fix nearly anything.

[Suspicious Package]

You can try resetting the Winsock and TCPIP stack.  Sometimes that straightens out issues like this.

1. Run Elevated Command Prompt:
- Click the Start button
- Type: cmd in the Start Search text box.
- right-click and choose "Run as Administrator" (alternatively, press CTRL-SHIFT-ENTER to run it as administrator), and allow elevation request
2. Type: 'netsh winsock reset catalog' in the shell and hit Enter
3. Type: 'netsh int ip reset reset.log' and hit Enter again. If this doesn't work, try 'netsh int ipv4 reset reset.log' to just reset ipv4.
4. Restart the computer

[JoshexProxy]

thankyou all for the prompt replies, I will try all of this from the top tomorrow.

@ Arcana, I only mentioned ethernet because one of the typical IT questions is "have you tried connecting to the internet through a wire" and the answer is I'd like to, but can't because of no username or password for the actual internet account being available atm.

@ Ironwolf, I use malwarebytes regularly, it can't figure out whats wrong. Still I'll try again.

I have a list of the majority of the stuff that was removed so that will make things easier if it comes to files. I just hope I kept cn find the clean/scan logs.

[chuckv3]

"have you tried connecting to the internet through a wire" and the answer is I'd like to, but can't because of no username or password for the actual internet account being available atm.

wired connections do not require a password (like WiFi).

[Codewalker]

Some do. It's possible to run 802.1x over wired connections as well as wireless, but it's rare to encounter outside of locked down corporate environments.

Much more common are old ADSL setups that require establishing a PPPoE link first (which requires a username/password) in order to get an Internet IP.

[Arcana]

Some do. It's possible to run 802.1x over wired connections as well as wireless, but it's rare to encounter outside of locked down corporate environments.

Much more common are old ADSL setups that require establishing a PPPoE link first (which requires a username/password) in order to get an Internet IP.

The "its all in the router" is what made me think it was something other than that, but I don't make a lot of presumptions when troubleshooting in the blind.

[JoshexProxy]

The only netfilter.sys malware I'm aware of is a browser hijack malware.  I don't think removing it should have hosed your networking completely, but browser hijack software has been used to install other nasty things.  Maybe your antivirus software found lots of other stuff and damaged something in the process of cleaning up the mess.

I'm not sure what you mean by not having the user name or password to make ethernet connections, but if you are connecting to the internet via wifi, there's often two different wifi configuration programs you can use: one provided by the wifi adapter manufacturer and a generic one that comes with Windows itself.  The only thing that comes to mind if you are having trouble after reinstalling the wifi drivers and software is that I've often had issues when my system tried to run both at the same time.  Either you use the vendor one or the windows one, but not both at the same time.  If one is running, kill the other.

If it is a missing Windows component, then Windows 7 usually can fix that with the troubleshooting wizard.  If it can't, it would be difficult to tell what the problem was without significant technical information.  Does the WLAN see the correct SSID?  Does it actually connect to that SSID?  When you ipconfig /all do you see the wireless adapter, and does it show you acquiring IP address information?

WLAN does see correct SSIDs it actually connects but acts like it didn't on the internet icon (no change), whilst it lists the connection to the SSID as EDIT: "limited access"

ipconfig /all does not show the device, it shows Windows IP Configuration with the host name being the computer identity,
dns:
node type: hybrid
IP routing enabled: no
WINS Proxy Enabled : no

then followed by tunnel adapter ?*15 , 6, 11, 12, 18, 19,13, 14, 16 all with the same settings:
media state: media disconnected
dns suffix:
description: either Microsoft 6to4 Adapter #1-10 or Microsoft Teredo Tunneling Adapter
physical address: 00-00-00-00-00-00-00-E0
DHCP ENabled: No
autoconfiguration enabled: Yes

also several entries of:
Tunnel adapter 6TO4 Adapter/ tunnel adapter reusable Microsoft 6To4 Adapter
same info.

wifi configuration programs, I don't know what those are or where to find them if they are on my system (help here might be what I need), I reinstalled the driver for the two wifi devices I use.

[JoshexProxy]

You can try resetting the Winsock and TCPIP stack.  Sometimes that straightens out issues like this.

1. Run Elevated Command Prompt:
- Click the Start button
- Type: cmd in the Start Search text box.
- right-click and choose "Run as Administrator" (alternatively, press CTRL-SHIFT-ENTER to run it as administrator), and allow elevation request
2. Type: 'netsh winsock reset catalog' in the shell and hit Enter
3. Type: 'netsh int ip reset reset.log' and hit Enter again. If this doesn't work, try 'netsh int ipv4 reset reset.log' to just reset ipv4.
4. Restart the computer

Did not work, I got a fresh winsock and winsock 2 the other day but that's not the problem.

I'm guessing based purely off intuition that something is wrong with the TCP/IP files on my computer so resetting the stack won't help, I will need a valid IPv4 installer and ipv6 installer to test this intuition as I will need to uninstall IPv4 and 6 on each device and then reinstall it. I'm not sure that would help though.

the problem seems to be that although windows can see the device, the files and services that run net connection can't see the device. hence it is missing from ipconfig, yet the device itself is operating fine and as such can see SSIDs and attempt to connect but when it happens the net connection files and services are either not there to handle the connection operation or though they receive the call they don't respond because they can't see the device. It should show up as ASUS EZ n-10 or something similar.

[Arcana]

WLAN does see correct SSIDs it actually connects but acts like it didn't on the internet icon (no change), whilst it lists the connection to the SSID as EDIT: "limited access"

ipconfig /all does not show the device, it shows Windows IP Configuration with the host name being the computer identity,
dns:
node type: hybrid
IP routing enabled: no
WINS Proxy Enabled : no

then followed by tunnel adapter ?*15 , 6, 11, 12, 18, 19,13, 14, 16 all with the same settings:
media state: media disconnected
dns suffix:
description: either Microsoft 6to4 Adapter #1-10 or Microsoft Teredo Tunneling Adapter
physical address: 00-00-00-00-00-00-00-E0
DHCP ENabled: No
autoconfiguration enabled: Yes

also several entries of:
Tunnel adapter 6TO4 Adapter/ tunnel adapter reusable Microsoft 6To4 Adapter
same info.

wifi configuration programs, I don't know what those are or where to find them if they are on my system (help here might be what I need), I reinstalled the driver for the two wifi devices I use.

That's strange.  If you do not see a wifi adapter listed when you did a ipconfig, then that sounds like the drivers did not install correctly.  Check device manager to see if the wifi adapter driver appears to have an issue.  You can get to the device manager by right-clicking on My Computer and selecting properties, then clicking on Device Manager in the upper left corner of the Control Panel system page.  You should see the wifi adapter under something like "Network adapters".  If you see a yellow warning triangle, then there's something wrong.  If you don't see it at all, your computer isn't even detecting the wifi hardware correctly.

[JoshexProxy]

That's strange.  If you do not see a wifi adapter listed when you did a ipconfig, then that sounds like the drivers did not install correctly.  Check device manager to see if the wifi adapter driver appears to have an issue.  You can get to the device manager by right-clicking on My Computer and selecting properties, then clicking on Device Manager in the upper left corner of the Control Panel system page.  You should see the wifi adapter under something like "Network adapters".  If you see a yellow warning triangle, then there's something wrong.  If you don't see it at all, your computer isn't even detecting the wifi hardware correctly.

no yellow triangle, it is there though, but I installed it's driver before I completely killed the netfilter devices, so reinstalling that might be a good thing to try. will try tonight.

result, same issue no change. the device pops up just fine in device manager when I plug it in.

found this: http://answers.microsoft.com/en-us/windows/forum/windows_7-networking/my-wireless-connection-says-limited-access-no/4536bd94-28ad-40d5-8a4e-6fe29c171039

will attempt to try this too.

[Arcana]

found this: http://answers.microsoft.com/en-us/windows/forum/windows_7-networking/my-wireless-connection-says-limited-access-no/4536bd94-28ad-40d5-8a4e-6fe29c171039

will attempt to try this too.

That article seems to be saying the same things I am: check driver, check adapter (in network connections or ipconfig), check connection (acquired address), check for competing WLAN configuration tools.

[JoshexProxy]

That article seems to be saying the same things I am: check driver, check adapter (in network connections or ipconfig), check connection (acquired address), check for competing WLAN configuration tools.

indeed, if it works you get credit.

it just tells me step by step instructions for each.

[microc]

with older version of windows make sure you turn off /disable the onboard ethernet port if your going ot use wifi. sometimes with both of them on windows wont log onto the net right with wifi. with your wifi stick google the vendor info online. see if the chipset vendor for the usb dongle has newer drivers then the dongle maker. also try hitman pro it another 3 party scanner that finds stuff malware bytes wont. also run msconfig and look under add/remove program for any toolbar helpers or anti virus or anti malware programs you did not install. a lot of trojans and new virus use real looking programs to reinfect your pc over and over. if the virus has damaged windows you may have to back up your files and reinstall it.

[JoshexProxy]

with older version of windows make sure you turn off /disable the onboard ethernet port if your going ot use wifi. sometimes with both of them on windows wont log onto the net right with wifi. with your wifi stick google the vendor info online. see if the chipset vendor for the usb dongle has newer drivers then the dongle maker. also try hitman pro it another 3 party scanner that finds stuff malware bytes wont. also run msconfig and look under add/remove program for any toolbar helpers or anti virus or anti malware programs you did not install. a lot of trojans and new virus use real looking programs to reinfect your pc over and over. if the virus has damaged windows you may have to back up your files and reinstall it.

I'll run hitman, I already do the other stuff on a regular basis

side note, I may have stumbled across the culprit, under device manager I right-clicked one of my adapters and opened it's properties window, went to details and clicked the drop down menu and lo and behold there are at least 10 entries reading {3ab22e31-8264-4b4e-9af5-a8d2d8e33e62}[1] - [10]

suspicious I think, now how to test that theory, finding their file locations is going to be a hassle if they aren't named the same, their registry entries should be easy to find, the question is kill or don't kill?

[Arcana]

I'll run hitman, I already do the other stuff on a regular basis

side note, I may have stumbled across the culprit, under device manager I right-clicked one of my adapters and opened it's properties window, went to details and clicked the drop down menu and lo and behold there are at least 10 entries reading {3ab22e31-8264-4b4e-9af5-a8d2d8e33e62}[1] - [10]

suspicious I think, now how to test that theory, finding their file locations is going to be a hassle if they aren't named the same, their registry entries should be easy to find, the question is kill or don't kill?

Don't mess with those.  I'm pretty sure that's the PCI device root GUID.  In other words, it is the place where device drivers store their PCI device properties.

Yep, here it is in the pci include file pciprop.h from the Windows SDK:

//
// The GUID {3AB22E31-8264-4b4e-9AF5-A8D2D8E33E62} is a seed for all properties
// defined for a PCI device.
//

#define DEFINE_PCI_DEVICE_DEVPKEY(_DevPkeyName, _Pid) \
   DEFINE_DEVPROPKEY((_DevPkeyName), 0x3ab22e31, 0x8264, 0x4b4e, 0x9a, 0xf5, 0xa8, 0xd2, 0xd8, 0xe3, 0x3e, 0x62, (_Pid))

My PCI devices also have those keys: in particular my AMD Radeon and my Realtek PCIe gig ethernet.  If it is a PCI(e) device under Windows Vista and higher, it will probably have those keys.  There seem to be 25 sub properties listed, so you can see subs from [1] to [25] inclusive.  However, not every device must implement them all: my Realtek only uses 1-17 and 25.  That's normal (I guess the Realetk doesn't implement those PCI error handling options).

[JoshexProxy]

Don't mess with those.  I'm pretty sure that's the PCI device root GUID.  In other words, it is the place where device drivers store their PCI device properties.

Yep, here it is in the pci include file pciprop.h from the Windows SDK:

My PCI devices also have those keys: in particular my AMD Radeon and my Realtek PCIe gig ethernet.  If it is a PCI(e) device under Windows Vista and higher, it will probably have those keys.  There seem to be 25 sub properties listed, so you can see subs from [1] to [25] inclusive.  However, not every device must implement them all: my Realtek only uses 1-17 and 25.  That's normal (I guess the Realetk doesn't implement those PCI error handling options).

ok so don't kill.

hmm it's gonna be a long few days before I have time to even get hitman and run it or try anything you said.  crap, it might be a week before I can do anything.

sick + work +sudden train trip coming up then followed by more work. I'm sure someone else has it worse lol.

[Arcana]

Have you considered performing a system restore to a date earlier than when you tried to clean the virus off your system? 

I must caution you that whenever I'm involved in complex repairs on a system especially when I lack complete information about the problem, I always consider making a backup first because in trying to make it better you can always make it worse.

Having said that, doing a system restore to previous version should keep all your data, and just revert windows and its drivers and subsystems to an earlier configuration.  That might fix the problem.  It can break apps installed after the restore point because shared libraries and registry settings get reverted, but it should keep your own files intact.  If things are working correctly, Windows should also actually make a restore point before reverting to an earlier restore point, so you can jump back to the configuration you have now (broken and all) if things don't go well.  Nothing is foolproof, but this might be a reasonable thing to try.  It is probably the safest thing I can recommend sight unseen.

See here:

http://windows.microsoft.com/en-us/windows/system-restore-faq#1TC=windows-7

[JoshexProxy]

Have you considered performing a system restore to a date earlier than when you tried to clean the virus off your system? 

I must caution you that whenever I'm involved in complex repairs on a system especially when I lack complete information about the problem, I always consider making a backup first because in trying to make it better you can always make it worse.

Having said that, doing a system restore to previous version should keep all your data, and just revert windows and its drivers and subsystems to an earlier configuration.  That might fix the problem.  It can break apps installed after the restore point because shared libraries and registry settings get reverted, but it should keep your own files intact.  If things are working correctly, Windows should also actually make a restore point before reverting to an earlier restore point, so you can jump back to the configuration you have now (broken and all) if things don't go well.  Nothing is foolproof, but this might be a reasonable thing to try.  It is probably the safest thing I can recommend sight unseen.

See here:

http://windows.microsoft.com/en-us/windows/system-restore-faq#1TC=windows-7

I had to limit system restore to 1 restore point, because it was eating up my c drive. problem is this one restore point got updated after the removal.

[Arcana]

I had to limit system restore to 1 restore point, because it was eating up my c drive. problem is this one restore point got updated after the removal.

First rule of backups: one is none.

[JoshexProxy]

First rule of backups: one is none.

found SMsvchost running yesterday, that's microsoft .net, why would it suddenly run? especially when I have no net.

I've got some time today, I'll be going through the registry backups I've made to see what had been removed that was affiliated with my net and try to restore them. it seems to me that my system may still be infected. I should also run hitman while I'm at it.

[Arcana]

found SMsvchost running yesterday, that's microsoft .net, why would it suddenly run? especially when I have no net.

I don't think network connectivity is required for the .Net tcp port sharing service to properly start.

[JoshexProxy]

I don't think network connectivity is required for the .Net tcp port sharing service to properly start.

thing is it started out of nowhere. so I suspect whatever is left of the virus is trying to trigger an internet connection for itself.

I cannot run hitman pro, the old hitman pro I remember did not use a scan cloud, the new one does (which means you need internet to scan) that's a really stupid idea lol.

Some more info I opened a log file for the troubleshooter and it says that "windows couldn't automatically bind the IP protocol stack to the adapter"

that and the netlogon service lsass.exe (which before the infection was running nearly all the time (probably because I was online all the time)) is now refusing to start, attempting to start it causes it to stop immediately, also it had been set to manual, I set it to automatic but still it wont start.

if there is anything you'd like me to do to get more information just ask, I really appreciate the help.

[JoshexProxy]

Huge update to this issue.

I wanted to check my friend's computer before I speculated this and I require a third out-of-china perspective as well for validation of the concern.

I got my friend's windows 7 computer which I bought for them in the UK, it has been operating in china as well and it too has netfilter.sys exactly as it was on my machine, it's listed as a driver.

searching about this driver online has turned up several things, it's based on a linux SDK for allowing devices on a network to access your computer, it basically a backdoor driver, a trojan horse as it would be that is only ever installed legitimately for things like teamviewer etc. where you let someone watch and manipulate your desktop and computer from an internet location. adwcleaner flags it as a tracker which allows an internet enabled location to track your browsing habits.

as windows keeps telling me the device driver is missing when I try to connect (and I've verified my driver is the best uptodate version for the device) I'm gathering there might be something built into windows 7 that wont let you online if you don't have the backdoor tracking driver netfilter.sys installed.

to confirm this I need someone who has a windows 7 machine that has never been to china to search C: for netfilter.sys if it's there then it's a microsoft thing. if it's not there then it's a china tracking thing. it's 31.2kb here and in C:windowssystem32drivers and system32driverstorefilerepositorynetsf.inf_amd64_neutral_3841bdc6464ec488.

[Aggelakis]

Does not exist on my Win 7 Home Premium desktop or Win 7 Pro laptop.

At this point, you would have saved more time and effort by just reinstalling Windows. *snerk*

[Golden Aurora]

I have a windows 7 64 bit alienware laptop.
It has never been to china.
When I search through c:\windows (and subfolders) for netfilter.sys there are 0 results.
Screenshots or directory contents can be provided if you desire.

[Golden Aurora]

My advice is to troll through HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services as per this http://www.installmate.com/support/im9/kb/kb50017.htm
When I look through mine, I see .sys files registered there. You might be able to delete the key hosing it up.
If you cant get to the registry, time to reinstall.
Good luck!

[Arcana]

My advice is to troll through HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services as per this http://www.installmate.com/support/im9/kb/kb50017.htm
When I look through mine, I see .sys files registered there. You might be able to delete the key hosing it up.
If you cant get to the registry, time to reinstall.
Good luck!

This might be simpler:

http://www.downloadcrew.com/article/27494-kernel_mode_drivers_manager

[JoshexProxy]

This might be simpler:

http://www.downloadcrew.com/article/27494-kernel_mode_drivers_manager

I wish it were that simple, it didn't even pick up the file as a driver on my friends computer, but I know what happens if I delete it, so for now I'll need that net to fix my other computer.

the fact that it didn't see it at all means it is a fictitious driver but it most likely pointed all other net drivers to itself in the registry.

[JoshexProxy]

My advice is to troll through HKEY_LOCAL_MACHINESYSTEMCurrentControlSetservices as per this http://www.installmate.com/support/im9/kb/kb50017.htm
When I look through mine, I see .sys files registered there. You might be able to delete the key hosing it up.
If you cant get to the registry, time to reinstall.
Good luck!

interesting, netfilter does not exist in my friend's computer's registry at all, it must be something that activates when given an impulse from the ISP to do so.

as for my computer I already deleted all the netfilter keys, values and data manually.

I wonder what would happen if I open the driver in notepad..

[JoshexProxy]

[Arcana]

I wonder what would happen if I open the driver in notepad..

You sure this isn't a component of some proxy something or other you loaded in China?

[JoshexProxy]

You sure this isn't a component of some proxy something or other you loaded in China?

100% positive. I'm trying to edit the above post give me a minute it explains everything or at least I think it does.

[JoshexProxy]

finished editing the code post so it will display.

[JoshexProxy]

the question now is if I should add the file back and if I need to perform any other actions to get china telecom's server to see it during connection?

I'll wait for a reply before continuing as I'm hesitant that this will solve anything and hesitant whether it's a good idea.

[Hyperstrike]

I'd recommend you get yourself a cheap, disposable laptop for your visits to China.
Grab a good clean system image.
Then use something like Deep Freeze to prevent them from screwing up your system too hard.

[JoshexProxy]

I'd recommend you get yourself a cheap, disposable laptop for your visits to China.
Grab a good clean system image.
Then use something like Deep Freeze to prevent them from screwing up your system too hard.

yeah.

I spent some time messing with the computer today, adding the files wont work and the netfilter inf files don't support "right-click > install" probably because I removed all the registry keys, but that proposes the question of how did this thing get on and install itself in the first place, it must have come over the line from the ISP or installed with some chinese software.

I'm hoping to get it online so I can use reimage to repair any damages done. I've secured the logs of what was removed to cause the problem to a zip drive. and may upload the logs here if anyone is willing to review them.

maybe reinstalling all the chinese software will reinstall netfilter and get it online again.

the ZTE modem driver (for a china telecom USB internet device) is probably the best culprit, I can't remember if it was even used on this computer though *goes to check* yes, yes it was.

this is a mess lol. I really need internet on my dev computer, I can't use this one because the left mouse button was broken and certain someone wont let me get it repaired or buy an external mouse. that and I'd have to transfer all my files and install all my software, and that's a lot.