need computer help

[JoshexProxy]

yes my computer is running.

no there is no red x over my internet icon.

my wifi devices can all see wifi networks, but attempting to connect results in "the connection was unsuccessful"

no I have not tried a direct connection via wire because no one knows the username or password it's all in the router.

I have recently removed a virus called netfilter.sys which adwcleaner flagged as a third party tracking program, however after it's removal I got limited connectivity to the internet.

The more I dug into it the more it looked like netfilter had woven it's way into the net drivers and devices and deleted the original net programs replacing them completely. looking in device manager I saw a slew of net device copies, even some which had not been connected to the computer in years all listed with (netfilter device) after them, so I ended up completely eradicating the registry entries with netfilter in them, it wasn't easy a few had been entered by the SYSTEM account. but I got rid of them and all the netfilter devices in device manager vanished. but still no net.

I replaced the drivers for the devices I use from the manufacturer's website but still have no net and windows trouble shooter still says there's a problem with the drivers for the devices. I am 100% sure it's no the device drivers, but some internal windows components that netfilter had it's way with that are refusing to function for a clean device.

I am running windows 7 ultimate 32bit. if anyone here has a clean system and knows what files, drivers and/or registry entries I need to input to get my wifi back please help or send me a copy of yours. I need windows net drivers, and possibly a new TC/IP copy from what I can see, but someone here may know more.

thankyou ahead of time for any help given.

Edit; I will be willing to pay via paypal for any help that enables me to get my netback without completely reinstalling windows (I really don't want to have to refind and reinstall all my software.)

[Arcana]

The only netfilter.sys malware I'm aware of is a browser hijack malware.  I don't think removing it should have hosed your networking completely, but browser hijack software has been used to install other nasty things.  Maybe your antivirus software found lots of other stuff and damaged something in the process of cleaning up the mess.

I'm not sure what you mean by not having the user name or password to make ethernet connections, but if you are connecting to the internet via wifi, there's often two different wifi configuration programs you can use: one provided by the wifi adapter manufacturer and a generic one that comes with Windows itself.  The only thing that comes to mind if you are having trouble after reinstalling the wifi drivers and software is that I've often had issues when my system tried to run both at the same time.  Either you use the vendor one or the windows one, but not both at the same time.  If one is running, kill the other.

If it is a missing Windows component, then Windows 7 usually can fix that with the troubleshooting wizard.  If it can't, it would be difficult to tell what the problem was without significant technical information.  Does the WLAN see the correct SSID?  Does it actually connect to that SSID?  When you ipconfig /all do you see the wireless adapter, and does it show you acquiring IP address information?

[Ironwolf]

Malwarebytes.

Pull it down onto a flash drive and load it - it will fix nearly anything.

[Suspicious Package]

You can try resetting the Winsock and TCPIP stack.  Sometimes that straightens out issues like this.

1. Run Elevated Command Prompt:
- Click the Start button
- Type: cmd in the Start Search text box.
- right-click and choose "Run as Administrator" (alternatively, press CTRL-SHIFT-ENTER to run it as administrator), and allow elevation request
2. Type: 'netsh winsock reset catalog' in the shell and hit Enter
3. Type: 'netsh int ip reset reset.log' and hit Enter again. If this doesn't work, try 'netsh int ipv4 reset reset.log' to just reset ipv4.
4. Restart the computer

[JoshexProxy]

thankyou all for the prompt replies, I will try all of this from the top tomorrow.

@ Arcana, I only mentioned ethernet because one of the typical IT questions is "have you tried connecting to the internet through a wire" and the answer is I'd like to, but can't because of no username or password for the actual internet account being available atm.

@ Ironwolf, I use malwarebytes regularly, it can't figure out whats wrong. Still I'll try again.

I have a list of the majority of the stuff that was removed so that will make things easier if it comes to files. I just hope I kept cn find the clean/scan logs.

[chuckv3]

"have you tried connecting to the internet through a wire" and the answer is I'd like to, but can't because of no username or password for the actual internet account being available atm.

wired connections do not require a password (like WiFi).

[Codewalker]

Some do. It's possible to run 802.1x over wired connections as well as wireless, but it's rare to encounter outside of locked down corporate environments.

Much more common are old ADSL setups that require establishing a PPPoE link first (which requires a username/password) in order to get an Internet IP.

[Arcana]

Some do. It's possible to run 802.1x over wired connections as well as wireless, but it's rare to encounter outside of locked down corporate environments.

Much more common are old ADSL setups that require establishing a PPPoE link first (which requires a username/password) in order to get an Internet IP.

The "its all in the router" is what made me think it was something other than that, but I don't make a lot of presumptions when troubleshooting in the blind.

[JoshexProxy]

The only netfilter.sys malware I'm aware of is a browser hijack malware.  I don't think removing it should have hosed your networking completely, but browser hijack software has been used to install other nasty things.  Maybe your antivirus software found lots of other stuff and damaged something in the process of cleaning up the mess.

I'm not sure what you mean by not having the user name or password to make ethernet connections, but if you are connecting to the internet via wifi, there's often two different wifi configuration programs you can use: one provided by the wifi adapter manufacturer and a generic one that comes with Windows itself.  The only thing that comes to mind if you are having trouble after reinstalling the wifi drivers and software is that I've often had issues when my system tried to run both at the same time.  Either you use the vendor one or the windows one, but not both at the same time.  If one is running, kill the other.

If it is a missing Windows component, then Windows 7 usually can fix that with the troubleshooting wizard.  If it can't, it would be difficult to tell what the problem was without significant technical information.  Does the WLAN see the correct SSID?  Does it actually connect to that SSID?  When you ipconfig /all do you see the wireless adapter, and does it show you acquiring IP address information?

WLAN does see correct SSIDs it actually connects but acts like it didn't on the internet icon (no change), whilst it lists the connection to the SSID as EDIT: "limited access"

ipconfig /all does not show the device, it shows Windows IP Configuration with the host name being the computer identity,
dns:
node type: hybrid
IP routing enabled: no
WINS Proxy Enabled : no

then followed by tunnel adapter ?*15 , 6, 11, 12, 18, 19,13, 14, 16 all with the same settings:
media state: media disconnected
dns suffix:
description: either Microsoft 6to4 Adapter #1-10 or Microsoft Teredo Tunneling Adapter
physical address: 00-00-00-00-00-00-00-E0
DHCP ENabled: No
autoconfiguration enabled: Yes

also several entries of:
Tunnel adapter 6TO4 Adapter/ tunnel adapter reusable Microsoft 6To4 Adapter
same info.

wifi configuration programs, I don't know what those are or where to find them if they are on my system (help here might be what I need), I reinstalled the driver for the two wifi devices I use.

[JoshexProxy]

You can try resetting the Winsock and TCPIP stack.  Sometimes that straightens out issues like this.

1. Run Elevated Command Prompt:
- Click the Start button
- Type: cmd in the Start Search text box.
- right-click and choose "Run as Administrator" (alternatively, press CTRL-SHIFT-ENTER to run it as administrator), and allow elevation request
2. Type: 'netsh winsock reset catalog' in the shell and hit Enter
3. Type: 'netsh int ip reset reset.log' and hit Enter again. If this doesn't work, try 'netsh int ipv4 reset reset.log' to just reset ipv4.
4. Restart the computer

Did not work, I got a fresh winsock and winsock 2 the other day but that's not the problem.

I'm guessing based purely off intuition that something is wrong with the TCP/IP files on my computer so resetting the stack won't help, I will need a valid IPv4 installer and ipv6 installer to test this intuition as I will need to uninstall IPv4 and 6 on each device and then reinstall it. I'm not sure that would help though.

the problem seems to be that although windows can see the device, the files and services that run net connection can't see the device. hence it is missing from ipconfig, yet the device itself is operating fine and as such can see SSIDs and attempt to connect but when it happens the net connection files and services are either not there to handle the connection operation or though they receive the call they don't respond because they can't see the device. It should show up as ASUS EZ n-10 or something similar.

[Arcana]

WLAN does see correct SSIDs it actually connects but acts like it didn't on the internet icon (no change), whilst it lists the connection to the SSID as EDIT: "limited access"

ipconfig /all does not show the device, it shows Windows IP Configuration with the host name being the computer identity,
dns:
node type: hybrid
IP routing enabled: no
WINS Proxy Enabled : no

then followed by tunnel adapter ?*15 , 6, 11, 12, 18, 19,13, 14, 16 all with the same settings:
media state: media disconnected
dns suffix:
description: either Microsoft 6to4 Adapter #1-10 or Microsoft Teredo Tunneling Adapter
physical address: 00-00-00-00-00-00-00-E0
DHCP ENabled: No
autoconfiguration enabled: Yes

also several entries of:
Tunnel adapter 6TO4 Adapter/ tunnel adapter reusable Microsoft 6To4 Adapter
same info.

wifi configuration programs, I don't know what those are or where to find them if they are on my system (help here might be what I need), I reinstalled the driver for the two wifi devices I use.

That's strange.  If you do not see a wifi adapter listed when you did a ipconfig, then that sounds like the drivers did not install correctly.  Check device manager to see if the wifi adapter driver appears to have an issue.  You can get to the device manager by right-clicking on My Computer and selecting properties, then clicking on Device Manager in the upper left corner of the Control Panel system page.  You should see the wifi adapter under something like "Network adapters".  If you see a yellow warning triangle, then there's something wrong.  If you don't see it at all, your computer isn't even detecting the wifi hardware correctly.

[JoshexProxy]

That's strange.  If you do not see a wifi adapter listed when you did a ipconfig, then that sounds like the drivers did not install correctly.  Check device manager to see if the wifi adapter driver appears to have an issue.  You can get to the device manager by right-clicking on My Computer and selecting properties, then clicking on Device Manager in the upper left corner of the Control Panel system page.  You should see the wifi adapter under something like "Network adapters".  If you see a yellow warning triangle, then there's something wrong.  If you don't see it at all, your computer isn't even detecting the wifi hardware correctly.

no yellow triangle, it is there though, but I installed it's driver before I completely killed the netfilter devices, so reinstalling that might be a good thing to try. will try tonight.

result, same issue no change. the device pops up just fine in device manager when I plug it in.

found this: http://answers.microsoft.com/en-us/windows/forum/windows_7-networking/my-wireless-connection-says-limited-access-no/4536bd94-28ad-40d5-8a4e-6fe29c171039

will attempt to try this too.

[Arcana]

found this: http://answers.microsoft.com/en-us/windows/forum/windows_7-networking/my-wireless-connection-says-limited-access-no/4536bd94-28ad-40d5-8a4e-6fe29c171039

will attempt to try this too.

That article seems to be saying the same things I am: check driver, check adapter (in network connections or ipconfig), check connection (acquired address), check for competing WLAN configuration tools.

[JoshexProxy]

That article seems to be saying the same things I am: check driver, check adapter (in network connections or ipconfig), check connection (acquired address), check for competing WLAN configuration tools.

indeed, if it works you get credit.

it just tells me step by step instructions for each.

[microc]

with older version of windows make sure you turn off /disable the onboard ethernet port if your going ot use wifi. sometimes with both of them on windows wont log onto the net right with wifi. with your wifi stick google the vendor info online. see if the chipset vendor for the usb dongle has newer drivers then the dongle maker. also try hitman pro it another 3 party scanner that finds stuff malware bytes wont. also run msconfig and look under add/remove program for any toolbar helpers or anti virus or anti malware programs you did not install. a lot of trojans and new virus use real looking programs to reinfect your pc over and over. if the virus has damaged windows you may have to back up your files and reinstall it.

[JoshexProxy]

with older version of windows make sure you turn off /disable the onboard ethernet port if your going ot use wifi. sometimes with both of them on windows wont log onto the net right with wifi. with your wifi stick google the vendor info online. see if the chipset vendor for the usb dongle has newer drivers then the dongle maker. also try hitman pro it another 3 party scanner that finds stuff malware bytes wont. also run msconfig and look under add/remove program for any toolbar helpers or anti virus or anti malware programs you did not install. a lot of trojans and new virus use real looking programs to reinfect your pc over and over. if the virus has damaged windows you may have to back up your files and reinstall it.

I'll run hitman, I already do the other stuff on a regular basis

side note, I may have stumbled across the culprit, under device manager I right-clicked one of my adapters and opened it's properties window, went to details and clicked the drop down menu and lo and behold there are at least 10 entries reading {3ab22e31-8264-4b4e-9af5-a8d2d8e33e62}[1] - [10]

suspicious I think, now how to test that theory, finding their file locations is going to be a hassle if they aren't named the same, their registry entries should be easy to find, the question is kill or don't kill?

[Arcana]

I'll run hitman, I already do the other stuff on a regular basis

side note, I may have stumbled across the culprit, under device manager I right-clicked one of my adapters and opened it's properties window, went to details and clicked the drop down menu and lo and behold there are at least 10 entries reading {3ab22e31-8264-4b4e-9af5-a8d2d8e33e62}[1] - [10]

suspicious I think, now how to test that theory, finding their file locations is going to be a hassle if they aren't named the same, their registry entries should be easy to find, the question is kill or don't kill?

Don't mess with those.  I'm pretty sure that's the PCI device root GUID.  In other words, it is the place where device drivers store their PCI device properties.

Yep, here it is in the pci include file pciprop.h from the Windows SDK:

//
// The GUID {3AB22E31-8264-4b4e-9AF5-A8D2D8E33E62} is a seed for all properties
// defined for a PCI device.
//

#define DEFINE_PCI_DEVICE_DEVPKEY(_DevPkeyName, _Pid) \
   DEFINE_DEVPROPKEY((_DevPkeyName), 0x3ab22e31, 0x8264, 0x4b4e, 0x9a, 0xf5, 0xa8, 0xd2, 0xd8, 0xe3, 0x3e, 0x62, (_Pid))

My PCI devices also have those keys: in particular my AMD Radeon and my Realtek PCIe gig ethernet.  If it is a PCI(e) device under Windows Vista and higher, it will probably have those keys.  There seem to be 25 sub properties listed, so you can see subs from [1] to [25] inclusive.  However, not every device must implement them all: my Realtek only uses 1-17 and 25.  That's normal (I guess the Realetk doesn't implement those PCI error handling options).

[JoshexProxy]

Don't mess with those.  I'm pretty sure that's the PCI device root GUID.  In other words, it is the place where device drivers store their PCI device properties.

Yep, here it is in the pci include file pciprop.h from the Windows SDK:

My PCI devices also have those keys: in particular my AMD Radeon and my Realtek PCIe gig ethernet.  If it is a PCI(e) device under Windows Vista and higher, it will probably have those keys.  There seem to be 25 sub properties listed, so you can see subs from [1] to [25] inclusive.  However, not every device must implement them all: my Realtek only uses 1-17 and 25.  That's normal (I guess the Realetk doesn't implement those PCI error handling options).

ok so don't kill.

hmm it's gonna be a long few days before I have time to even get hitman and run it or try anything you said.  crap, it might be a week before I can do anything.

sick + work +sudden train trip coming up then followed by more work. I'm sure someone else has it worse lol.

[Arcana]

Have you considered performing a system restore to a date earlier than when you tried to clean the virus off your system? 

I must caution you that whenever I'm involved in complex repairs on a system especially when I lack complete information about the problem, I always consider making a backup first because in trying to make it better you can always make it worse.

Having said that, doing a system restore to previous version should keep all your data, and just revert windows and its drivers and subsystems to an earlier configuration.  That might fix the problem.  It can break apps installed after the restore point because shared libraries and registry settings get reverted, but it should keep your own files intact.  If things are working correctly, Windows should also actually make a restore point before reverting to an earlier restore point, so you can jump back to the configuration you have now (broken and all) if things don't go well.  Nothing is foolproof, but this might be a reasonable thing to try.  It is probably the safest thing I can recommend sight unseen.

See here:

http://windows.microsoft.com/en-us/windows/system-restore-faq#1TC=windows-7

[JoshexProxy]

Have you considered performing a system restore to a date earlier than when you tried to clean the virus off your system? 

I must caution you that whenever I'm involved in complex repairs on a system especially when I lack complete information about the problem, I always consider making a backup first because in trying to make it better you can always make it worse.

Having said that, doing a system restore to previous version should keep all your data, and just revert windows and its drivers and subsystems to an earlier configuration.  That might fix the problem.  It can break apps installed after the restore point because shared libraries and registry settings get reverted, but it should keep your own files intact.  If things are working correctly, Windows should also actually make a restore point before reverting to an earlier restore point, so you can jump back to the configuration you have now (broken and all) if things don't go well.  Nothing is foolproof, but this might be a reasonable thing to try.  It is probably the safest thing I can recommend sight unseen.

See here:

http://windows.microsoft.com/en-us/windows/system-restore-faq#1TC=windows-7

I had to limit system restore to 1 restore point, because it was eating up my c drive. problem is this one restore point got updated after the removal.