Can't get to internet/spyware/virus problem

[vistaman]

Background: I had one of my users bring in a home PC that they said has been "very slow" and has additional pop ups etc. They had installed a bunch of products to try and fix it (SpyBot, AVG etc) but could no longer get to the internet. So I took a look and it seems clean now (they have AVG Free 2012 and MS Security Essentials as AV, both show nothing in full deep scans, spybot and Malwarebytes came up clean). The internet connection you plug in and it just sits at "Unidentified Network - Access: Local Only". It will not pick up an IP address. If you try ipconfig /renew, you get the message:
An error occurred while renewing interface Local Area Connection 2: A socket operation encountered a dead network

I read the sticky on what to do before posting and ran the MS Malicious Software tool, and it said things were clean. I then ran the ATF Cleaner. I have the logs from GMER (GMEROne and GMERTwo - attached)

The computer is a Dell Dimension C521, running Windows Vista Basic (x32). I'm kind of at a loss on what to try next. I was going to uninstall AVG, but the post suggests to not do anything after the GMER, so I'll wait to see what people say.

Thanks for any and all help.

[JorgeM]

Try going to device manager, uninstall the network adapter, rescan and install the latest driver. This usually fixes quirky issues, assuming this is not malware relate.

[vistaman]

I downloaded the newest driver from Dell, then uninstalled the network driver. The weird thing is it immediately reinstalled the NIC without any interaction from me. I choose "Uninstall" on the NIC, and it ininstalled and immediately popped up that it was installing, then said it was successful at installing the driver. Weird

According to Dell's site, the driver I downloaded has a release date of 3/20/2007. However I checked the date on the driver being used after the setup program completed and it still says 11/21/2006. I checked the folder it unzipped to and the driver files have that date on them, and it has "DOS", "Win2k" and "WinXP" as the folder options. So even though I supposedly got the "Vista" driver, I'm thinking it's the same as the XP driver.

I also downloaded the NIC diagnostics, just to check (Broadcom Control Suite) and it shows when I have the network connected with a green link status (100 Mbps, full duplex). The ip address is 169.254.209.40 so it's not obtaining DHCP. I have no other problems with DHCP (general working network is 200+ devices). I ran the NIC diagnostics and they all passed (don't believe it to be a HW problem).

When I check the local area connection status, I see that I'm connected (in this case 8+ minutes) and have received 244 packets, but have sent 0.

The user told me that the programs they have installed (Spybot, AVG etc) found some viruses/spyware and they cleaned them, and then they lost internet connectivity. I don't know if any of this will help.

[vistaman]

I also have run SFC /SCANNOW. I checked in the CBS log and it says I have two corrupt member files it cannot fix, tcpmon.ini and afd.sys. It looks like afd.sys might explain why I can't get a network connection. Is there an easy way to replace/fix this file? I have access to other windows vista machines, but they are professional or ultimate editions (if that matters).

[JorgeM]

It could be that the cleanup process caused the issue. Do you have another NiC you can install?

[andrewaus]

If you were using both the AVG 2012 and Microsoft Security Essentials in a go then many a time antiviruses conflict with each other and ignore the virus in the system treating it as clean file.

ADVERT DELETED (AGAIN)

[johhny-marshal]

Install only one antivirus program at a time on your computer otherwise it will degrade the throughput of the system. Update the drivers of the system and put a good and updated antivirus on your computers.

[vistaman]

Uninstalled AVG, the barracuda malware program and also spybot. So all I should have installed AV/Malware wise is MS Security Essentials. The box is LFF, so I'll check if I can put in a NIC for a test that's not LFF. Any other ideas while I work on that?

[gerbil]

Struggling still? You might try running Farbar Network Service Scan from http://www.bleepingcomputer.com/download/farbar-service-scanner/
Start it, check Internet Service, and Scan. Post the log.
It's a portable tool, run it from a UFD key.

[vistaman]

I think I have it licked. Still finishing up some scans. It looks like one of the initial malware scans they did found that afd.sys and a few other files were infected, and deleted them. That caused the network outage. I was able to mount the factory .wim file to recover the original afd.sys and put it in c:\windows\system32\drivers and the network came back, so I'm working on getting Windows updates loaded before running the last few scans to verify everything is clean.

Thanks for the help.

[gerbil]

Farbar would have picked that up for you (afd.sys missing) and helped you search for a copy on your sys. There should be a few of them.
Cheers.