Wireless card doesn't work in Windows after rootkit, but works in Linux

I have a computer that I recently could not connect to the internet with. I did a scan with Avast and found a rootkit.
After I removed the rootkit with Avast I still could not connect to the internet.

I posted on the malware removal forum, thinking that I was still infected somehow.
After several days of trying to get the internet working there, I finally got my hands on a Vista disk and did a clean refromat.
But after reformating, the wireless card still would not work.
But the strange thing is, it works fine in a Linux live CD, it's only Windows.

So I was directed here, to see if one of you guys can figure it out.

Here is the link to the post in the malware forum: http://www.bleepingcomputer.com/forums/topic462023.html

And now for some details...
It works if I plug it directly to the router, or if I plug another wireless card in via USB.
I have tried reinstalling the drivers - didn't work.

When I try to ping the router/gateway, I get this:

Pinging 192.168.1.254 with 32 bytes of data:
Reply from 192.168.1.76: Destination host unreachable.
Reply from 192.168.1.76: Destination host unreachable.
Reply from 192.168.1.76: Destination host unreachable.
Reply from 192.168.1.76: Destination host unreachable.

192.168.1.254 = router/gateway
192.168.1.76 = IP assigned to the laptop.

Here's the MiniToolBox log:


MiniToolBox by Farbar Version: 23-07-2012
Ran by Sharon (administrator) on 03-08-2012 at 07:04:43
Microsoft® Windows Vista™ Home Premium Service Pack 1 (X86)
Boot Mode: Normal
***************************************************************************

========================= IE Proxy Settings: ==============================

Proxy is not enabled.
No Proxy Server is set.
========================= Hosts content: =================================

::1 localhost

127.0.0.1 localhost

========================= IP Configuration: ================================

Atheros Wireless Network Adapter = Wireless Network Connection (Connected)
Broadcom NetLink ™ Gigabit Ethernet = Local Area Connection (Media disconnected)


# ----------------------------------
# IPv4 Configuration
# ----------------------------------
pushd interface ipv4

reset
set global icmpredirects=enabled


popd
# End of IPv4 configuration



Windows IP Configuration

Host Name . . . . . . . . . . . . : Sharon-PC
Primary Dns Suffix . . . . . . . :
Node Type . . . . . . . . . . . . : Hybrid
IP Routing Enabled. . . . . . . . : No
WINS Proxy Enabled. . . . . . . . : No
DNS Suffix Search List. . . . . . : gateway.2wire.net

Wireless LAN adapter Wireless Network Connection:

Connection-specific DNS Suffix . : gateway.2wire.net
Description . . . . . . . . . . . : Atheros Wireless Network Adapter
Physical Address. . . . . . . . . : 00-1C-26-B4-1A-90
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
Link-local IPv6 Address . . . . . : fe80::64fc:60ed:9c07:2198%9(Preferred)
IPv4 Address. . . . . . . . . . . : 192.168.1.76(Preferred)
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Lease Obtained. . . . . . . . . . : Friday, August 03, 2012 7:03:18 AM
Lease Expires . . . . . . . . . . : Saturday, August 04, 2012 7:03:18 AM
Default Gateway . . . . . . . . . : 192.168.1.254
DHCP Server . . . . . . . . . . . : 192.168.1.254
DNS Servers . . . . . . . . . . . : 192.168.1.254
NetBIOS over Tcpip. . . . . . . . : Enabled

Ethernet adapter Local Area Connection:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Broadcom NetLink ™ Gigabit Ethernet
Physical Address. . . . . . . . . : 00-15-58-CB-FD-A0
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes

Tunnel adapter Local Area Connection* 6:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : isatap.{64968193-EBD4-4F88-9F00-B0ECA2EB1012}
Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes

Tunnel adapter Local Area Connection* 10:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . : gateway.2wire.net
Description . . . . . . . . . . . : isatap.gateway.2wire.net
Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes
DNS request timed out.
timeout was 2 seconds.
Server: UnKnown
Address: 192.168.1.254

DNS request timed out.
timeout was 2 seconds.
DNS request timed out.
timeout was 2 seconds.
DNS request timed out.
timeout was 2 seconds.
DNS request timed out.
timeout was 2 seconds.
Ping request could not find host google.com. Please check the name and try again.

DNS request timed out.
timeout was 2 seconds.
Server: UnKnown
Address: 192.168.1.254

DNS request timed out.
timeout was 2 seconds.
DNS request timed out.
timeout was 2 seconds.
DNS request timed out.
timeout was 2 seconds.
DNS request timed out.
timeout was 2 seconds.
Ping request could not find host yahoo.com. Please check the name and try again.

DNS request timed out.
timeout was 2 seconds.
Server: UnKnown
Address: 192.168.1.254

DNS request timed out.
timeout was 2 seconds.
DNS request timed out.
timeout was 2 seconds.
DNS request timed out.
timeout was 2 seconds.
DNS request timed out.
timeout was 2 seconds.
Ping request could not find host bleepingcomputer.com. Please check the name and try again.



Pinging 127.0.0.1 with 32 bytes of data:

Reply from 127.0.0.1: bytes=32 time<1ms TTL=128

Reply from 127.0.0.1: bytes=32 time<1ms TTL=128



Ping statistics for 127.0.0.1:

Packets: Sent = 2, Received = 2, Lost = 0 (0% loss),

Approximate round trip times in milli-seconds:

Minimum = 0ms, Maximum = 0ms, Average = 0ms

===========================================================================
Interface List
9 ...00 1c 26 b4 1a 90 ...... Atheros Wireless Network Adapter
8 ...00 15 58 cb fd a0 ...... Broadcom NetLink ™ Gigabit Ethernet
1 ........................... Software Loopback Interface 1
10 ...00 00 00 00 00 00 00 e0 isatap.{64968193-EBD4-4F88-9F00-B0ECA2EB1012}
13 ...00 00 00 00 00 00 00 e0 isatap.gateway.2wire.net
===========================================================================

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 192.168.1.254 192.168.1.76 25
127.0.0.0 255.0.0.0 On-link 127.0.0.1 306
127.0.0.1 255.255.255.255 On-link 127.0.0.1 306
127.255.255.255 255.255.255.255 On-link 127.0.0.1 306
192.168.1.0 255.255.255.0 On-link 192.168.1.76 281
192.168.1.76 255.255.255.255 On-link 192.168.1.76 281
192.168.1.255 255.255.255.255 On-link 192.168.1.76 281
224.0.0.0 240.0.0.0 On-link 127.0.0.1 306
224.0.0.0 240.0.0.0 On-link 192.168.1.76 281
255.255.255.255 255.255.255.255 On-link 127.0.0.1 306
255.255.255.255 255.255.255.255 On-link 192.168.1.76 281
===========================================================================
Persistent Routes:
None

IPv6 Route Table
===========================================================================
Active Routes:
If Metric Network Destination Gateway
1 306 ::1/128 On-link
9 281 fe80::/64 On-link
9 281 fe80::64fc:60ed:9c07:2198/128
On-link
1 306 ff00::/8 On-link
9 281 ff00::/8 On-link
===========================================================================
Persistent Routes:
None

========================= Event log errors: ===============================

Application errors:
==================
Error: (08/02/2012 03:25:54 PM) (Source: Windows Search Service Profile Notification) (User: )
Description: Unable to remove Windows Search Service indexed data for user 'Sharon-PC\Administrator' in response to user profile deletion. Error code 0x80070015.

The device is not ready.
.


System errors:
=============
Error: (08/03/2012 07:04:46 AM) (Source: Service Control Manager) (User: )
Description: Parallel port driver%%1058

Error: (08/03/2012 07:03:10 AM) (Source: HTTP) (User: )
Description: \Device\Http\ReqQueueKerberos

Error: (08/02/2012 03:26:21 PM) (Source: Service Control Manager) (User: )
Description: Parallel port driver%%1058

Error: (08/02/2012 05:25:32 PM) (Source: HTTP) (User: )
Description: \Device\Http\ReqQueueKerberos

Error: (08/02/2012 05:23:16 PM) (Source: Microsoft-Windows-Eventlog) (User: NT AUTHORITY)
Description: 5Microsoft-Windows-Winlogon/Operational{DBE9B383-7CF3-4331-91CC-A3CB16A3B538}

Error: (08/02/2012 05:19:39 PM) (Source: HTTP) (User: )
Description: \Device\Http\ReqQueueKerberos


Microsoft Office Sessions:
=========================
Error: (08/02/2012 03:25:54 PM) (Source: Windows Search Service Profile Notification)(User: )
Description: Sharon-PC\Administrator0x80070015The device is not ready.


========================= Memory info: ===================================

Percentage of memory in use: 22%
Total physical RAM: 2037.68 MB
Available physical RAM: 1573.67 MB
Total Pagefile: 4310.41 MB
Available Pagefile: 3889.69 MB
Total Virtual: 2047.88 MB
Available Virtual: 1945.59 MB

========================= Partitions: =====================================

1 Drive c: () (Fixed) (Total:111.79 GB) (Free:102.69 GB) NTFS
3 Drive e: () (Removable) (Total:3.79 GB) (Free:2.27 GB) FAT32

========================= Users: ========================================

User accounts for \\SHARON-PC

Administrator Guest Sharon


**** End of log ****

If you did a clean reformat and the virus is DEFINITELY out of the PC, then there is not much more you can do. If the wireless card is enabled on the laptop (make sure the on/off switch for the wireless card is set to on. Most laptops put a little antenna symbol above the button) and you are getting a valid internal IP address with no conflictions on your network, try to go out and purchase a little wireless USB chip from buffalo as your wireless card may have gone bad. I use them all the time they are great little devices even if your wireless card in your laptop isn't bad, its always good to have for troubleshooting issues like this. Here's the link:

http://www.newegg.com/Product/Product.aspx?Item=N82E16833162037

If I interpreted what you said correctly, your laptop is not showing any wireless network in range down in the available wireless networks section even after doing a clean reformat, which leads me to believe your wireless NIC switch is turned off. Just make sure that is turned on before you go spend the 17 bucks if your wireless card did go bad. And like I said before even if your card isn't the issue, it is always a good device to have for troubleshooting issues like this.

It's definitely turned on, as it works fine when I boot the computer into a Linux live CD.
Which is why I'm wondering if the card is actually bad or not.

If I interpreted what you said correctly, your laptop is not showing any wireless network in range down in the available wireless networks section even after doing a clean reformat

It does show the networks in range, and I'm able to connect to my network.
And from the looks of it, my laptop is assigned an IP, but after that I can't connect to/ping anything.

Hi Tehyoda,

Run the Network Troubleshooter located in the Control Panel under Troubleshooting In the next window Under Network and Internet say "Connect to the Internet".

Please let us know if it fix anything

My OS is Vista, so I ran the Diagnose and Repair in Network and Sharing.

"Your modem or router is not available."
* A problem with your network router or broadband modem might be preventing an Internet Connection
* Automatically get a new IP settings for the network adapter "Wireless Network Connection"
* Reset the network adapter "Wireless Network Connection"

Also the last time I did this, before I reformatted it said:

Cannot communicate with Primary DNS Server(8.8.8.8)
* A problem with your network router or broadband modem might be preventing an Internet connection.
* Automatically get new IP settings for the network adapter "Wireless Network Connection"
* Reset the network adapter "Wireless Network Connection"

Either way, I've tried most of that before, nothing has helped.
But like I said, I've got an IP from the router, everything in ipconfig looks correct.

I dont want to suggest this if every computer works but Have you Reset your whole network because its looks like it definitive a internet issue from point A to point B A is laptop and B is your wireless box.

Are you using the Generic drivers(windows) or manufacture drivers.

This problem stumps me because you have all the right ips and you did a Complete Reformat. this looks like hard ware but not sure maybe some of the other members might have a suggestion or two.

Well I have 4-5 other computers on the network, all running fine. And I tried the laptop at a different location, to see if there was a problem with my router, but it still didn't work.
And I am using the generic drivers that come with Windows, I'm going to try to get drivers from Atheros later and see how those work.
But thanks for your effort

Here's a question... since it works in Linux and not in Windows, is there any way to do some sort of tests on the wireless card from Linux? To determine if the card is actually bad or not? Perhaps the drivers in Linux are able to ignore the fact that some part of the wireless card is damaged.

Do not use the Windows generic drivers. They are never the best drivers and sometimes they appear to work but don't.

Go to the Laptop makers website and download the proper driver for that wireless.

Roger

Ubuntu us a completely different system and I think they use vendor drivers.

Tried some drivers I found from Atheros, made no difference.

If the wireless card will work in Linux/Ubuntu and not Windows, the issue is definately related to the Drivers that Windows is using for the device.