WAN Miniport with yellow exclimation mark

[Tushman 19]

Your system looks pretty clean from what I can tell. If you're still unable to connect to the internet, try the winsock repair utility.

[zillah 5]

If you're still unable to connect to the internet, try the winsock repair utility.

I did used winsock without any joy ,,,,still I can not see LAN icon within the "My Network Place"Thanks

[Temmu 1,931]

it's been ~ 10 days since the original post and a lot of time spent.so, is there anything so extraordinarily special about this optiplex gx620 that warrants ~not~ simply wiping it and reinstalling from scratch? (don't forget to backup, and also to drop the partition table from a bootable disk(ette) (that will wipe any rootkits, and i have other reasons i do that...))

[Tushman 19]

I did used winsock without any joy ,,,,still I can not see LAN icon within the "My Network Place"Thanks

Zillah,Just because you cannot see the LAN icon in My Network places doesn't necessarily mean there's a problem. I've got the same thing as you can see from my screenshot. Sounds like to me your NIC driver has become corrupt. Try re-installing the NIC driver. It's possible that you have the wrong version driver. The following URL is the driver download page for your Dell Optiplex.Broadcom Integrated Controller.What kind of internet connection do you have by the way? Edited July 6, 2010 by Tushman

[lewmur 355]

I did used winsock without any joy ,,,,still I can not see LAN icon within the "My Network Place"Thanks

I'm going to risk another tongue lashing by making a suggestion. In the Device Manager, right click the Broadcom network cards and then /Properties/Driver/Driver Details to find the file names of the drivers. Rename the files.Then in regedit find "networkcards." Click the entries till you find the one for "Direct Parallel. Delete the entire entry.With the fingers on both hands crossed, reboot and reinstall the network card driver.

[zillah 5]

so, is there anything so extraordinarily special about this optiplex gx620 that warrants ~not~ simply wiping it and reinstalling from scratch?

No there is nothing special but now becomes a type of challenge,,,I just want to find out where is the problem of course by your helps guys

It's possible that you have the wrong version driver.

I have checked it again buy using the Dell service tag and it the same one that I was using ,,,,any way I downloaded again and still I could not fix the issue

The following URL is the driver download page for your Dell Optiplex.

This is diagnostic utility not the driver,,,,although I have installed that as well

What kind of internet connection do you have by the way?

Cable internet.

[zillah 5]

Hi lewmur

names of the drivers. Rename the files.

I did find the drivers name but I could not rename them http://i50.tinypic.com/fyzawx.jpg

[zillah 5]

When I use the driver for the networkcard it can remove the installed driver and install afresh one as can be seen in the snapshot below http://i48.tinypic.com/24v4br9.jpgBut then for few seconds every thing is okay as can be seen in the snap shot below http://i50.tinypic.com/29d9r91.jpgThen all of the sudden another message pops up saying : devices may not work correctly,,,,I could not record that word by word

[Tushman 19]

When I use the driver for the networkcard it can remove the installed driver and install afresh one as can be seen in the snapshot below.... Then all of the sudden another message pops up saying : devices may not work correctly,,,,I could not record that word by word

So it's able to recognize the NIC but the driver does not seem to take. Interesting. Just by the error message that you reported, I think that the hardware abstraction layer seems to be intact. Something else is going on that prohibiting the system from making an internet connection. It sounds suspiciously like a corrupt registry setting.Earlier when you modified the registry key from 0x00000029 to 0x00000009 - which key did you make that change in?HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ClassorHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet001\Control\ClassI hope that you made the change in the first one. If you didn't go back in and delete all references to the wan miniport in the 1st key.HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ClassAlso if you want to remove the "direct parallel" from the device manager, you'll have to make the same changes as before. This time make sure you are in the CurrentControlSet -- and not the CurrentControlSet001 subkey.I'd also like to see what processes are in the startup. Type 'msconfig' in the run command line and take a screenshot of the Start up tab. Edited July 6, 2010 by Tushman

[zillah 5]

You should also search for the "wan miniport" in the following subkey:HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ClassIf you are able to find it, then make the changes I suggested earlier.

I forgot to answer that ,,,,through my search for "wan miniport" I could not find it within HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class,,,,,therefore I did not make any changes

Earlier when you modified the registry key from 0x00000029 to 0x00000009 - which key did you make that change in?HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ClassorHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet001\Control\Class

I guess the above answeres this quote ,,,,doesn't it ?

Also if you want to remove the "direct parallel" from the device manager, you'll have to make the same changes as before. This time make sure you are in the CurrentControlSet -- and not the CurrentControlSet001 subkey.

I will do that as well

I'd also like to see what processes are in the startup. Type 'msconfig' in the run command line and take a screenshot of the Start up tab.

http://i50.tinypic.com/2zf6a2t.jpg

[Tushman 19]

Zillah,This is unrelated to your internet connection issue, but you have unchecked some necessary components. You need to recheck the 3 items that I've highlighted with the red outline.

Edited July 7, 2010 by Tushman

[zillah 5]

but you have unchecked some necessary components. You need to recheck the 3 items that I've highlighted with the red outline.

I did recheck them again

[lewmur 355]

Hi lewmurI did find the drivers name but I could not rename them http://i50.tinypic.com/fyzawx.jpg

Have you tried renaming them while in Safe Mode? Or boot using the XP CD and doing it from the Repair Console.

[zillah 5]

Hi lewmur

Have you tried renaming them while in Safe Mode

I will try in safe mode,,,,,to what name should I rename them ? Any name ?Thanks

[goretsky 1,158]

Hello,I noticed from your HijackThis log and System Configuration Utility screenshot that you had Spybot - Search & Destroy, MalwareBytes and AVG installed on the computer. While I am not aware of any specific conflict between these three programs, perhaps there is some interaction between them which is blocking the successful reinstallation of the device drivers.Another possibility—and perhaps a more likely one—is that there was some additional damage done to the system by the Trojan horse or perhaps a remnant of it is still present on the system and interfering with the device driver reinstallation. If that is the case, it might time to contact one of the vendors in question and see if they have any supplemental tools you can run to look for additional malware and/or repair damage caused by an infestation.Regards,Aryeh Goretsky

[zillah 5]

Hi AryehGood day to you

I noticed from your HijackThis log and System Configuration Utility screenshot that you had Spybot - Search & Destroy, MalwareBytes and AVG installed on the computer. While I am not aware of any specific conflict between these three programs, perhaps there is some interaction between them which is blocking the successful reinstallation of the device drivers.

Yes I did install these 3 programs when i was cleaning the PC.Thanks

[Tushman 19]

Hi AryehGood day to you Yes I did install these 3 programs when i was cleaning the PC.Thanks

What he is saying is that you should uninstall those programs for a moment and try to install the NIC driver again.

[zillah 5]

should uninstall those programs for a moment and try to install the NIC driver again.

I did and I received below:

Then all of the sudden another message pops up saying : devices may not work correctly,,,,I could not record that word by word

And this is the exact message word by wordhttp://i29.tinypic.com/34ifmmx.jpg

[Tushman 19]

Zillah,Click on the control panel and open up your network connections applet. For your Broadcomm NIC, right click and choose 'properties' from the context menu. I've posted a screenshot of my network connection for your reference. You should see the NIC properties menu show up as in my 2nd screenshot.Post back let us know which items are checked.

[zillah 5]

Click on the control panel and open up your network connections applet. For your Broadcomm NIC

This is what I meant by

still I can not see LAN icon within the "My Network Place"

I can not see the icon for Broadcomm NIC

[Tushman 19]

This is what I meant by still I can not see LAN icon within the "My Network Place"

Zillah,I think that you are getting your wording mixed up. There is "My Network Place" listed on the start menu; and then there is "network connections" in the control panel. Please make sure you are clicking on the "network connections" as shown in the screenshot.

[zillah 5]

There is "My Network Place" listed on the start menu; and then there is "network connections" in the control panel.

Hi Tushman and sorry for confusionYes I did that from control panel > Network Connections and I could not find Broadcom NIC,,,,,,and if you do right click to "My Network Places" then "Properties" you will end up to Network Connections as well.This is what I meant when I said :

still I can not see LAN icon within the "My Network Place"

[lewmur 355]

Hi Tushman and sorry for confusionYes I did that from control panel > Network Connections and I could not find Broadcom NIC,,,,,,and if you do right click to "My Network Places" then "Properties" you will end up to Network Connections as well.This is what I meant when I said :

It would appear to me that you still have malware controlling the computer. Here is a link to Combofix. I have had good success with it. I don't think anything short of a clean install will work until you find and remove the trojan. Edited July 8, 2010 by lewmur

[zillah 5]

Here is a link to Combofix.

Hi lewmurI have just tried but still no joy

[Tushman 19]

Zillah,It's possible the trojan has altered the list of services in XP. Download the default Start services from Black Viper's website here:http://www.blackviper.com/WinXP/registry.htmNote that there are different versions depending on your operating system,XP Home; Pro; MCE; Tablet and it's for systems with Service Pack 3 installed.After you've downloaded the zip file, unzip the small registry file to a temporary directory; it can even be on your desktop - doesn't matter. Afterwards, double click it to incorporate the registry file. Reboot the system and then try to install the driver after that.

[zillah 5]

TushmanI tried what you have suggested but still no joyThanks

[Tushman 19]

TushmanI tried what you have suggested but still no joyThanks

Open up the device manager and under the View menu, check the item for "Show Hidden Devices" -- post a screenshot here.

[zillah 5]

Open up the device manager and under the View menu, check the item for "Show Hidden Devices" -- post a screenshot here.

http://i27.tinypic.com/1zqswac.jpg

[Tushman 19]

Open up the command shell and reset your tcp/ip stack.At the C:\ prompt, type the following without quotes: "netsh int ip reset c:\resetlog.txt"

[zillah 5]

At the C:\ prompt, type the following without quotes: "netsh int ip reset c:\resetlog.txt"

deleted SYSTEM\CurrentControlSet\Services\Netbt\Parameters\EnableLmhostsadded   SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{4E4D915F-6AEB-4401-803C-80D22408E259}\AddressTypeadded   SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{4E4D915F-6AEB-4401-803C-80D22408E259}\DisableDynamicUpdatereset   SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{4E4D915F-6AEB-4401-803C-80D22408E259}\RawIpAllowedProtocols			old REG_MULTI_SZ =				0reset   SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{4E4D915F-6AEB-4401-803C-80D22408E259}\TcpAllowedPorts			old REG_MULTI_SZ =				0reset   SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{4E4D915F-6AEB-4401-803C-80D22408E259}\UdpAllowedPorts			old REG_MULTI_SZ =				0deleted SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\DontAddDefaultGatewayDefaultdeleted SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\EnableIcmpRedirectdeleted SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\EnableSecurityFiltersadded   SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\NameServerdeleted SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\SearchListdeleted SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\UseDomainNameDevolutionreset   Linkage\UpperBind for PCI\VEN_14E4&DEV_1677&SUBSYS_01AD1028&REV_01\4&117729E2&0&00E0.  bad value was:			REG_MULTI_SZ =				PSched<completed><completed>