2

I'm trying to recover from a rootkit infection, where I am unable to connect to the internet.

When I try to ping the router this is the output:

Pinging 192.168.1.254 with 32 bytes of data:
Reply from 192.168.1.70: Destination host unreachable.
Reply from 192.168.1.70: Destination host unreachable.
Reply from 192.168.1.70: Destination host unreachable.
Reply from 192.168.1.70: Destination host unreachable.

192.168.1.254 = router
192.168.1.70 = IP assigned to the laptop.

It works when I connect it to the gateway via an ethernet cable, but wireless don't.
And I've already tried reinstalling wireless drivers.

When I try to run the ipconfig /renew command I get this output:

An error occurred while renewing interface Wireless Network Connection : The operation was canceled by the user.

No operations can be performed on Local Area Connection while it has its media disconnected.
An error occurred while releasing interface Loopback Pseudo-Interface 1 : The system cannot find the file specified.

And when I run the command netsh int ip reset, everything is OK except when Resetting Echo Request, which failed with an access denied error message. (and yes I ran in an elevated command prompt)

Also reformatting is an absolute last resort, that I would REALLY like to avoid. Any ideas?

EDIT: Here is the output of an ipconfig /all http://pastebin.com/fwuRxiT2

11
  • Is the gateway also set to 192.168.1.254? Posting your ipconfig /all might help.
    – rtf
    Commented Jul 24, 2012 at 0:16
  • @r.tanner.f Uploaded and added to question.
    – Josh
    Commented Jul 24, 2012 at 0:31
  • Go to control panel and turn your adapter off then on - this works for me sometimes, no idea why.
    – cutrightjm
    Commented Jul 24, 2012 at 0:50
  • @ekaj Tried it, didn't work. Also tried assigning a static IP, also didn't work.
    – Josh
    Commented Jul 24, 2012 at 0:51
  • Stupid question: is the wireless card turned on? There's often a physical switch on the laptop.
    – user3463
    Commented Jul 24, 2012 at 0:52

1 Answer 1

3

It sounds like you may still be infected by the rootkit! Your updated information and the diagnostics made by the other community members in the Comments tell me that "incongruous results = something amiss".

I strongly suspect that you are getting these extremely "strange" results because whatever damage the rootkit dealt is still present -- either it is successfully removed but it left the system broken; or it's NOT removed and you're still suffering the symptoms of it.

Personally I wouldn't trust my system with any kind of sensitive data without nuking it from orbit if I knew I had a rootkit. You may yet find a simple solution within the bowels of Windows Networking, but if not, I highly recommend wiping the disk clean and reinstall from an empty partition. AFAIK no rootkit has yet figured out how to persist across OS installs if you wipe the disk. So that's the good news.

BTW, my argument for suspecting that the rootkit is still present: it may have found a way to hide itself from your virus scanners, etc. while still remaining on the system in a less detectable way. If it's got itself into the Windows kernel, it can lie to the operating system about every single system call, and so it can manipulate network devices, the filesystem, etc. to deceive programs (and virus scanners) into thinking that it's removed, when in fact it's still present.

Rootkits are to computers what the "evil deceiver" was to Rene Descartes. If you aren't familiar with the philosophy exercise, the question posed was, how do we know that our real existence isn't somewhere else, and our brains are just hooked up to a machine/equipment/whatever that is feeding us impulses to make us think we are actually in this world? How can we break out of the skepticism that we're not under the influence of an "evil deceiver"? Well, the rootkit is exactly the same problem, except that you can't use an ontological argument like Descartes because we're talking about the world in a very restricted, digital computing sense. The rootkit is basically the ultimate virus: if done perfectly, they are all but undetectable.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .