HI good people,

I want to know if virus can spoil a NIC card. I just formated my system after a persistent virus attack that refused to go after scaning and deleting the infected files.

I instaled a new operating system and also installed a newwer antivirus software. I was suprised that after browsing for some hours, I noticed a slowness on my browsing speed. On checking the send and receive packets on the NIC, I saw that the sent packets was ten thousand times the receive making my uplink to be far greater than my downlink.

Could this be that virus has destroyed or spoilt my NIC card or could there be another cause for this ugly incident.
Please respond, am at my wits end!

Well, I don't think the virus is responsible for the slow downlink though I suppose you are using an asynchronous connection. I have never heard of virus attacks on NIC's unless your own case is very unique. NIC's sit at the Network layer of the IP stack so it is most unlikely to be affected by a virus.

When the internet traffic hit the NIC, it should be in a very low level language (binary). The confusion that computers experience with viruses have nothing to do with the NIC; they are simply passed to the higher members of the stack. The worst virus attacks are the ones that work on the kernel files thus greately incapacitating the system.

You sound knowledgeable enough to be able to check your internet connections and see what possibly went wrong.

Cheers

Virus has nothing to do with your NIC card. virus only duplicates itself on the d system hard disk thus occupying its space. Your sent/receive is different as a result of the configuration on the system. check your TCP/IP properties, and see if its configuration is correct, which presumedly is not correct. in respect to the attack, you can email me and i will give u some programs that will protect your computer.

@marcusjay
basic tcp/ip misconfiguration cant have such effects on your sys. check your registry settings for more complex settings such as window size, mtu settings, sack flags, etc. in case you dont understand, just restore your registry to a previous state, or get a software to do it for you - make periodic registry backups

Hmmm if u guyz says know it cant affect d netwrk card --then y is my service provider alwayz telling 2 b VIRUS FREE whereever i complian 2 'em abt slowness in BROWSING? I really want 2 know?

Kashif,

I will disagree with you that NICs work at the network layer of the OSI, if I am mistaken, plz correct me. NICs work at the data link layer especially with MAC sub layer.

And yes - viruses can affect NICs - an example is a simple ARP poisoning of a subnet, this will render most NICs on your network ineffective. Also, NICs have drivers that are softwares and you can write batch files that can modify these firmwares i.e like changing the MAC address when spoofing.

aadewale,

If you are using a Windows machine and it hasn't been patched up - it can be attacked as soon as it is attached to the network. On the other hand, it could be you NIC speed; some ISPs use half-duplex braodband transmission or full duplex and if your card doesn't support auto-sensing, it could be a reason.

;Domo wetin person wan talk sef,these guys most be vast in the computer world or if u na just dey talk computer grammar.but d answer to your question is yes,dont ask me how

kentoma,

Answer to which question is yes? what are you refering to?

Yes, a virus can affect an NIC.

AN NIC is a hardware that has something to do with software, drivers, etc as was mentioned before. As long as a virus can affect software, the effects can propage to hardware. Kaput.

There are viruses that could damage the entire motherboard - an after chain effect

The most secure computers nowadays are those not connected to the internet.

jaybaby:

Hmmm if u guys says know it can't affect d netwrk card --then y is my service provider alwayz telling 2 b VIRUS FREE whereever i complian 2 'em about slowness in BROWSING? I really want 2 know?

who is your ISP, and what speed are you subscribing/paying for?
If you are on a shared BW platform, theres nothing you can do about slow-browsing at some-times of the day, especially between 11am-2pm. At these hours of the day, internet access is generally slower than at other times of the day. And besides a lot of ISPs would rather tell you a virus-story rather than tell you about the poor service you are paying for.

A virus can affect the way our NIC work but not directly, maybe there is a virus on our computer that is trying to access a server somewhere just to take our whole bandwidth like adwares, spywares, trojans and many more. So i will advice you to get an up-to-date antivirus and spyware. If that doesn't work contact our isp.

The virus must have corrupted your NIC's driver. You should uninstall the drivers completely, remove the NIC, get rid of the virus and reinstall the drivers again.

alexis,

Yes, the NIC is at the datalink and not the network layer but, the MAC (Media Access Control) address is a unique hard-wired HEX number which I don't think could be overwritten. Remember that no two NIC's in the world have the same MAC addy.

During spoofing, the attacker tries to alter the packet header to hide/impersonate a sender. This is not the same as altering the MAC address.

aadewale wants to know if his NIC is damaged (not hampered); to which I still maintain that if so, then it is not likely from the virus or any malware.

You be correct guy. Keep it up

Hi;

the key to your problem is in your question:

[i]I saw that the sent packets was ten thousand times the receive making my uplink to be far greater than my downlink.[/i]

I have seen this happen a lot. its not ur card or the ISP, iuts a virus on the net. when it enters ur system it starts sending intermittent TCP messages such that your system starts generating the kind of traffic that 50 or more systems would. a trace using ethereal would clarify this.

what is worst about it is that it tries to infect any and every other computer system that is on your LAN.


SOLUTION

I have used different antivirus solutions and as at last year when i encountered this last, none really worked.

What worked for me was to re-install the system offline and use windows xp service pack 2, then turn on the windows firewall. End of story.

forget anything u do on XP SP1, it will not work, twas so bad then that i asked myself if MS didnt bring out the virus to force all to upgrade,

**** solve it very fast cos the next thing you will see are system malfunctions, some system file error that i cant recall now,

Kashif,

Thanks for clarifying things. The MAC address is burned to the device and can't be the same with any other device MAC, I totally agree but you can put a network card in passive mode and give it a totally different MAC address such that the original MAC is not displayed but a spoofed one, this was what I was refering to.

Computers on the local network use ARP to communicate, it is much faster, that is why ARP poisoning is very effective on local networks.

Will you agree that any other software that will make a computer behave in a way that is not suppose to may be called a computer virus? If you agree, I can show you some batch programs that can make a pentium II look like a pentium M, it will only change the information and not the performance.

Virus has nothing to do with ur NIC Card

May be the slow character of ur NIC could be because its not transmitting on a full duplex mode

Be assured that virus can not destroy ur LAN card cos why? Virus only atack the harddisk by either ocupying the space in the harddisk or affecting ur operating system by currupting ur software.

when two or more systems is on a LAN and a particular system is infected by a virus,
the virus may transmit to other systems drive that are on the Network.

SOLUTION

So it is not advisable to just format a particular system that you thinks it is infected, cos in the process of doing that most especially if the network cable is not removed from that system or removed from others (whether they are infected or not ) the virus will move or transport iteself to other systems on that network and the problem will persist.

JUST FORMAT ALL UR SYSTEMS AT ONCE AND REMEMBER TO REMOVE THE NETWORK CABLE BEFORE THE PROCESS

@adewale and alexis
i believe u ought to try and assist the poster rather than engaging in bouts of who's more techy. firmware is burnt into EEPROM which no virus can have access to. viruses cannot damage a hardware simply by screwing driver files.

@the first poster
spyware and suchlike malware trackers can exponentially increase ur uplink traffic by constantly "phoning home", and since they eat up bandwidth they can slow down not just ur connection but ur system as well. get ad-aware and scan for them. its free.

Neoteny,

Thanks for your comment, if you read my post you will see that I made suggestions on how to fix the virus issue. Adewale and I were trying to clear the air on a topic and it has nothing to do with being tecky. Thanks.

Just get Avast and scan ur system.

cheers.

@alexis
no disrespect intended, just that i feel you were clogging up precious posting space arguing about tedious stuff which at the end of the day makes little sense to a lot of people. no offense.

Neoteny,

Well appreciated - I will try not to clog up precious space next time

alexis
well appreciated