nic card mac address problem

Posted on 2009-04-30
Last Modified: 2012-05-06
I have a computer that lost it's network connection.  The nic card in device mgr had exclamation marks by it so I physically removed that card and installed a different one.  Problem solved until I reboot the computer and then no network connection.  I run ipconfig /all and it shows a mac address of ff ff ff ff ff ff ff ff but it has been handed a dhcp ip address.  I cannot ping anything except localhost nor can any pc on the network ping this pc.  I then uninstall the nic from device mgr and do a hardware scan and it finds the nic, installs it, and I have network connection again.  When this happens I checked the mac address and it is what is printed on the card.  Reboot the computer and it's back to no network connection again.  Uninstall and reinstall and I can get the network connection back up and running.  Have tried the card in two different pci slots with the same results.
Question by:mrsam3
    LVL 2

    Expert Comment

    Download latest drivers for the NIC and install them and if there is a diagnostic software for the NIC download and install too.

    LVL 7

    Expert Comment

    I think this is a failed NIC card.  In a lot of cards, especially older ones, The MAC address is stored in a separate chip which, in your case, seems to have failed, at least after a reboot.    I would just replace the card.
    LVL 2

    Author Comment

    Replaced nic card with a brand new one and the problem still exists.  Ran spyware/virus/malware scans and found a few files infected but after cleaning problem is still there.  Also now it is finding hardware that is not attached to the system.  I have one nic card in this system and it does not have an onboard nic but after one of the scans was finished I have 5 items listed under network adpts. in dev mgr.  DQ USB IAD Lan modem, LiteOn Comm Compatable PCI Fast Eth Adpt, Realtek RTL8139 Family PCI Fast Eth Adpt, and Wan Miniport (IP).  The fifth listing is the Linksys nic card that works if you uninstall it and do a hardware scan to reinstall it.  If I try to remove any of the other four listed items I get 'Failed to uninstall device. It may be required to boot up the system.
    LVL 7

    Expert Comment

    Sounds like the malware may have dome some nastiness to the networking stack.

    The only sure fix is a complete reinstall, but failing that you may want to to look deeper for more malware.  A lot of times, what you clean off is a secondary infection.  You may have a rootkit embedded in the networking section.

    I like to use Combofix to clean out deep rootkits, Google for Combofix.

    This is a strange one, the computer sounds quite sick.
    LVL 2

    Accepted Solution

    Reran much of the malware rookit scans and although it found a few things it did not stop the nic card from being reset to all Fs after a reboot.  Did some more reading on the net and found a suggestion that had me enter a new string value key in the registry named NetworkAddress and the value was the nic card mac address.  This key was in hklm\currentcontrolset\control\class\{4d36e972e325-11ce-bfc1-08002be10318}.  It said to look for all listings of the nic card starting with 0000.  Mine was under 0001 because I had only installed the driver once.  I had uninstalled and reinstalled the nic card many times always using the same driver.  I then rebooted and was able to get on the net right after the boot.  I rebooted several times and also shut the pc off and unplugged it, and after each time I was back on the net as it should be.  Apparently reinstalling the nic card refreshed the mac address temporally until the reboot reset it and since there was no reference to mac address anywhere in the registry it defaulted to all Fs.  This problem has been solved.

    Featured Post

    IT, Stop Being Called Into Every Meeting

    Highfive is so simple that setting up every meeting room takes just minutes and every employee will be able to start or join a call from any room with ease. Never be called into a meeting just to get it started again. This is how video conferencing should work!

    Join & Write a Comment

    We have adopted the strategy to use Computers in Student Labs as the bulletin boards. The same target can be achieved by using a Login Notice feature in Group policy but it’s not as attractive as graphical wallpapers with message which grabs the att…
    If you have done a reformat of your hard drive and proceeded to do a successful Windows XP installation, you may notice that a choice between two operating systems when you start up the machine. Here is how to get rid of this: Click Start Clic…
    In this sixth video of the Xpdf series, we discuss and demonstrate the PDFtoPNG utility, which converts a multi-page PDF file to separate color, grayscale, or monochrome PNG files, creating one PNG file for each page in the PDF. It does this via a c…
    This video discusses moving either the default database or any database to a new volume.

    728 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    22 Experts available now in Live!

    Get 1:1 Help Now