Solved

Network driver corrupt/Software won't install

Posted on 2009-05-11
16
747 Views
Last Modified: 2013-11-22
I'm almost sure this system is still infected but I can't find it. I have run Combofix, MAB, SDFix, and TrendMicro's scanner and I still can't get software to install nor can I get the nIC drivers repaired or reinstalled. I've even installed another NIC but the system won't pick it up and install it. The is XP home. Any ideas?
0
Comment
Question by:cebrooks03
  • 10
  • 3
  • 3
16 Comments
 
LVL 4

Expert Comment

by:deltex141
ID: 24357965
First, what's the problem, are your NIC's visible under the device manager? If so, what are they reporting as the status?
0
 
LVL 1

Author Comment

by:cebrooks03
ID: 24358010
Yes, they are visible. They are showing that the drivers are corrupt. I have tried to reinstall them from fresh downloads but the status does not change. I have uninstalled/reinstalled but still no change.
0
 
LVL 4

Expert Comment

by:deltex141
ID: 24358063
Do you have (or can you download) the manufacturer drivers?

Have you tried deleting them entirely, rebooting and reinstalling using fresh drivers? do not attempt to use the drivers previously used, you could also try ripping the nic cards out after removing them from the device manager, rebooting and replugging/installing.
0
 
LVL 1

Author Comment

by:cebrooks03
ID: 24358093
Yea, I have downloaded them. I can't rip 1 of the nics out because it's onboard. I should say the system will also not allow me to install NOD32. I just think it's a virus that has a really tight grip on this system. I'm just out of tools here.
0
 
LVL 4

Expert Comment

by:deltex141
ID: 24358152
Can you boot into safe mode and try installing Spybot or Symantec 360?
0
 
LVL 1

Author Comment

by:cebrooks03
ID: 24358251
i've run everything I know of in safe mode.
0
 
LVL 23

Accepted Solution

by:
Admin3k earned 500 total points
ID: 24358545

try to login using the local administrator account in safe mode
start>run>devmgmt.msc
, locate the driver file windows is using & move / delete it
you can find the driver name/path from Device properties>driver>Driver Details
uninstall the NIC driver from device manager
reboot into Normal mode & let windows pick up the driver installation, locate the driver files manually when prompted
you should also make sure to show Hidden devices from View>Show Hidden Devices, sometimes Malware will install erroneous drivers or other components , look for unidentified/hidden  devices 
also can we please see an updated Hijack this log ?
if the problem persists, can you please run a scan using Autoruns, save as PML log  file, rename to .TXT ,compress to zip & post here.
0
 
LVL 1

Author Comment

by:cebrooks03
ID: 24358671
Here is the HJT log.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 4:20:34 PM, on 5/11/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16791)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTSMLBIZ\Binn\sqlservr.exe
C:\Program Files\Spyware Doctor\pctsAuxs.exe
C:\Program Files\Spyware Doctor\pctsSvc.exe
C:\Program Files\Dell Support Center\bin\sprtsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\system32\userinit.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Dell Support Center\bin\sprtcmd.exe
C:\Program Files\Spyware Doctor\pctsTray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
E:\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = http://www.dell.com
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll
O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\BAE\BAE.dll
O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter
O4 - HKLM\..\Run: [dscactivate] "C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe"
O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-19\..\Run: [jepikebuso] Rundll32.exe "C:\WINDOWS\system32\popefuha.dll",s (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [jepikebuso] Rundll32.exe "C:\WINDOWS\system32\popefuha.dll",s (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (User 'Default user')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: dlcc_device -   - C:\WINDOWS\system32\dlcccoms.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: SupportSoft Sprocket Service (dellsupportcenter) (sprtsvc_dellsupportcenter) - SupportSoft, Inc. - C:\Program Files\Dell Support Center\bin\sprtsvc.exe
O23 - Service: Trend Micro Personal Firewall (TmPfw) - Unknown owner - C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe (file missing)

--
End of file - 6533 bytes
0
Find Ransomware Secrets With All-Source Analysis

Ransomware has become a major concern for organizations; its prevalence has grown due to past successes achieved by threat actors. While each ransomware variant is different, we’ve seen some common tactics and trends used among the authors of the malware.

 
LVL 23

Assisted Solution

by:Admin3k
Admin3k earned 500 total points
ID: 24359144
This certainly looks bad
O4 - HKUS\S-1-5-19\..\Run: [jepikebuso] Rundll32.exe "C:\WINDOWS\system32\popefuha.dll",s (User 'LOCAL SERVICE')                  
        O4 - HKUS\S-1-5-20\..\Run: [jepikebuso] Rundll32.exe "C:\WINDOWS\system32\popefuha.dll",s (User 'NETWORK SERVICE')


when booted in safe mode, Please delete the file C:\WINDOWS\system32\popefuha.dll
or you can disable the startup item using HJT, then locate the file & delete it.
0
 
LVL 1

Author Comment

by:cebrooks03
ID: 24359571
ok, that made no difference.
0
 
LVL 1

Author Comment

by:cebrooks03
ID: 24364491
ok, back at it this morning. HJT shows no changes after removing the above mentioned items.
0
 
LVL 1

Author Comment

by:cebrooks03
ID: 24364974
A bit more info....... I can not start the windows firewall....... because a file is missing... not sure what file. Also, I can't install NOD32. The installation fails for an unknown error.
0
 
LVL 1

Author Comment

by:cebrooks03
ID: 24365053
rebuilding the tcp/ip stack did not resolve it....
0
 
LVL 1

Author Comment

by:cebrooks03
ID: 24365751
winsock reset no worky.....
0
 
LVL 23

Expert Comment

by:Admin3k
ID: 24367789
Can you please attach a recent Combofix log, as well as the Autoruns PML log as per my earlier post.

0
 
LVL 1

Author Comment

by:cebrooks03
ID: 24367859
This has been resolved by repairing the Windows installation. I'm going to give the points to adamin3k for the effort. The HJT log did show some remnants of unwanted apps. The removal off everything crushed the OS and the complete fix was to repair the OS. Thanks for all the help.
0

Featured Post

How to run any project with ease

Manage projects of all sizes how you want. Great for personal to-do lists, project milestones, team priorities and launch plans.
- Combine task lists, docs, spreadsheets, and chat in one
- View and edit from mobile/offline
- Cut down on emails

Join & Write a Comment

Suggested Solutions

Title # Comments Views Activity
SPAM Mail 6 38
Is CCleaner a virus?  Do you use CCleaner? 18 163
Yet another Ransome ware 13 147
Ransomware attacks 5 55
Sub-Titled: “My Way” (with apologies to Francis Albert Sinatra) Let me start by stating emphatically that I am one of those Experts who prefer doing things “My Way”. It’s kind of a no-brainer. “The following procedure works for me, so here is …
Operating system developers such as Microsoft (https://www.microsoft.com) and Apple have made incredible strides in virus protection over the past decade. Operating systems come packaged with built in defensive tools such as virus protection and a f…
Excel styles will make formatting consistent and let you apply and change formatting faster. In this tutorial, you'll learn how to use Excel's built-in styles, how to modify styles, and how to create your own. You'll also learn how to use your custo…
Get a first impression of how PRTG looks and learn how it works.   This video is a short introduction to PRTG, as an initial overview or as a quick start for new PRTG users.

708 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

15 Experts available now in Live!

Get 1:1 Help Now