67 replies to this topic

[zillah]

Quote

look at the DWORD value in the right pane.

I did search more than one times for "wan miniport" ,,,,,and in all my search that I have done in the right pane ,,,,,,I have got : " Name , Type, Data ",,,,,,,,,,,,,,,,most of the keys are of " Type : REG_SZ "not of " Type DWORD "Please see some screen shoots that I have taken http://i45.tinypic.com/2w3dp2o.jpgThanks

[Tushman]

zillah, on Jul 4 2010, 09:13 PM, said:

I did search more than one times for "wan miniport" ,,,,,and in all my search that I have done in the right pane ,,,,,,I have got : " Name , Type, Data ",,,,,,,,,,,,,,,,most of the keys are of " Type : REG_SZ "not of " Type DWORD "Please see some screen shoots that I have taken http://i45.tinypic.com/2w3dp2o.jpgThanks

Zillah,In the first two screenshots you posted, the DWORD value I'm referring to is the one that is named "characteristics". (2nd one listed in the right hand pane window).You should also search for the "wan miniport" in the following subkey:HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ClassIf you are able to find it, then make the changes I suggested earlier.  The Current Control Set takes precedence over the Current Control Set 001 and 002.

Edited by Tushman, 05 July 2010 - 12:00 AM.

[zillah]

Quote

There is a value named "characteristic' with a value of 0x00000029. (2nd one listed) That is the value that is prohibiting you from deleting it from the device manager. Double click to change the value. Type in a value of 0x00000009

I did change the value from 0x00000029 to 0x00000009,,,,,,,,,,,,,I was able to delete all of them from the device manager except "Direct Parallel" option ,,,,,please see the screen shot that I posted earlier.Now whenever I installed the driver for the network card it is still coming with yellow exclamation mark and I can not find the icon for the LAN adapter under " My Network Place" Thanks

[Tushman]

zillah, on Jul 5 2010, 02:33 AM, said:

I did change the value from 0x00000029 to 0x00000009,,,,,,,,,,,,,I was able to delete all of them from the device manager except "Direct Parallel" option ,,,,,please see the screen shot that I posted earlier.Now whenever I installed the driver for the network card it is still coming with yellow exclamation mark and I can not find the icon for the LAN adapter under " My Network Place" Thanks

You probably still have some type of a malware infection.  Download HijackThis! and when you scan it, click the option for "Scan and Save Log".  Paste the log contents here in the forum and we can help you further.Also, post another screenshot of your device manager now that you have managed to delete all the wan miniports.

Edited by Tushman, 05 July 2010 - 12:40 PM.

[zillah]

Thanks Tushman for your help

Quote

Download HijackThis! and when you scan it, click the option for "Scan and Save Log". Paste the log contents here in the forum and we can help you further.

Logfile of Trend Micro HijackThis v2.0.4Scan saved at 2:02:51 PM, on 7/6/2010Platform: Windows XP SP3 (WinNT 5.01.2600)MSIE: Internet Explorer v8.00 (8.00.6001.18702)Boot mode: NormalRunning processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\spoolsv.exeC:\Program Files\AVG\AVG9\avgwdsvc.exeC:\Program Files\AVG\AVG9\avgchsvx.exeC:\Program Files\AVG\AVG9\avgrsx.exeC:\Program Files\PC Connectivity Solution\ServiceLayer.exeC:\Program Files\AVG\AVG9\avgcsrvx.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\Explorer.EXEC:\PROGRA~1\AVG\AVG9\avgtray.exeC:\WINDOWS\system32\hkcmd.exeC:\WINDOWS\system32\igfxpers.exeC:\WINDOWS\system32\ctfmon.exeC:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exeC:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exeC:\Program Files\Trend Micro\HiJackThis\HiJackThis.exeR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.com.au/R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dllO2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dllO2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dllO2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dllO2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dllO2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dllO4 - HKLM\..\Run: [AVG9_TRAY] C:\PROGRA~1\AVG\AVG9\avgtray.exeO4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exeO4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exeO4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exeO4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exeO6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel presentO8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dllO9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dllO9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLLO9 - Extra button: (no name) - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\system32\shdocvw.dllO9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dllO9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dllO9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exeO9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exeO9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO16 - DPF: {1CE17C82-8DE2-4EF6-ACF9-3A8B21830475} (Courier6 Control) - https://csm.cybertrust.com.au/courier/couriercontrol.cabO16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase6087.cabO16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cabO17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = any.localO17 - HKLM\Software\..\Telephony: DomainName = any.localO17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = any.localO17 - HKLM\System\CS1\Services\Tcpip\..\{A92F07A1-A271-4B39-82ED-279EBA843C61}: NameServer = 192.168.0.50O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = any.localO17 - HKLM\System\CS3\Services\Tcpip\Parameters: Domain = any.localO18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dllO18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG9\avgpp.dllO20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dllO23 - Service: AVG Free WatchDog (avg9wd) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG9\avgwdsvc.exeO23 - Service: ServiceLayer - Nokia - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe--End of file - 5751 bytes

I tried to use those two links to analyze the log above http://hjt.networktechs.com/http://hijackthis.de...gselect=englishYes I do believe It is NOT to be used as a replacement for an expert but I believe it can be used as an educational tool

Quote

Also, post another screenshot of your device manager now that you have managed to delete all the wan miniports.

http://i46.tinypic.com/mw6r8g.jpg

Edited by zillah, 06 July 2010 - 12:13 AM.

[Tushman]

Your system looks pretty clean from what I can tell.  If you're still unable to connect to the internet, try the winsock repair utility.

[zillah]

Quote

If you're still unable to connect to the internet, try the winsock  repair utility.

I did used winsock without any joy ,,,,still I can not see LAN icon within the "My Network Place"Thanks

[Temmu]

it's been ~ 10 days since the original post and a lot of time spent.so, is there anything so extraordinarily special about this optiplex gx620 that warrants ~not~ simply wiping it and reinstalling from scratch?  (don't forget to backup, and also to drop the partition table from a bootable disk(ette) (that will wipe any rootkits, and i have other reasons i do that...))

[Tushman]

zillah, on Jul 6 2010, 04:42 AM, said:

I did used winsock without any joy ,,,,still I can not see LAN icon within the "My Network Place"Thanks

Zillah,Just because you cannot see the LAN icon in My Network places doesn't necessarily mean there's a problem.  I've got the same thing as you can see from my screenshot.  Sounds like to me your NIC driver has become corrupt.  Try re-installing the NIC driver.  It's possible that you have the wrong version driver. The following URL is the driver download page for your Dell Optiplex.Broadcom Integrated Controller.What kind of internet connection do you have by the way?

Edited by Tushman, 06 July 2010 - 11:57 AM.

[lewmur]

zillah, on Jul 6 2010, 04:42 AM, said:

I did used winsock without any joy ,,,,still I can not see LAN icon within the "My Network Place"Thanks

I'm going to risk another tongue lashing by making a suggestion.  In the Device Manager, right click the Broadcom network cards and then /Properties/Driver/Driver Details to find the file names of the drivers.  Rename the files.Then in regedit find "networkcards."  Click the entries till you find the one for "Direct Parallel.  Delete the entire entry.With the fingers on both hands crossed, reboot and reinstall the network card driver.

[zillah]

Quote

so, is there anything so extraordinarily special about this optiplex gx620 that warrants ~not~ simply wiping it and reinstalling from scratch?

No there is nothing special but now becomes a type of challenge,,,I just want to find out where is the problem of course by your helps guys

Quote

It's possible that you have the wrong version driver.

I have checked it again buy using the Dell service tag and it the same one that I was using ,,,,any way I downloaded again and still I could not fix the issue

Quote

The following URL is the driver download page for your Dell Optiplex.

This is diagnostic utility not the driver,,,,although I have installed that as well

Quote

What kind of internet connection do you have by the way?

Cable internet.

[zillah]

Hi lewmur

Quote

names of the drivers. Rename the files.

I did find the drivers name but I could not rename them http://i50.tinypic.com/fyzawx.jpg

[zillah]

When I use the driver for the networkcard it can remove the installed driver and install afresh one as can be seen in the snapshot below http://i48.tinypic.com/24v4br9.jpgBut then for few seconds every thing is okay as can be seen in the snap shot below http://i50.tinypic.com/29d9r91.jpgThen all of the sudden another message pops up saying : devices may not work correctly,,,,I could not record that word by word

[Tushman]

zillah, on Jul 6 2010, 04:11 PM, said:

When I use the driver for the networkcard it can remove the installed driver and install afresh one as can be seen in the snapshot below.... Then all of the sudden another message pops up saying : devices may not work correctly,,,,I could not record that word by word

So it's able to recognize the NIC but the driver does not seem to take. Interesting.  Just by the error message that you reported, I think that the hardware abstraction layer seems to be intact. Something else is going on that prohibiting the system from making an internet connection.  It sounds suspiciously like a corrupt registry setting.Earlier when you modified the registry key from 0x00000029 to 0x00000009 - which key did you make that change in?HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ClassorHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet001\Control\ClassI hope that you made the change in the first one.  If you didn't go back in and delete all references to the wan miniport in the 1st key.HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ClassAlso if you want to remove the "direct parallel" from the device manager, you'll have to make the same changes as before.  This time make sure you are in the CurrentControlSet -- and not the CurrentControlSet001 subkey.I'd also like to see what processes are in the startup.  Type 'msconfig' in the run command line and take a screenshot of the Start up tab.

Edited by Tushman, 06 July 2010 - 07:46 PM.

[zillah]

Quote

You should also search for the "wan miniport" in the following subkey:HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ClassIf you are able to find it, then make the changes I suggested earlier.

I forgot to answer that ,,,,through my search for "wan miniport" I could not find it within HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class,,,,,therefore I did not make any changes

Quote

Earlier when you modified the registry key from 0x00000029 to 0x00000009 - which key did you make that change in?HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ClassorHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet001\Control\Class

I guess the above answeres this quote ,,,,doesn't it ?

Quote

Also if you want to remove the "direct parallel" from the device manager, you'll have to make the same changes as before. This time make sure you are in the CurrentControlSet -- and not the CurrentControlSet001 subkey.

I will do that as well

Quote

I'd also like to see what processes are in the startup. Type 'msconfig' in the run command line and take a screenshot of the Start up tab.

http://i50.tinypic.com/2zf6a2t.jpg

[Tushman]

Zillah,This is unrelated to your internet connection issue, but you have unchecked some necessary components.  You need to recheck the 3 items that I've highlighted with the red outline.

Edited by Tushman, 06 July 2010 - 09:39 PM.

[zillah]

Quote

but you have unchecked some necessary components. You need to recheck the 3 items that I've highlighted with the red outline.

I did recheck them again

[lewmur]

zillah, on Jul 6 2010, 04:04 PM, said:

Hi lewmurI did find the drivers name but I could not rename them http://i50.tinypic.com/fyzawx.jpg

Have you tried renaming them while in Safe Mode?  Or boot using the XP CD and doing it from the Repair Console.

[zillah]

Hi lewmur

Quote

Have you tried renaming them while in Safe Mode

I will try in safe mode,,,,,to what name should I rename them ? Any name ?Thanks

[goretsky]

Hello,I noticed from your HijackThis log and System Configuration Utility screenshot that you had Spybot - Search & Destroy, MalwareBytes and AVG installed on the computer.  While I am not aware of any specific conflict between these three programs, perhaps there is some interaction between them which is blocking the successful reinstallation of the device drivers.Another possibility—and perhaps a more likely one—is that there was some additional damage done to the system by the Trojan horse or perhaps a remnant of it is still present on the system and interfering with the device driver reinstallation.  If that is the case, it might time to contact one of the vendors in question and see if they have any supplemental tools you can run to look for additional malware and/or repair damage caused by an infestation.Regards,Aryeh Goretsky

[zillah]

Hi AryehGood day to you

Quote

I noticed from your HijackThis log and System Configuration Utility screenshot that you had Spybot - Search & Destroy, MalwareBytes and AVG installed on the computer. While I am not aware of any specific conflict between these three programs, perhaps there is some interaction between them which is blocking the successful reinstallation of the device drivers.

Yes I did install these 3 programs when i was cleaning the PC.Thanks

[Tushman]

zillah, on Jul 7 2010, 04:35 AM, said:

Hi AryehGood day to you Yes I did install these 3 programs when i was cleaning the PC.Thanks

What he is saying is that you should uninstall those programs for a moment and try to install the NIC driver again.

[zillah]

Quote

should uninstall those programs for a moment and try to install the NIC driver again.

I did and I received below:

Quote

Then all of the sudden another message pops up saying : devices may not work correctly,,,,I could not record that word by word

And this is the exact message word by wordhttp://i29.tinypic.com/34ifmmx.jpg

[Tushman]

Zillah,Click on the control panel and open up your network connections applet.  For your Broadcomm NIC, right click and choose 'properties' from the context menu.   I've posted a screenshot of my network connection for your reference.  You should see the NIC properties menu show up as in my 2nd screenshot.Post back let us know which items are checked.

[zillah]

Quote

Click on the control panel and open up your network connections applet. For your Broadcomm NIC

This is what I meant by

Quote

still I can not see LAN icon within the "My Network Place"

I can not see the icon for Broadcomm NIC