[mutex]

This Broadcom network card was working fine until I got a virus. I noticed that when I unplugged the network cable I would stop getting all the popup error messages and Symantec AV scan boxes caused by the virus. I then disabled the Symantec AV in msconfig and when I rebooted the computer I noticed I had lost Internet access. I tried to 'repair' my Network Connection but I still had no access. I then reset the router and the cable modem. When I tried to right-click on the Network Connection to view the properties it gave me an error message (an unknown error has occurred). Then in desperation I decided to uninstall the network card. I got a message that the card couldn't be uninstalled but when I clicked okay the card was no longer listed in Device Manager. When I rebooted and tried to reinstall the drivers for the card the installation fails. I even went to the manufacturers web site and downloaded new drivers but nothing works. I get the message: "An error occurred during the installation of the device. The specified module could not be found"...even in Safe Mode.

It seems the virus either corrupted a necessary file or disabled my ability to install drivers.

I initially posted my problem on the virus/malware forum (http://www.geekstogo...20#entry1727720) but when they realized I didn't have Internet access due to my network card problem they told me to post the issue here.

Am I stuck in a loop where the Windows XP forum can't help me because of the virus issue and the virus forum can't help me because of the driver issue?

[Advertisements]

Did you try to boot into "safe mode with networking"? If this doesn't work then try to install the driver which you downloaded in safe mode.

If this doesn't work either download Avira AntiVir Rescue System" from here. Use the built-in CD burning option (a CD, not a DVD) and create a bootable CD. Boot the computer with the CD and run a full scan of your system. Please note:

1: Default language is German. You can change to English.

2: Before starting the scan click "configuration" and click the option in which Avira try to repair or rename the infected file.

What we try to do is bring your computer to a state where you can continue cleaning your computer in the malware forum.

[The Skeptic]

Did you try to boot into "safe mode with networking"? If this doesn't work then try to install the driver which you downloaded in safe mode.

If this doesn't work either download Avira AntiVir Rescue System" from here. Use the built-in CD burning option (a CD, not a DVD) and create a bootable CD. Boot the computer with the CD and run a full scan of your system. Please note:

1: Default language is German. You can change to English.

2: Before starting the scan click "configuration" and click the option in which Avira try to repair or rename the infected file.

What we try to do is bring your computer to a state where you can continue cleaning your computer in the malware forum.

[mutex]

Thanks for responding Skeptic. Booting into safe mode with networking didn't work. The guy I'm helping has a 2nd computer which is identical to the infected computer (except for the software installed on it) so I exported the reg key for the network card on that computer (HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\ENUM\PCI) and tried to import it on the infected computer. It wouldn't let me do it and said the files were in use even though the card was disabled and I was in safe mode.

I then downloaded the Avira file you told me about. Unfortunately it was not able to burn an image file on my cd burner. I tried saving the iso file to my hd and then used an image burning utility I got on the web to burn the image to a cd. However, when I try to boot with it I get the boot menu and then no matter what option I choose it starts to load (with the little monkey in the corner of the screen) but after a few seconds I get a blank screen and everything stops. I am going to try to find a friend who has a newer cd burner and see if letting the Avira file burn the cd makes a difference. I will probably try the disk I made on the infected machine tomorrow just in case there is something goofy with my computer.

Below is the information I have from the latest OTL and MBAM scans and a section of the setupapi log file on the infected machine:

First OTL:



And now the setupapi log info:


#-199 Executing "C:\WINDOWS\system32\rundll32.exe" with command line: rundll32.exe newdev.dll,ClientSideInstall \\.\pipe\PNP_Device_Install_Pipe_0.{8834E6AA-5A61-47BE-AA7D-1C506D3165B9}
#I060 Set selected driver.
#-019 Searching for hardware ID(s): pci\ven_14e4&dev_169a&subsys_101517aa&rev_02,pci\ven_14e4&dev_169a&subsys_101517aa,pci\ven_14e4&dev_169a&cc_020000,pci\ven_14e4&dev_169a&cc_0200
#-018 Searching for compatible ID(s): pci\ven_14e4&dev_169a&rev_02,pci\ven_14e4&dev_169a,pci\ven_14e4&cc_020000,pci\ven_14e4&cc_0200,pci\ven_14e4,pci\cc_020000,pci\cc_0200
#I022 Found "PCI\VEN_14e4&DEV_169A" in C:\WINDOWS\inf\oem1.inf; Device: "Broadcom NetLink ™ Gigabit Ethernet"; Driver: "Broadcom NetLink ™ Gigabit Ethernet"; Provider: "Broadcom"; Mfg: "Broadcom"; Section name: "BCM5750A1.XpInst".
#I023 Actual install section: [BCM5750A1.XpInst.NTx86]. Rank: 0x00002001. Effective driver date: 05/15/2006.
#I022 Found "PCI\VEN_14e4&DEV_169A&SUBSYS_101517aa" in C:\WINDOWS\inf\oem1.inf; Device: "Broadcom NetLink ™ Gigabit Ethernet"; Driver: "Broadcom NetLink ™ Gigabit Ethernet"; Provider: "Broadcom"; Mfg: "Broadcom"; Section name: "BCM5750A1.XpInst".
#I023 Actual install section: [BCM5750A1.XpInst.NTx86]. Rank: 0x00000001. Effective driver date: 05/15/2006.
#I022 Found "PCI\VEN_14e4&DEV_169A" in C:\DRIVERS\NETWORK\b57win32.inf; Device: "Broadcom NetLink ™ Gigabit Ethernet"; Driver: "Broadcom NetLink ™ Gigabit Ethernet"; Provider: "Broadcom"; Mfg: "Broadcom"; Section name: "BCM5750A1.XpInst".
#I023 Actual install section: [BCM5750A1.XpInst.NTx86]. Rank: 0x00002001. Effective driver date: 05/15/2006.
#I022 Found "PCI\VEN_14e4&DEV_169A&SUBSYS_101517aa" in C:\DRIVERS\NETWORK\b57win32.inf; Device: "Broadcom NetLink ™ Gigabit Ethernet"; Driver: "Broadcom NetLink ™ Gigabit Ethernet"; Provider: "Broadcom"; Mfg: "Broadcom"; Section name: "BCM5750A1.XpInst".
#I023 Actual install section: [BCM5750A1.XpInst.NTx86]. Rank: 0x00000001. Effective driver date: 05/15/2006.
#-166 Device install function: DIF_SELECTBESTCOMPATDRV.
#I063 Selected driver installs from section [BCM5750A1.XpInst] in "c:\windows\inf\oem1.inf".
#I320 Class GUID of device remains: {4D36E972-E325-11CE-BFC1-08002BE10318}.
#I060 Set selected driver.
#I058 Selected best compatible driver.
#-124 Doing copy-only install of "PCI\VEN_14E4&DEV_169A&SUBSYS_101517AA&REV_02\4&360A6DE&0&00E1".
#-166 Device install function: DIF_REGISTER_COINSTALLERS.
#I056 Coinstallers registered.
#-166 Device install function: DIF_INSTALLINTERFACES.
#-011 Installing section [BCM5750A1.XpInst.NTx86.Interfaces] from "c:\windows\inf\oem1.inf".
#I054 Interfaces installed.
#-166 Device install function: DIF_INSTALLDEVICE.
#I123 Doing full install of "PCI\VEN_14E4&DEV_169A&SUBSYS_101517AA&REV_02\4&360A6DE&0&00E1".
#I121 Device install of "PCI\VEN_14E4&DEV_169A&SUBSYS_101517AA&REV_02\4&360A6DE&0&00E1" finished successfully.
#E154 Class installer failed. Error 126: The specified module could not be found.



THANKS FOR ANY HELP YOU CAN PROVIDE!

Edited by Rorschach112, 06 January 2010 - 05:50 PM.
removed otl log

[mutex]

Okay, I got the Avira disk to boot and run on the infected computer. It said it found 2 Records, 0 Suspect files and 97 warnings. I believe the warnings all had 'unable to extract' 'encrypted file' messages.

It also said 'Checking master boot record drive 128 error(2) cannot read record.

It also found c:\windows\system32\ntll.dll and apparently renamed it and said something about TR/Dropper.Gen. When I rebooted the computer I couldn't find an Avira log file.

Anyway, since the network card still wasn't working and I still couldn't sucessfully reinstall the drivers I decided to boot the computer with a Windows XP home disk they had and go into Recovery Console. Once there I was going to run fixmbr but got a warning message stating "This computer appears to have a non-standard or invalid master boot record. Fixmbr may damage your partition tables if you proceed". This is a Lenovo computer and since I remember IBM doing some pretty non-standard stuff on their computers I thought I better check with you before I ran this utility.

Anyway, I await further instructions.

[The Skeptic]

If the computer boot and run then I don't think the problem is with the MBR. In any case FIXMBR should be taken with care, after your data was backuped first.

Can you use the XP CD to run windows repair? If yes, try it according to the instructions in the link in my list.

If not, download and run winsock and TCP/IP repair, also from my links.

[mutex]

Here is some important information I forgot to tell you. When I initially tried to delete the Broadcom network card in Device Manager it said it couldn't delete it because it might be needed to boot the computer. Also, during boot up there is an option to press CTRL-S to enter the Broadcom network card configuration menu. I took a look at it but I didin't recognize anything so I just let it be.

I'm starting to think this configuration menu might be the key to re-enabling the network card.

Also, I failed to mention that after running MBAM the last time I can now access System Restore. I'm thinking about using System Restore to set the computer back before I got the virus but I assume the virus infected all the restore copies. What do you think.

The other option I considered was deleting the registry key for the network card. It is missing some information compared to their other computer with the same card.

I don't think I will be able to run the Windows XP repair because I don't have an XP Pro Service Pack 3 cd. Won't it just tell me there is a newer version of Windows on the machine? Won't I also need a Product Key? They don't have the XP disk for this computer. I have one for my own computer but I'm not allowed to install it on another computer am I?

Also, I booted this computer with a linux Kubuntu disk I have and was able to access the Internet so I know the network card works.

Everything seems to work fine on the computer now except the network card. Do you think buying a new network card would work?

I have been working on this since Monday. The small business I'm helping is about 5 miles from me so it is very time consuminng testing something and running back and forth to download stuff and do more research. I appreciate your help but I wanted you to be aware that I need to coordinate all this testing with them.

Anyway, do you have any further ideas before I try your previous suggestions?

Thanks.

[The Skeptic]

If you can restore to an earlier date please do it. All we want is to enable networking on this computer and let the malware forum take care of the virus infection.

Regarding buying another card: PCI ethernet cards are cheap and easy to install. You don't even need a driver because all modern cards are recognized by windows and install automatically. This could work, but no guarantee.

[mutex]

GOOD NEWS!!! I ran the winsock and TCP/IP repair and I'm back online and there is no sign of a virus. I downloaded AVG anti-virus and ran a scan and the only thing it found was a couple of files that ComboFix had quarantined.

Everything seems to be working fine now!

Thanks for your help!

Happy New Year!!!

[The Skeptic]

Thanks for letting us know.