[RKinner]

Our friend:

R1 JSWPSLWF; C:\Windows\System32\DRIVERS\jswpslwfx.sys [26624 2008-05-15] (Atheros Communications, Inc.) [File not signed]
...
 Date: 2016-03-15 12:13:57.857  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\jswpslwfx.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

What I don't understand is why the file is important.  There is another one which is related to this one:

 

S3 athur; system32\DRIVERS\athurx.sys [X]

 

The [X] means the file is missing.  I'm wondering if it is  a leftover from an earlier WiFi install.  We could remove them  and see what happens.  Worst case you would have to restore it back to before we clear it out.

 

Also do you have any idea what these tasks are doing?

 

Task: {1EA493D9-9F24-4B1A-B947-40AF5936EAD5} - System32\Tasks\{90EC5867-59BF-4FE7-BD45-1451449C0A69} => pcalua.exe -a "C:\Users\User\Desktop\Novi Driveri\win64_153342.exe" -d "C:\Users\User\Desktop\Novi Driveri"

Task: {C5BD7536-550E-4D52-9B7F-CA26F8A29D75} - System32\Tasks\{08D6EE61-D8EE-4B26-890C-B0E61292495D} => pcalua.exe -a "C:\Users\User\Desktop\Novi Driveri\sp74100(1).exe" -d "C:\Users\User\Desktop\Novi Driveri"

 

Appear to be Intel related but I've never seen Novi Driveri before and Google doesn't know it either.

 

Let's see what Speccy says about your PC:

 

 

Get the free version of Speccy:

 

http://www.filehippo...download_speccy(Look in the upper right for the Download

Latest Version button  - Do NOT press the large Start Download button on the upper left!)  Download, Save and Install it.  Run Speccy.  When it finishes (the little icon in the bottom left will stop moving), File, Save as Text File,  (to your desktop) note the name it gives. OK.  Open the file in notepad and delete the line that gives the serial number of your Operating System.  (It will be near the top about 10 lines down.) Attach the file to your next post. (More Reply Options, Choose File, Open, Attach This File.)

[Advertisements]

Oh boy did you just make me laugh my tears out
"Novi Driveri" is just Serbian (my native language) translation to "New Drivers". It´s just a name i gave to the folder i made for a couple of newer drivers i tried installing. I ran a software that detected drivers that had new versions so i downloaded them on my laptop, transfered it on my PC and installed them. I got a couple of errors while installing some, probably because i tried to install some a couple of times for some reason, or i at least hope that that is the reason...
I haven´t removed files you suggested yet, firstly because i wanted to do the Speccy thing first. But also because the last time i tried restoring my PC it didn´t work perfectly, after restoring it i got error messages about some files. It was related to my OBS (software for screen recording and streaming) so i just uninstalled it and deleted all the files. After that i did not try restoring my PC again but i am still a little bit sceptical about it...

Attached Files

•  USER-PC.txt   59.18KB   279 downloads

[MCMSBre]

Oh boy did you just make me laugh my tears out
"Novi Driveri" is just Serbian (my native language) translation to "New Drivers". It´s just a name i gave to the folder i made for a couple of newer drivers i tried installing. I ran a software that detected drivers that had new versions so i downloaded them on my laptop, transfered it on my PC and installed them. I got a couple of errors while installing some, probably because i tried to install some a couple of times for some reason, or i at least hope that that is the reason...
I haven´t removed files you suggested yet, firstly because i wanted to do the Speccy thing first. But also because the last time i tried restoring my PC it didn´t work perfectly, after restoring it i got error messages about some files. It was related to my OBS (software for screen recording and streaming) so i just uninstalled it and deleted all the files. After that i did not try restoring my PC again but i am still a little bit sceptical about it...

Attached Files

•  USER-PC.txt   59.18KB   279 downloads

[RKinner]

That explains why I've never seen Novi Driveri before.

 

Speccy says you are currently using only the Ethernet connection and not the WiFi  so it shouldn't matter if we remove the WiFi related components.  

 

(Speccy also says it's running nice and cool and that the hard drive is in good shape which is nice to know)

 

You can uninstall Speccy.  I don't think we need it any more and it does stay resident unless you uninstall it.

 

Let's see what happens when we let FRST remove the old WiFi drivers.

 

 

 

Right click on (My) Computer and select Manage (Continue) Then click on the arrow in front of Event Viewer. Next Click on the arrow in front of Windows Logs Right click on System and Clear Log, Clear. Repeat for Application.

 

 

Download the attached fixlist.txt to the same location as FRST

 

 

Run FRST and press Fix

A fix log will be generated please post that 

 

Reboot and run a FRST scan with Addition.txt checked.  Post both logs.

 

 

[MCMSBre]

After i ran FRST Fix I lost my connection. Tried restarting but it did not help. Both normal start and with signing disabled don´t have internet acces.

Attached Files

•  Addition.txt   52.68KB   252 downloads
•  Fixlog.txt   2.36KB   234 downloads
•  FRST.txt   34.78KB   229 downloads

[RKinner]

run FRST.  put JSWPSLWF in the box and click on Search Registry.  It will take a while then come back with a log of what it found.  Post the log.

[MCMSBre]

Farbar Recovery Scan Tool (x64) Version:05-03-2016 01
Ran by User (2016-03-16 16:32:15)
Running from C:\Users\User\Desktop\FRST64
Boot Mode: Normal

================== Search Registry: "JSWPSLWF" ===========

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Network\{4d36e974-e325-11ce-bfc1-08002be10318}\{EF19862D-07B9-4BC2-BCA9-7DD7F64462E4}\Ndi]
"Service"="jswpslwf"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Network\{4d36e974-e325-11ce-bfc1-08002be10318}\{EF19862D-07B9-4BC2-BCA9-7DD7F64462E4}\Ndi]
"CoServices"="jswpslwf"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_JSWPSLWF]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_JSWPSLWF\0000]
"Service"="JSWPSLWF"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\JSWPSLWF]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\JSWPSLWF]
"ImagePath"="system32\DRIVERS\jswpslwfx.sys"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\Network\{4d36e974-e325-11ce-bfc1-08002be10318}\{EF19862D-07B9-4BC2-BCA9-7DD7F64462E4}\Ndi]
"Service"="jswpslwf"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\Network\{4d36e974-e325-11ce-bfc1-08002be10318}\{EF19862D-07B9-4BC2-BCA9-7DD7F64462E4}\Ndi]
"CoServices"="jswpslwf"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_JSWPSLWF]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_JSWPSLWF\0000]
"Service"="JSWPSLWF"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Control\Network\{4d36e974-e325-11ce-bfc1-08002be10318}\{EF19862D-07B9-4BC2-BCA9-7DD7F64462E4}\Ndi]
"Service"="jswpslwf"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Control\Network\{4d36e974-e325-11ce-bfc1-08002be10318}\{EF19862D-07B9-4BC2-BCA9-7DD7F64462E4}\Ndi]
"CoServices"="jswpslwf"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_JSWPSLWF]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_JSWPSLWF\0000]
"Service"="JSWPSLWF"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Network\{4d36e974-e325-11ce-bfc1-08002be10318}\{EF19862D-07B9-4BC2-BCA9-7DD7F64462E4}\Ndi]
"Service"="jswpslwf"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Network\{4d36e974-e325-11ce-bfc1-08002be10318}\{EF19862D-07B9-4BC2-BCA9-7DD7F64462E4}\Ndi]
"CoServices"="jswpslwf"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_JSWPSLWF]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_JSWPSLWF\0000]
"Service"="JSWPSLWF"

====== End of Search ======

[RKinner]

Do a Search Registry on

 

EF19862D-07B9-4BC2-BCA9-7DD7F64462E4

 

and post the log.

[MCMSBre]

Farbar Recovery Scan Tool (x64) Version:05-03-2016 01
Ran by User (2016-03-16 19:13:33)
Running from C:\Users\User\Desktop\FRST64
Boot Mode: Normal

================== Search Registry: "EF19862D-07B9-4BC2-BCA9-7DD7F64462E4" ===========

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\0007\Linkage]
"FilterList"="{6B2717B9-31AA-486B-A352-9EEB122CAD08}-{EF19862D-07B9-4BC2-BCA9-7DD7F64462E4}-0000
{6B2717B9-31AA-486B-A352-9EEB122CAD08}-{C477F579-9F31-474D-86CC-E1567F0BFD1D}-0000
{6B2717B9-31AA-486B-A352-9EEB122CAD08}-{B5F4D659-7DAA-4565-8E41-BE220ED60542}-0000
{6B2717B9-31AA-486B-A352-9EEB122CAD08}-{B70D6460-3635-4D42-B866-B8AB1A24454C}-0000"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Network\{4d36e974-e325-11ce-bfc1-08002be10318}\{EF19862D-07B9-4BC2-BCA9-7DD7F64462E4}]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\JSWPSLWF\Parameters\Adapters\{6B2717B9-31AA-486B-A352-9EEB122CAD08}\{EF19862D-07B9-4BC2-BCA9-7DD7F64462E4}-0000]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\0007\Linkage]
"FilterList"="{57C84DA3-60F6-4DE1-9A32-2A9681C5337B}-{EF19862D-07B9-4BC2-BCA9-7DD7F64462E4}-0000
{57C84DA3-60F6-4DE1-9A32-2A9681C5337B}-{C477F579-9F31-474D-86CC-E1567F0BFD1D}-0000
{57C84DA3-60F6-4DE1-9A32-2A9681C5337B}-{B5F4D659-7DAA-4565-8E41-BE220ED60542}-0000
{57C84DA3-60F6-4DE1-9A32-2A9681C5337B}-{B70D6460-3635-4D42-B866-B8AB1A24454C}-0000"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\Network\{4d36e974-e325-11ce-bfc1-08002be10318}\{EF19862D-07B9-4BC2-BCA9-7DD7F64462E4}]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\0007\Linkage]
"FilterList"="{57C84DA3-60F6-4DE1-9A32-2A9681C5337B}-{EF19862D-07B9-4BC2-BCA9-7DD7F64462E4}-0000
{57C84DA3-60F6-4DE1-9A32-2A9681C5337B}-{C477F579-9F31-474D-86CC-E1567F0BFD1D}-0000
{57C84DA3-60F6-4DE1-9A32-2A9681C5337B}-{B5F4D659-7DAA-4565-8E41-BE220ED60542}-0000
{57C84DA3-60F6-4DE1-9A32-2A9681C5337B}-{B70D6460-3635-4D42-B866-B8AB1A24454C}-0000"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Control\Network\{4d36e974-e325-11ce-bfc1-08002be10318}\{EF19862D-07B9-4BC2-BCA9-7DD7F64462E4}]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\0007\Linkage]
"FilterList"="{57C84DA3-60F6-4DE1-9A32-2A9681C5337B}-{EF19862D-07B9-4BC2-BCA9-7DD7F64462E4}-0000
{57C84DA3-60F6-4DE1-9A32-2A9681C5337B}-{C477F579-9F31-474D-86CC-E1567F0BFD1D}-0000
{57C84DA3-60F6-4DE1-9A32-2A9681C5337B}-{B5F4D659-7DAA-4565-8E41-BE220ED60542}-0000
{57C84DA3-60F6-4DE1-9A32-2A9681C5337B}-{B70D6460-3635-4D42-B866-B8AB1A24454C}-0000"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Network\{4d36e974-e325-11ce-bfc1-08002be10318}\{EF19862D-07B9-4BC2-BCA9-7DD7F64462E4}]

====== End of Search ======

[RKinner]

Can you go into regedit and navigate to

 

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\0007\Linkage

 

then double click on 

 

FilterList

 

a box will open with a list of long number.

 

all of them will be highlighted.  Highlight just the top one which should be

 

{57C84DA3-60F6-4DE1-9A32-2A9681C5337B}-{EF19862D-07B9-4BC2-BCA9-7DD7F64462E4}-0000

 

 

and delete it.  That should leave you with:

 

"{57C84DA3-60F6-4DE1-9A32-2A9681C5337B}-{C477F579-9F31-474D-86CC-E1567F0BFD1D}-0000

{57C84DA3-60F6-4DE1-9A32-2A9681C5337B}-{B5F4D659-7DAA-4565-8E41-BE220ED60542}-0000

{57C84DA3-60F6-4DE1-9A32-2A9681C5337B}-{B70D6460-3635-4D42-B866-B8AB1A24454C}-0000"

 

Also navigate to:  HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Network\{4d36e974-e325-11ce-bfc1-08002be10318}\{EF19862D-07B9-4BC2-BCA9-7DD7F64462E4}

 

 

Right click on {EF19862D-07B9-4BC2-BCA9-7DD7F64462E4} and Delete.

 

Then reboot.

 

Any change?

 

 

 

[MCMSBre]

Normal restart. I got internet connection back, but for a couple of secconds after booting up the "Intel® Smart Connect Technology" icon in the lower right corner had an exclamation mark blinking. Was that normal, maybe it needed some time to install some things back?
Also is this it, or do I have to install some things now, drivers or something?
Do i need to get the JSWPSLWF back, install it correctly, or was it not needed at all?

Edited by MCMSBre, 16 March 2016 - 02:12 PM.

[RKinner]

Don't know much about Intel® Smart Connect Technology.  Do you get the same blinking on a second reboot?  If so look in the Event Log, Windows logs,  Application and see if you have a red or yellow flagged item which talks about Intel® Smart Connect Technology.  Might need to be reinstalled.

[MCMSBre]

I did the second restart, this time there was no exclamation mark blinking.
I did check the event logs, application anyway, and i saw exclamation marks on "ISCT Agent" (always in pair of 2 of those) and "User Profile Service". Those warning repeated a couple of times, probably with every start/restart i have done today.

[RKinner]

Please download MiniToolBox, save it to your desktop and run it.

 

Checkmark the following checkboxes:

 

List last 10 Event Viewer Errors

 

Click Go and post the result (Result.txt). A copy of Result.txt will be saved in the same directory the tool is run.

[MCMSBre]

I see only 1 checkbox in your post. The first pont (bullet, dot) is empty for me. I only ran "List last 10 Event Viewer Errors".


MiniToolBox by Farbar  Version: 07-02-2016 01
Ran by User (administrator) on 16-03-2016 at 21:52:58
Running from "C:\Users\User\Desktop"
Microsoft Windows 7 Ultimate  Service Pack 1 (X64)
Model: To Be Filled By O.E.M. Manufacturer: To Be Filled By O.E.M.
Boot Mode: Normal
***************************************************************************

========================= Event log errors: ===============================

Application errors:
==================

System errors:
=============
Error: (03/16/2016 11:37:31 AM) (Source: WMPNetworkSvc) (User: )
Description: Service 'WMPNetworkSvc' did not start correctly because CoCreateInstance(CLSID_UPnPDeviceFinder) encountered error '0x80004005'. Verify that the UPnPHost service is running and that the UPnPHost component of Windows is installed properly.


Microsoft Office Sessions:
=========================

CodeIntegrity Errors:
===================================
  Date: 2016-03-15 19:26:49.439
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\jswpslwfx.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2016-03-15 19:26:49.392
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\jswpslwfx.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2016-03-15 19:24:18.702
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\jswpslwfx.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2016-03-15 19:24:18.655
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\jswpslwfx.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2016-03-15 19:14:27.280
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\jswpslwfx.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2016-03-15 19:14:27.234
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\jswpslwfx.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2016-03-15 17:39:03.468
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\jswpslwfx.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2016-03-15 17:39:03.405
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\jswpslwfx.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2016-03-15 12:13:57.904
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\jswpslwfx.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2016-03-15 12:13:57.857
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\jswpslwfx.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.


**** End of log ****
 

[RKinner]

Yes there was just one item to check.  I'm only using it to look at your event log.  My usual tool doesn't speak Serbian but I see your PC is set to use English so it should work.

 

First Search for services.msc and hit Enter.  That should open the services window.

Find Windows Media Player Newtork Sharing Service and right click on it and change the Startup Type to Manual.  It's not working but it's not something most people use so best to just turn it off.

 

 

1. Please download the Event Viewer Tool by Vino Rosso

http://images.malwar...om/vino/VEW.exe

and save it to your Desktop:

2. Right-click VEW.exe and Run AS Administrator

3. Under 'Select log to query', select:

 

* System

4. Under 'Select type to list', select:

* Error

* Warning

 

 

Then use the 'Number of events' as follows:

 

 

1. Click the radio button for 'Number of events'

Type 20 in the 1 to 20 box

Then click the Run button.

Notepad will open with the output log.

 

 

Please post the Output log in your next reply then repeat but select Application.  (Each time you run VEW it overwrites the log so copy the first one to a Reply or rename it before running it a second time.)