Jump to content

Welcome to Geeks to Go - Register now for FREE

Geeks To Go is a helpful hub, where thousands of volunteer geeks quickly serve friendly answers and support. Check out the forums and get free advice from the experts. Register now to gain access to all of our features, it's FREE and only takes one minute. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more.

Create Account How it Works
Photo

Problem with the driver for Local Area Connection adapter

AdapterNetwork Drivers Windows7 Local Area Connection

  • Please log in to reply

#16
RKinner

RKinner

    Malware Expert

  • Expert
  • 20,029 posts
  • MVP

Our friend:

R1 JSWPSLWF; C:\Windows\System32\DRIVERS\jswpslwfx.sys [26624 2008-05-15] (Atheros Communications, Inc.) [File not signed]
...
 Date: 2016-03-15 12:13:57.857  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\jswpslwfx.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

What I don't understand is why the file is important.  There is another one which is related to this one:

 

S3 athur; system32\DRIVERS\athurx.sys [X]

 

The [X] means the file is missing.  I'm wondering if it is  a leftover from an earlier WiFi install.  We could remove them  and see what happens.  Worst case you would have to restore it back to before we clear it out.

 

Also do you have any idea what these tasks are doing?

 

Task: {1EA493D9-9F24-4B1A-B947-40AF5936EAD5} - System32\Tasks\{90EC5867-59BF-4FE7-BD45-1451449C0A69} => pcalua.exe -a "C:\Users\User\Desktop\Novi Driveri\win64_153342.exe" -d "C:\Users\User\Desktop\Novi Driveri"

Task: {C5BD7536-550E-4D52-9B7F-CA26F8A29D75} - System32\Tasks\{08D6EE61-D8EE-4B26-890C-B0E61292495D} => pcalua.exe -a "C:\Users\User\Desktop\Novi Driveri\sp74100(1).exe" -d "C:\Users\User\Desktop\Novi Driveri"

 

Appear to be Intel related but I've never seen Novi Driveri before and Google doesn't know it either.

 

Let's see what Speccy says about your PC:

 

 
Get the free version of Speccy:
 
http://www.filehippo...download_speccy(Look in the upper right for the Download
Latest Version button  - Do NOT press the large Start Download button on the upper left!)  Download, Save and Install it.  Run Speccy.  When it finishes (the little icon in the bottom left will stop moving), File, Save as Text File,  (to your desktop) note the name it gives. OK.  Open the file in notepad and delete the line that gives the serial number of your Operating System.  (It will be near the top about 10 lines down.) Attach the file to your next post. (More Reply Options, Choose File, Open, Attach This File.)

  • 0

Advertisements


#17
MCMSBre

MCMSBre

    Member

  • Topic Starter
  • Member
  • PipPip
  • 19 posts

Oh boy did you just make me laugh my tears out :D
"Novi Driveri" is just Serbian (my native language) translation to "New Drivers". It´s just a name i gave to the folder i made for a couple of newer drivers i tried installing. I ran a software that detected drivers that had new versions so i downloaded them on my laptop, transfered it on my PC and installed them. I got a couple of errors while installing some, probably because i tried to install some a couple of times for some reason, or i at least hope that that is the reason...
I haven´t removed files you suggested yet, firstly because i wanted to do the Speccy thing first. But also because the last time i tried restoring my PC it didn´t work perfectly, after restoring it i got error messages about some files. It was related to my OBS (software for screen recording and streaming) so i just uninstalled it and deleted all the files. After that i did not try restoring my PC again but i am still a little bit sceptical about it...

Attached Files


  • 0

#18
RKinner

RKinner

    Malware Expert

  • Expert
  • 20,029 posts
  • MVP

That explains why I've never seen Novi Driveri before.

 

Speccy says you are currently using only the Ethernet connection and not the WiFi  so it shouldn't matter if we remove the WiFi related components.  

 

(Speccy also says it's running nice and cool and that the hard drive is in good shape which is nice to know)

 

You can uninstall Speccy.  I don't think we need it any more and it does stay resident unless you uninstall it.

 

Let's see what happens when we let FRST remove the old WiFi drivers.

 

 

 
Right click on (My) Computer and select Manage (Continue) Then click on the arrow in front of Event Viewer. Next Click on the arrow in front of Windows Logs Right click on System and Clear Log, Clear. Repeat for Application.
 
 
Download the attached fixlist.txt to the same location as FRST
 
Attached File  fixlist.txt   1.47KB   60 downloads
 
Run FRST and press Fix
A fix log will be generated please post that 
 
Reboot and run a FRST scan with Addition.txt checked.  Post both logs.
 
 

  • 0

#19
MCMSBre

MCMSBre

    Member

  • Topic Starter
  • Member
  • PipPip
  • 19 posts

After i ran FRST Fix I lost my connection. Tried restarting but it did not help. Both normal start and with signing disabled don´t have internet acces.

Attached Files


  • 0

#20
RKinner

RKinner

    Malware Expert

  • Expert
  • 20,029 posts
  • MVP

run FRST.  put JSWPSLWF in the box and click on Search Registry.  It will take a while then come back with a log of what it found.  Post the log.


  • 0

#21
MCMSBre

MCMSBre

    Member

  • Topic Starter
  • Member
  • PipPip
  • 19 posts

Farbar Recovery Scan Tool (x64) Version:05-03-2016 01
Ran by User (2016-03-16 16:32:15)
Running from C:\Users\User\Desktop\FRST64
Boot Mode: Normal

================== Search Registry: "JSWPSLWF" ===========

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Network\{4d36e974-e325-11ce-bfc1-08002be10318}\{EF19862D-07B9-4BC2-BCA9-7DD7F64462E4}\Ndi]
"Service"="jswpslwf"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Network\{4d36e974-e325-11ce-bfc1-08002be10318}\{EF19862D-07B9-4BC2-BCA9-7DD7F64462E4}\Ndi]
"CoServices"="jswpslwf"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_JSWPSLWF]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_JSWPSLWF\0000]
"Service"="JSWPSLWF"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\JSWPSLWF]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\JSWPSLWF]
"ImagePath"="system32\DRIVERS\jswpslwfx.sys"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\Network\{4d36e974-e325-11ce-bfc1-08002be10318}\{EF19862D-07B9-4BC2-BCA9-7DD7F64462E4}\Ndi]
"Service"="jswpslwf"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\Network\{4d36e974-e325-11ce-bfc1-08002be10318}\{EF19862D-07B9-4BC2-BCA9-7DD7F64462E4}\Ndi]
"CoServices"="jswpslwf"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_JSWPSLWF]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_JSWPSLWF\0000]
"Service"="JSWPSLWF"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Control\Network\{4d36e974-e325-11ce-bfc1-08002be10318}\{EF19862D-07B9-4BC2-BCA9-7DD7F64462E4}\Ndi]
"Service"="jswpslwf"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Control\Network\{4d36e974-e325-11ce-bfc1-08002be10318}\{EF19862D-07B9-4BC2-BCA9-7DD7F64462E4}\Ndi]
"CoServices"="jswpslwf"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_JSWPSLWF]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_JSWPSLWF\0000]
"Service"="JSWPSLWF"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Network\{4d36e974-e325-11ce-bfc1-08002be10318}\{EF19862D-07B9-4BC2-BCA9-7DD7F64462E4}\Ndi]
"Service"="jswpslwf"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Network\{4d36e974-e325-11ce-bfc1-08002be10318}\{EF19862D-07B9-4BC2-BCA9-7DD7F64462E4}\Ndi]
"CoServices"="jswpslwf"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_JSWPSLWF]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_JSWPSLWF\0000]
"Service"="JSWPSLWF"

====== End of Search ======


  • 0

#22
RKinner

RKinner

    Malware Expert

  • Expert
  • 20,029 posts
  • MVP

Do a Search Registry on

 

EF19862D-07B9-4BC2-BCA9-7DD7F64462E4

 

and post the log.


  • 0

#23
MCMSBre

MCMSBre

    Member

  • Topic Starter
  • Member
  • PipPip
  • 19 posts

Farbar Recovery Scan Tool (x64) Version:05-03-2016 01
Ran by User (2016-03-16 19:13:33)
Running from C:\Users\User\Desktop\FRST64
Boot Mode: Normal

================== Search Registry: "EF19862D-07B9-4BC2-BCA9-7DD7F64462E4" ===========

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\0007\Linkage]
"FilterList"="{6B2717B9-31AA-486B-A352-9EEB122CAD08}-{EF19862D-07B9-4BC2-BCA9-7DD7F64462E4}-0000
{6B2717B9-31AA-486B-A352-9EEB122CAD08}-{C477F579-9F31-474D-86CC-E1567F0BFD1D}-0000
{6B2717B9-31AA-486B-A352-9EEB122CAD08}-{B5F4D659-7DAA-4565-8E41-BE220ED60542}-0000
{6B2717B9-31AA-486B-A352-9EEB122CAD08}-{B70D6460-3635-4D42-B866-B8AB1A24454C}-0000"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Network\{4d36e974-e325-11ce-bfc1-08002be10318}\{EF19862D-07B9-4BC2-BCA9-7DD7F64462E4}]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\JSWPSLWF\Parameters\Adapters\{6B2717B9-31AA-486B-A352-9EEB122CAD08}\{EF19862D-07B9-4BC2-BCA9-7DD7F64462E4}-0000]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\0007\Linkage]
"FilterList"="{57C84DA3-60F6-4DE1-9A32-2A9681C5337B}-{EF19862D-07B9-4BC2-BCA9-7DD7F64462E4}-0000
{57C84DA3-60F6-4DE1-9A32-2A9681C5337B}-{C477F579-9F31-474D-86CC-E1567F0BFD1D}-0000
{57C84DA3-60F6-4DE1-9A32-2A9681C5337B}-{B5F4D659-7DAA-4565-8E41-BE220ED60542}-0000
{57C84DA3-60F6-4DE1-9A32-2A9681C5337B}-{B70D6460-3635-4D42-B866-B8AB1A24454C}-0000"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\Network\{4d36e974-e325-11ce-bfc1-08002be10318}\{EF19862D-07B9-4BC2-BCA9-7DD7F64462E4}]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\0007\Linkage]
"FilterList"="{57C84DA3-60F6-4DE1-9A32-2A9681C5337B}-{EF19862D-07B9-4BC2-BCA9-7DD7F64462E4}-0000
{57C84DA3-60F6-4DE1-9A32-2A9681C5337B}-{C477F579-9F31-474D-86CC-E1567F0BFD1D}-0000
{57C84DA3-60F6-4DE1-9A32-2A9681C5337B}-{B5F4D659-7DAA-4565-8E41-BE220ED60542}-0000
{57C84DA3-60F6-4DE1-9A32-2A9681C5337B}-{B70D6460-3635-4D42-B866-B8AB1A24454C}-0000"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Control\Network\{4d36e974-e325-11ce-bfc1-08002be10318}\{EF19862D-07B9-4BC2-BCA9-7DD7F64462E4}]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\0007\Linkage]
"FilterList"="{57C84DA3-60F6-4DE1-9A32-2A9681C5337B}-{EF19862D-07B9-4BC2-BCA9-7DD7F64462E4}-0000
{57C84DA3-60F6-4DE1-9A32-2A9681C5337B}-{C477F579-9F31-474D-86CC-E1567F0BFD1D}-0000
{57C84DA3-60F6-4DE1-9A32-2A9681C5337B}-{B5F4D659-7DAA-4565-8E41-BE220ED60542}-0000
{57C84DA3-60F6-4DE1-9A32-2A9681C5337B}-{B70D6460-3635-4D42-B866-B8AB1A24454C}-0000"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Network\{4d36e974-e325-11ce-bfc1-08002be10318}\{EF19862D-07B9-4BC2-BCA9-7DD7F64462E4}]

====== End of Search ======


  • 0

#24
RKinner

RKinner

    Malware Expert

  • Expert
  • 20,029 posts
  • MVP

Can you go into regedit and navigate to

 

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\0007\Linkage

 

then double click on 

 

FilterList

 

a box will open with a list of long number.

 

all of them will be highlighted.  Highlight just the top one which should be

 

{57C84DA3-60F6-4DE1-9A32-2A9681C5337B}-{EF19862D-07B9-4BC2-BCA9-7DD7F64462E4}-0000

 

 

and delete it.  That should leave you with:

 

"{57C84DA3-60F6-4DE1-9A32-2A9681C5337B}-{C477F579-9F31-474D-86CC-E1567F0BFD1D}-0000

{57C84DA3-60F6-4DE1-9A32-2A9681C5337B}-{B5F4D659-7DAA-4565-8E41-BE220ED60542}-0000
{57C84DA3-60F6-4DE1-9A32-2A9681C5337B}-{B70D6460-3635-4D42-B866-B8AB1A24454C}-0000"
 
Also navigate to:  HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Network\{4d36e974-e325-11ce-bfc1-08002be10318}\{EF19862D-07B9-4BC2-BCA9-7DD7F64462E4}
 
 
Right click on {EF19862D-07B9-4BC2-BCA9-7DD7F64462E4} and Delete.
 
Then reboot.
 
Any change?
 
 

 


  • 0

#25
MCMSBre

MCMSBre

    Member

  • Topic Starter
  • Member
  • PipPip
  • 19 posts

Normal restart. I got internet connection back, but for a couple of secconds after booting up the "Intel® Smart Connect Technology" icon in the lower right corner had an exclamation mark blinking. Was that normal, maybe it needed some time to install some things back?
Also is this it, or do I have to install some things now, drivers or something?
Do i need to get the JSWPSLWF back, install it correctly, or was it not needed at all?


Edited by MCMSBre, 16 March 2016 - 02:12 PM.

  • 0

Advertisements


#26
RKinner

RKinner

    Malware Expert

  • Expert
  • 20,029 posts
  • MVP

Don't know much about Intel® Smart Connect Technology.  Do you get the same blinking on a second reboot?  If so look in the Event Log, Windows logs,  Application and see if you have a red or yellow flagged item which talks about Intel® Smart Connect Technology.  Might need to be reinstalled.


  • 0

#27
MCMSBre

MCMSBre

    Member

  • Topic Starter
  • Member
  • PipPip
  • 19 posts

I did the second restart, this time there was no exclamation mark blinking.
I did check the event logs, application anyway, and i saw exclamation marks on "ISCT Agent" (always in pair of 2 of those) and "User Profile Service". Those warning repeated a couple of times, probably with every start/restart i have done today.


  • 0

#28
RKinner

RKinner

    Malware Expert

  • Expert
  • 20,029 posts
  • MVP
Please download MiniToolBox, save it to your desktop and run it.
 
Checkmark the following checkboxes:
 
  • List last 10 Event Viewer Errors
  •  
    Click Go and post the result (Result.txt). A copy of Result.txt will be saved in the same directory the tool is run.

    • 0

    #29
    MCMSBre

    MCMSBre

      Member

    • Topic Starter
    • Member
    • PipPip
    • 19 posts

    I see only 1 checkbox in your post. The first pont (bullet, dot) is empty for me. I only ran "List last 10 Event Viewer Errors".


    MiniToolBox by Farbar  Version: 07-02-2016 01
    Ran by User (administrator) on 16-03-2016 at 21:52:58
    Running from "C:\Users\User\Desktop"
    Microsoft Windows 7 Ultimate  Service Pack 1 (X64)
    Model: To Be Filled By O.E.M. Manufacturer: To Be Filled By O.E.M.
    Boot Mode: Normal
    ***************************************************************************

    ========================= Event log errors: ===============================

    Application errors:
    ==================

    System errors:
    =============
    Error: (03/16/2016 11:37:31 AM) (Source: WMPNetworkSvc) (User: )
    Description: Service 'WMPNetworkSvc' did not start correctly because CoCreateInstance(CLSID_UPnPDeviceFinder) encountered error '0x80004005'. Verify that the UPnPHost service is running and that the UPnPHost component of Windows is installed properly.


    Microsoft Office Sessions:
    =========================

    CodeIntegrity Errors:
    ===================================
      Date: 2016-03-15 19:26:49.439
      Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\jswpslwfx.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

      Date: 2016-03-15 19:26:49.392
      Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\jswpslwfx.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

      Date: 2016-03-15 19:24:18.702
      Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\jswpslwfx.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

      Date: 2016-03-15 19:24:18.655
      Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\jswpslwfx.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

      Date: 2016-03-15 19:14:27.280
      Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\jswpslwfx.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

      Date: 2016-03-15 19:14:27.234
      Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\jswpslwfx.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

      Date: 2016-03-15 17:39:03.468
      Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\jswpslwfx.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

      Date: 2016-03-15 17:39:03.405
      Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\jswpslwfx.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

      Date: 2016-03-15 12:13:57.904
      Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\jswpslwfx.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

      Date: 2016-03-15 12:13:57.857
      Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\jswpslwfx.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.


    **** End of log ****
     


    • 0

    #30
    RKinner

    RKinner

      Malware Expert

    • Expert
    • 20,029 posts
    • MVP

    Yes there was just one item to check.  I'm only using it to look at your event log.  My usual tool doesn't speak Serbian but I see your PC is set to use English so it should work.

     

    First Search for services.msc and hit Enter.  That should open the services window.
    Find Windows Media Player Newtork Sharing Service and right click on it and change the Startup Type to Manual.  It's not working but it's not something most people use so best to just turn it off.
     
     
    1. Please download the Event Viewer Tool by Vino Rosso
    and save it to your Desktop:
    2. Right-click VEW.exe and Run AS Administrator
    3. Under 'Select log to query', select:
     
    * System
    4. Under 'Select type to list', select:
    * Error
    * Warning
     
     
    Then use the 'Number of events' as follows:
     
     
    1. Click the radio button for 'Number of events'
    Type 20 in the 1 to 20 box
    Then click the Run button.
    Notepad will open with the output log.
     
     
    Please post the Output log in your next reply then repeat but select Application.  (Each time you run VEW it overwrites the log so copy the first one to a Reply or rename it before running it a second time.)

    • 0






    Similar Topics


    Also tagged with one or more of these keywords: AdapterNetwork, Drivers, Windows7, Local Area Connection

    0 user(s) are reading this topic

    0 members, 0 guests, 0 anonymous users

    As Featured On:

    Microsoft Yahoo BBC MSN PC Magazine Washington Post HP