I am trying to get a friend's laptop working again.
His kids evidently let the anti virus software expire and..
Now all the network adapters say:
Device Status - windows cannot load the device drivers for this hardware. the driver may be corrupted or missing (Code 39)..
I ran LSPFix.exe and it did not find anything to remove.
I have run SuperAntispyware numerous times and malwarbytes and removed everything they wanted to remove. I have followed all the spyware advice that the laptop will permit, but there are certain files the removal programs want to delete that it will not delete.
I don't know if the network adapters are corrupt because of viruses/rootkits etc, of if there is a hardware issue, which is keeping me from cleaning up the viruses/rootkits, etc.
I would appreciate any advice.
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:38:06 PM, on 5/18/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
I will wait for reply on spyware forum, but from what I have read, it is very ugly.
I got very afraid that I could have transferred it to my husband's desktop computer
since I was using a thumb drive to transfer file to the infected laptop and
one hijackthis log from the laptop to my husband's desktop.
My husband's desktop has upto date McAfee and I think it may have intercepted something from the thumb drive and saved us.
Very scary.
My days of trying to help friends clean things up may be over after this experience.
These entries indicate Virut which I personally will not even attempt to fix. I've tried....
O20 - AppInit_DLLs: c:\progra~1\ThunMail\testabd.dll, <- See here.
O23 - Service: Background Intelligent Transfer Service (BITS) - Unknown owner - C:\WINDOWS\ <- Indicates the computer is, or is trying to, send information to the attacker.
Read this closely. All of your questions should be answered.
The logs show that you are infected by an infection called Virut or Sality. Virut/Sality is a virus that infects all executable files and screensavers. Virut also opens a back door providing the attacker with unauthorized remote access to the infected computer. Definition: Polymorphic virus.
There is no way to cure this infection. Your only option is to perform a full reformat. Do NOT attempt a repair install. Trying to fix this infection will only leave the computer unusable. See Virut on the Rise and Virut and other File infectors - Throwing in the Towel? for more information.
Note that if you decide to try and clean this you must be extremely careful on what is backed up as these new infections can get into many different file extensions ( DLL, EXE, SCR, HTM, HTML, MP3, AVI, WMV, PDF.....etc). A complete reformat and reinstall is highly suggested! Avoid backing up compressed files (zip/cab/rar.....etc). Virut can also penetrate compressed files that have .exe or .scr inside them.
Backing up files before formatting
If you backup any files they should be scanned from a clean properly protected PC before restoring. Also be careful what scanner is used as some are very poor at detecting and even worse at protecting from this infection. In fact due to the nature of these new infections there are probably no tools that will properly protect you from the infection. Be very selective and only backup files you can not replace like text documents and personal photos.
Do not back up to another machine! It will likely become infected by Virut. Burn to DVD/CD, a flash drive or to an external drive which has nothing else on it and which you can format should it become infected from the backups.
I suggest running at least 3 of the below scanners on the backup files. Run the first scan then reboot before running the second then reboot after the second before running the third.
Very important, do the following immediately or as soon as possible!
If you have done any online transactions, call all of your banks, credit card companies, financial institutions and inform them that you may be a victim of identity theft and to put a watch on your accounts and/or change all of your account numbers.
From a clean computer change all of your online passwords including for email, banks, financial accounts, PayPal, eBay, online credit card companies and any online forums or groups you belong to etc.
DO NOT change passwords or do any transactions while using the infected computer. The attacker will get the new passwords and transaction information.
.
Our help here is always free but it does cost money to keep the site running. If you feel we've helped you, Please Donate to the Forum
LinkBack URL
About LinkBacks
all network adapter corrupt or missing
Reply With Quote
