
Posted:
Wed Mar 21, 2007 2:45 pm
by buboes
Hmm.. well here's the logfile:
Logfile of HijackThis v1.99.1
Scan saved at 6:38:21 AM, on 3/21/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
C:\Program Files\Sophos\Sophos Anti-Virus\SAVAdminService.exe
C:\Program Files\Common Files\SafeNet Sentinel\Sentinel Protection Server\WinNT\spnsrvnt.exe
C:\WINDOWS\System32\snmp.exe
C:\Program Files\Sophos\AutoUpdate\ALsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\NETGEAR\WG511SCU\Utility\Gear511.exe
C:\Program Files\PeerGuardian2\pg2.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Sophos\AutoUpdate\ALMon.exe
C:\Program Files\Privoxy\privoxy.exe
C:\Program Files\K-Meleon\loader.exe
C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
C:\Program Files\K-Meleon\k-meleon.exe
C:\Program Files\HijackThis\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar =
http://ie.redirect.hp.com/svs/rdr?TYPE= ... &pf=laptop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
http://ie.redirect.hp.com/svs/rdr?TYPE= ... &pf=laptop
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext =
http://www.americangreetings.com/cnp/hp ... source=hpn
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [AS00_Gear511] C:\Program Files\NETGEAR\WG511SCU\Utility\Gear511.exe -hide
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKCU\..\Run: [PeerGuardian] C:\Program Files\PeerGuardian2\pg2.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: K-Meleon Loader.lnk = C:\Program Files\K-Meleon\loader.exe
O4 - Global Startup: AutoUpdate Monitor.lnk = C:\Program Files\Sophos\AutoUpdate\ALMon.exe
O4 - Global Startup: Privoxy.lnk = C:\Program Files\Privoxy\privoxy.exe
O8 - Extra context menu item: E&xport to Microsoft Excel -
res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O12 - Plugin for .fpx: C:\Program Files\Internet Explorer\PLUGINS\NPRVRT34.dll
O12 - Plugin for .ivr: C:\Program Files\Internet Explorer\PLUGINS\NPRVRT34.dll
O14 - IERESET.INF: START_PAGE_URL=http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q105&bd=presario&pf=laptop
O16 - DPF: {C1BAC744-8F0B-11D0-89E7-00C0A8295197} (Cameractl Class) -
http://www.berkeley.edu/webcams/camera.cab
O16 - DPF: {C5E28B9D-0A68-4B50-94E9-E8F6B4697514} (NsvPlayX Control) -
http://www.nullsoft.com/nsv/embed/nsvplayx_vp3_mp3.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\SHARED\HPQWMI.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Kerio Personal Firewall 4 (KPF4) - Kerio Technologies - C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
O23 - Service: SQL Server (QSRNVIVO) (MSSQL$QSRNVIVO) - Unknown owner - c:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe" -sQSRNVIVO (file missing)
O23 - Service: Sophos Anti-Virus status reporter (SAVAdminService) - Sophos Plc - C:\Program Files\Sophos\Sophos Anti-Virus\SAVAdminService.exe
O23 - Service: Sophos Anti-Virus (SAVService) - Sophos Plc - C:\Program Files\Sophos\Sophos Anti-Virus\SavService.exe
O23 - Service: SentinelProtectionServer - SafeNet, Inc - C:\Program Files\Common Files\SafeNet Sentinel\Sentinel Protection Server\WinNT\spnsrvnt.exe
O23 - Service: Sophos AutoUpdate Service - Sophos Plc - C:\Program Files\Sophos\AutoUpdate\ALsvc.exe

Posted:
Sun Mar 25, 2007 3:20 pm
by buboes
1. I tried the uninstall from the cd. Very exciting, it got as far as 2% before it hanged, as opposed to 0%! I still had to ctrl-alt-del it and got the same error message.
2. Contents of the inf file:
;/*++
;
;Copyright (c) 2004 NETGEAR Communications, Incorporated All Rights Reserved
;
;Module Name:
;
; netw511.inf
;
;Abstract:
; INF file for installing NETGEAR WG511T Wireless Network Adapter
;
;--*/
[Version]
Signature = "$Chicago$" ; Single INF file for Windows 98 and Windows 2000
Compatible = 1 ; Single INF file for Windows 98 and Windows 2000
Class = Net
ClassGUID = {4D36E972-E325-11CE-BFC1-08002BE10318}
Provider = %Vendor_String%
DriverVer = 03/23/2006,4.2.2.14 ; Recognized by Windows 2000 only
CatalogFile = netw511.cat
[Manufacturer]
%Vendor_String% = Vendor
[ControlFlags]
ExcludeFromSelect = PCI\VEN_168C&DEV_0013&SUBSYS_4B001385
ExcludeFromSelect = PCI\VEN_168C&DEV_0013&SUBSYS_5B001385
[Vendor]
; DisplayName Section DeviceID
; ----------- ------- --------
%LEX.DeviceDesc.CB31g% = LEX_CB31g_02, PCI\VEN_168C&DEV_0013&SUBSYS_4B001385
%LEX.DeviceDesc.CB31g% = LEX_CB31g_01, PCI\VEN_168C&DEV_0013&SUBSYS_5B001385
;==========================================
[LEX_CB31g_02.NT] ; Win2k
AddReg = LEX_CB31g_02_2k.reg, LEX_CB31g_02_9x_2k.reg, COMMON_MB22ag.reg, COMMON_SG.reg, COMMON_NDIS_2k_WG511.reg, COMMON_CARDBUS.reg, COMMON.reg
CopyFiles = WLAN_2k_WG511.CopyFiles
DelFiles = WLAN_2k.DelIniFiles
BusType = 5 ; Treat CARDBUS as PCI
Characteristics = 0x84 ; NCF_PHYSICAL | NCF_HAS_UI
[LEX_CB31g_02.NT.Services]
AddService = NETGEAR_WG511_SERVICE, 2, WlanNetCard_WG511.Service, WlanNetCard.EventLog
[LEX_CB31g_02_2k.reg]
[LEX_CB31g_02_9x_2k.reg]
HKR, , VendorDesc, 0, %LEX.DeviceDesc.CB31g%
;==========================================
[LEX_CB31g_01.NT] ; Win2k
AddReg = LEX_CB31g_01_2k.reg, LEX_CB31g_01_9x_2k.reg, COMMON_MB22ag.reg, COMMON_SG.reg, COMMON_NDIS_2k_WG511.reg, COMMON_CARDBUS.reg, COMMON.reg
CopyFiles = WLAN_2k_WG511.CopyFiles
DelFiles = WLAN_2k.DelIniFiles
BusType = 5 ; Treat CARDBUS as PCI
Characteristics = 0x84 ; NCF_PHYSICAL | NCF_HAS_UI
[LEX_CB31g_01.NT.Services]
AddService = NETGEAR_WG511_SERVICE, 2, WlanNetCard_WG511.Service, WlanNetCard.EventLog
[LEX_CB31g_01_2k.reg]
[LEX_CB31g_01_9x_2k.reg]
HKR, , VendorDesc, 0, %LEX.DeviceDesc.CB31g%
;###############################################################################
[WlanNetCard_WG511.Service]
DisplayName = %WG511_Service.DispName%
ServiceType = 1 ; SERVICE_KERNEL_DRIVER
StartType = 3 ; SERVICE_DEMAND_START
ErrorControl = 1 ; NORMAL
ServiceBinary = %12%\wg511nd5.sys
LoadOrderGroup = NDIS
[WlanNetCard.EventLog]
AddReg = WlanNetCard.EventLog.reg
[WlanNetCard.EventLog.reg]
HKR, , EventMessageFile, 0x00020000, "%%SystemRoot%%\System32\netevent.dll"
HKR, , TypesSupported, 0x00010001, 7
;###############################################################################
[COMMON_CARDBUS.reg]
;RegKey,SubKey ,Name ,Type ,Value
;------------- ----- ----- ------
HKR,NDI ,CardType ,0 ,"PCI"
HKR, ,BusType ,0 ,"5"
[COMMON_PCI.reg]
HKR,NDI ,CardType ,0 ,"PCI"
HKR, ,BusType ,0 ,"5"
;^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
[COMMON_CB21.reg]
HKR, ,NicType ,0x00002 ,"0" ; CB21
[COMMON_MB22.reg]
HKR, ,NicType ,0x00002 ,"2" ; MB22
[COMMON_MB22g.reg]
HKR, ,NicType ,0x00002 ,"5" ; MB22g
[COMMON_MB22ag.reg]
HKR, ,NicType ,0x00002 ,"6" ; MB22ag
[COMMON_A.reg]
HKR, , NetBand, 0x00002, %NetBand_DEF_STR_A%
HKR, , AdHocBand, 0x00002, %AdhocBand_DEF_STR_A%
[COMMON_AB.reg]
HKR, , NetBand, 0x00002, %NetBand_DEF_STR_AB%
HKR, , AdHocBand, 0x00002, %AdhocBand_DEF_STR_AB%
[COMMON_G.reg]
HKR, , NetBand, 0x00002, %NetBand_DEF_STR_G%
HKR, , AdHocBand, 0x00002, %AdhocBand_DEF_STR_G%
[COMMON_AG.reg]
HKR, , NetBand, 0x00002, %NetBand_DEF_STR_AG%
HKR, , AdHocBand, 0x00002, %AdhocBand_DEF_STR_AG%
[COMMON_SG.reg]
HKR, , NetBand, 0x00002, %NetBand_DEF_STR_SG%
HKR, , AdHocBand, 0x00002, %AdhocBand_DEF_STR_G%
;^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
[COMMON_NDIS_2k_WG511.reg]
HKR,NDI\Interfaces ,UpperRange ,0 ,"ndis5"
HKR,NDI\Interfaces ,LowerRange ,0 ,"ethernet"
HKR,NDI ,Service ,0 ,"NETGEAR_WG511_SERVICE"
HKR, ,aifs ,0 ,"2"
HKR, ,cwmin ,0 ,"15"
[COMMON.reg]
HKR, , sleepMode, 0x00002, "0"
;HKR, , sleepMode, 0x00002, %sleepMode_DEFAULT%
;HKR, Ndi\params\sleepMode, ParamDesc, 0, %sleepMode%
;HKR, Ndi\params\sleepMode, Base, 0, "10"
;HKR, Ndi\params\sleepMode, default, 0, %sleepMode_DEFAULT%
;HKR, Ndi\params\sleepMode, type, 0, "enum"
;HKR, Ndi\params\sleepMode\enum, "0", 0, %sleepModeOff%
;HKR, Ndi\params\sleepMode\enum, "2", 0, %sleepModeNormal%
;HKR, Ndi\params\sleepMode\enum, "1", 0, %sleepModeMax%
HKR, , tpc, 0x00002, %tpc_DEFAULT%
HKR, Ndi\params\tpc, ParamDesc, 0, %tpc%
HKR, Ndi\params\tpc, Base, 0, "10"
HKR, Ndi\params\tpc, default, 0, %tpc_DEFAULT%
HKR, Ndi\params\tpc, type, 0, "enum"
HKR, Ndi\params\tpc\enum, "0", 0, "100%"
HKR, Ndi\params\tpc\enum, "1", 0, "50%"
HKR, Ndi\params\tpc\enum, "2", 0, "25%"
HKR, Ndi\params\tpc\enum, "3", 0, "12.5%"
HKR, Ndi\params\tpc\enum, "4", 0, %tpcLowest%
HKR, , shortPreamble, 0x00002, %shortPreamble_DEFAULT%
HKR, Ndi\params\shortPreamble, ParamDesc, 0, %shortPreamble%
HKR, Ndi\params\shortPreamble, Base, 0, "10"
HKR, Ndi\params\shortPreamble, default, 0, %shortPreamble_DEFAULT%
HKR, Ndi\params\shortPreamble, type, 0, "enum"
HKR, Ndi\params\shortPreamble\enum, "1", 0, %shortPreambleEnable%
HKR, Ndi\params\shortPreamble\enum, "0", 0, %shortPreambleDisable%
HKR, , radioEnable, 0x00002, %radio_DEFAULT%
HKR, Ndi\params\radioEnable, ParamDesc, 0, %radioEnable%
HKR, Ndi\params\radioEnable, Base, 0, "10"
HKR, Ndi\params\radioEnable, default, 0, %radio_DEFAULT%
HKR, Ndi\params\radioEnable, type, 0, "enum"
HKR, Ndi\params\radioEnable\enum, "1", 0, %radioEnableOn%
HKR, Ndi\params\radioEnable\enum, "0", 0, %radioEnableOff%
HKR, Ndi\params\authTypeUseOnly, ParamDesc, 0, %authTypeUseOnly%
HKR, Ndi\params\authTypeUseOnly, Base, 0, "10"
HKR, Ndi\params\authTypeUseOnly, default, 0, "0"
HKR, Ndi\params\authTypeUseOnly, type, 0, "enum"
HKR, Ndi\params\authTypeUseOnly\enum, "0", 0, %authAuto%
HKR, Ndi\params\authTypeUseOnly\enum, "1", 0, %authOpen%
HKR, Ndi\params\authTypeUseOnly\enum, "2", 0, %authShared%
HKR, , AwakeTimePerf, 0x00002, "200"
HKR, , beaconInterval, 0x00002, "100"
HKR, , bkScanEnable, 0x00002, "1"
HKR, , bssType, 0x00002, "1"
;HKR, , ccode, 0x00002, "US"
HKR, , ccode, 0x00002, %ccode_DEFAULT%
HKR, Ndi\params\ccode, ParamDesc, 0, %ccode_Description%
HKR, Ndi\params\ccode, Base, 0, "10"
HKR, Ndi\params\ccode, default, 0, %ccode_DEFAULT%
HKR, Ndi\params\ccode, type, 0, "enum"
HKR, Ndi\params\ccode\enum, "DZ", 0, %ccode_Africa%
HKR, Ndi\params\ccode\enum, "CN", 0, %ccode_Asia%
HKR, Ndi\params\ccode\enum, "AU", 0, %ccode_Australia%
HKR, Ndi\params\ccode\enum, "CA", 0, %ccode_Canada%
HKR, Ndi\params\ccode\enum, "GB", 0, %ccode_Europe%
HKR, Ndi\params\ccode\enum, "FR", 0, %ccode_France%
HKR, Ndi\params\ccode\enum, "IL", 0, %ccode_Israel%
HKR, Ndi\params\ccode\enum, "JP", 0, %ccode_Japan%
HKR, Ndi\params\ccode\enum, "MX", 0, %ccode_Mexico%
HKR, Ndi\params\ccode\enum, "BR", 0, %ccode_SourthAmerica%
HKR, Ndi\params\ccode\enum, "US", 0, %ccode_UnitedStates%
HKR, , clist, 0x00002, ""
HKR, , defaultKey, 0x00002, "0"
HKR, , EncryptionAlg, 0x00002, "2"
HKR, , FragThreshold, 0x00002, "2346"
HKR, , HwTxRetries, 0x00002, "4"
HKR, , privacyInvoked, 0x00002, "0"
HKR, , QoS, 0x00002, "0"
HKR, , rateCtrlEnable, 0x00002, "1"
HKR, , RTSThreshold, 0x00002, "2346"
HKR, , scanType, 0x00002, "2"
HKR, , SwTxRetryScale, 0x00002, "6"
HKR, , SmeEnable, 0x00002, "1"
HKR, , gpioPinFunc0, 0x00002, "1"
HKR, , LanExpress, 0, "AS00"
HKR, , DynamicConfig, 0, "0"
;Static Turbo G
HKR, , Abolt, 0, "255"
; Allow non admin uses to switch profiles
[COMMON.reg.security]
"D:ARAI(A;;GA;;;BA)(A;;GA;;;SY)(A;CI;GA;;;IU)"
;###############################################################################
[DestinationDirs]
;CopyFiles Section = Destination Directory ID -- see layout.inf
;----------------- ------------------------
DefaultDestDir = 11 ; Win9x=%windir%\system Win2k=%windir%\system32
WLAN_2k_WG511.CopyFiles = 12 ; Win2k=%windir%\system32\drivers
WLAN_2k.DelIniFiles = 12 ; Win2k=%windir%\system32\drivers
[WLAN_2k_WG511.CopyFiles]
wg511nd5.sys,,,0x00000004 ; COPYFLG_NOVERSIONCHECK
[WLAN_2k.DelIniFiles]
Athnic.ini,,,1
[SourceDisksNames]
; diskid = description[, [tagfile] [, <unused>, subdir]]
;-------------------------------------------------------
1 = %DriverDiskName%,,,
[SourceDisksFiles.X86] ; Win2k
wg511nd5.sys = 1
;###############################################################################
[Strings]
DriverDiskName = "NETGEAR Wireless Adapter Driver Disk"
Vendor_String = "NETGEAR, Inc."
LEX.DeviceDesc.CB31g = "NETGEAR 108 Mbps Wireless PC Card WG511T"
WG511_Service.DispName = "NETGEAR WG511T Wireless Adapter Service"
; (0x01=11A, 0x02=11A_TURBO, 0x04=11B, 0x08=11G, 0x16=SuperG)
NetBand_DEF_STR_A = "3" ; (A/T)
NetBand_DEF_STR_AB = "7" ; (A/T/B)
NetBand_DEF_STR_G = "12" ; (B/G)
NetBand_DEF_STR_AG = "15" ; (A/T/B/G)
NetBand_DEF_STR_SG = "28" ; (B/G/SG)
; (0=11B, 1=11A, 2=11A_TURBO, 3=11G)
AdhocBand_DEF_STR_A = "1" ; (A)
AdhocBand_DEF_STR_AB = "1" ; (A)
AdhocBand_DEF_STR_G = "0" ; (B)
AdhocBand_DEF_STR_AG = "0" ; (B)
; (0=Disable, 1=Maximum, 2=Normal)
sleepMode = "Power Save Mode"
sleepModeOff = "Off"
sleepModeNormal = "Normal"
sleepModeMax = "Maximum"
sleepMode_DEFAULT = "0"
; (0=100%, 1=50%, 2=25%, 3=12.5%, 4=Lowest)
tpc = "Transmit Power"
tpcLowest = "Lowest"
tpc_DEFAULT = "0"
; (0=Long Preamble, 1=Long and Short)
shortPreamble = "802.11b Preamble"
shortPreambleEnable = "Long and Short"
shortPreambleDisable = "Long only"
shortPreamble_DEFAULT = "1"
; (0=OFF, 1=ON)
radioEnable = "Radio On/Off"
radioEnableOn = "On"
radioEnableOff = "Off"
radio_DEFAULT = "1"
; (Country Selection)
ccode_Description = "Regional Domain"
ccode_Africa = "Africa"
ccode_Asia = "Asia"
ccode_Australia = "Australia"
ccode_Canada = "Canada"
ccode_Europe = "Europe"
ccode_France = "France"
ccode_Israel = "Israel"
ccode_Mexico = "Mexico"
ccode_Japan = "Japan"
ccode_SourthAmerica = "Sourth America"
ccode_UnitedStates = "United States"
ccode_DEFAULT = "US"
authTypeUseOnly = "802.11 Authentication Type"
authAuto = "Auto"
authOpen = "Open"
authShared = "Shared"
3. I couldn't find any logs in the windows folder. In C:\Program Files\NetGear\Utility there was a "service.log" which was blank, and a "results.txt" created Friday when I installed the updated driver. It reads:
log=mdc8021x Protocol (network component): Uninstalled.
message=Driver Uninstall was successful
log=mdc8021x Protocol (device driver): Stopped.
log=mdc8021x Protocol (C:\WINDOWS\inf\mdc8021x.PNF): Deleted.
log=mdc8021x Protocol (C:\WINDOWS\inf\mdc8021x.inf): Deleted.
log=mdc8021x Protocol (C:\WINDOWS\system32\drivers\mdc8021x.sys): Deleted.
code=0
4. Device Manager does not see my card, whether its inserted or not; except sometimes as an unidentified "PCI Device."