Software

Ask something
Question Locked

Restore Windows XP USB driver

0 helpful
11 replies

by bhkolts 1 view

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Hi All,
I have a client who has a USB SD card reader. I "installed" it for him which consisted of plugging it in and using Windows XP native drivers. All went well. The card reader does come with a driver/bloatware disk. The installation guide states not to use the disk drivers but use the native drivers. Well over the weekend someone installed the drivers of the disk. Now the machine blue screens. I have determined the offending driver is fixustor.sys which is on the disk. This driver conflicts with other USB drivers, in particular the printer driver, even if the card reader is not plugged in causing the BSOD. My question, how do I remove this driver. Simply using the Add/Remove programs applet removes the bloatware but not the driver. Uninstalling the card reader from device manager doesn't work. What I have done is rename fixustor.sys to fiaustor.sys.bak which allows the other USB devices to load with out crashing, but the card reader won't load the native drivers. It looks for fixustor.sys and doesn't work. I also tried "Roll back Driver" in device manager and it said no driver to roll back to. Is there a registry edit to unassociate this driver from this USB device?
Thanks in advance for your help
Barry

Edit: Corrected spelling

11 replies

by bhkolts

Thanks for your reply. The original complaint with this computer was "every time we start IE it reboots". So I figured we had some malware in play. I removed 25 malware objects. So System Restore will restore all the registry entries associated with the malware. So you can see why I was looking another solution. After I posted my question, I came across Bill Detwiler's video http://blogs.techrepublic.com.com/itdojo/?p=731&tag=nl.e101 on how to remove hidden drivers. I think I will give this a go and if it doesn't work do a System Restore and reremove the malware. If all else fails I will reload the system and start fresh.
Thanks again for your reply,
Barry

by rob miners

on things. To successfully remove Malware you should have turned off System Restore. I would suspect that you are still infected.

Follow the steps below with the System started and restarted in Safe Mode with Networking. Running in Safe Mode loads a minimal set of drivers for the Operating System. You can use these options to start Windows so that you can modify the registry or load or remove drivers.

With the new strains of Virus that have been created you may find it necessary to rename the executable files so that they will work. Rename mbam-setup.exe and then navigate to the install folder and rename mbam.exe. Do not change the files extension from .exe. Do the same with Spybot.

Removing malware from System Restore points
To remove the malware, you must first disable System Restore, then scan the system with up-to-date antivirus software - allowing it to clean, delete, or quarantine any viruses found. After the system has been disinfected, you may then re-enable System Restore. The steps for disabling System Restore vary, depending on whether the default Start Menu or the Classic Start Menu is being used.

Default Start Menu XP
If using the default Start Menu, click Start | Control Panel | Performance and Maintenance | System. Select the System Restore tab and check "Turn off System Restore".

Classic Start Menu XP
If using the Classic Start Menu, click Start | Settings | Control Panel and double-click the System icon. Select the System Restore tab and check "Turn off System Restore".

Vista
Start, right mouse click Computer and select Properties. Select Advanced System Properties, click contine and then System Protection. Untick the box nect to Local Disk C: and click on Turn System Restore off.

After scanning the system and removing the offending malware, re-enable System Restore by repeating the steps, this time removing the check from "Turn off System Restore".

Download Spybot - Search & Destroy and install it. Update it and run it.

Spybot

Download Malwarebytes Anti-Malware, install it and update it.

Malwarebytes

* Double-click mbam-setup.exe and follow the prompts to install the program.
* At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version.
* Once the program has loaded, select Perform Quick Scan, then click Scan.
* When the scan is complete, click OK, then Show Results to view the results.
* Be sure that everything is checked, and click Remove Selected.

If you encounter any problems while downloading the updates, manually download them from here and just double-click on mbam-rules.exe to install.
mbam-rules

I would keep scanning with it until it is clean by closing out and rebooting and running it again.

Run this Rootkit Revealer GMer
Gmer

FAQ
FAQ

How to remove a Trojan, Virus, Worm, or other Malware

http://www.bleepingcomputer.com/tutorials/tutorial101.html

by bhkolts

Jackie,
Thanks for your reply. I should have mentioned the malware, but so much has happened to this machine I was torn between giving enough information and keeping the post from getting to long. The machine had been hit by lightening, came in through the phone line and took out the DSL router and the on board nic in the computer. I installed a nic card and the phone company replaced the DSL router. Then I discovered some one had broken the front USB ports beyond repair. The back USB ports still work.
I tried system restore and it refused to restore previous restore points. At this point, not knowing what else I haven't been told, I suggested the client get whatever they wanted backed up and I would reload the OS. Then I was informed the a previous disgruntled employee left mad and took all the disks with them. This is small not-for-profit business with all the problems of being new, volunteers, nobody really in charge, etc. And to top it off the bosses brother-in law and sister-in law are part of the organization, board members I think. So you kinda of get the picture.
Thanks for your response though, I use the software tools you mentioned but wasn't doing everything you mentioned, like turning off System Restore. I will be using your procedure in the future, it is nice outline to follow.
So you have been very helpful and if I can figure out how to give you a thumbs up I will (I am always on the up hill side of the learning curve ;)).
Thanks again,
Barry

by rob miners

your between a rock and a hard place at the moment. If the on-board NIC has been fried it will probably effect the 5V rail. That Motherboard mightn't be around too much longer and will need to be replaced. If the Malware removal doesn't fix the problem try Dans suggestion but you will probably have to reinstall Service packs and re-activate the software.

Might I suggest that you look into Microsofts offers for Charity and non-profit organisations.

Qualifying 501(c)(3) nonprofit organizations

http://www.microsoft.com/licensing/programs/open

Only eligible charity organizations that meet certain requirements can purchase licenses through Open License for Charities.

http://www.microsoft.com/licensing/licensing-options/for-industries.aspx#tab_4

A list of Resellers

http://www.microsoft.com/licensing/licensing-options/charity-resellers.aspx

Edit: for http://

by bhkolts

I have already warned the customer that the motherboard has been weakened. It may last years or go belly up tomorrow. I can reload the OS with out the disks, the COA is still attached to the case. I keep a copy of XP and both service packs on disks as well as a copy of AVG Free. That way I can load the service packs and an anti-virus before I even put it on the internet. I don't think I violate any rules or licenses doing it that way. It has worked well before.
Thanks for all your other suggestions.
Barry

by computechdan

on the malware with jacky, when u get all that cleared up..

some thoughts i had on the original issue:

the file fixustor.sys has been known to carry malware as well as create a new service

perhaps the software changed some of the windows system files, start, run, cmd, sfc /scannow

might be worth a look to see if uninstal left any hidden devices behind, device manager, view, show hidden

have often resolved strange usb problems by unplugging all devices, removing the usb root hubs, and then scanning for new hardware in device manager to redetect the hubs, then plug devices back in

i noticed u mentioned the front ports where damaged. i do hope u unplug them from the main board, as future attempts to use them could cause a board failure.

by bhkolts

Searching the internet for fixustor.sys did indicate the file was suspect. I tried System File Checker and it didn't catch anything. I also tried looking at hidden drivers in device manager, even with the environment variable devmgr_show_nonpresent_devices set to 1 and no joy. I think the best course of action is to reload the OS. Then I will know the software is good and any if there is still problems it will be hardware. Oh, and I did unplug the front ports from the motherboard.
Thanks for your time and suggestions, I will be adding them to my 'tool box'.
Barry

This discussion is closed to new replies.