Jump to content

Welcome to Geeks to Go - Register now for FREE

Geeks To Go is a helpful hub, where thousands of volunteer geeks quickly serve friendly answers and support. Check out the forums and get free advice from the experts. Register now to gain access to all of our features, it's FREE and only takes one minute. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more.

Create Account How it Works
Photo

Virus won’t allow me to run MBAM and get on internet, also shut down m


  • Please log in to reply

#46
RKinner

RKinner

    Malware Expert

  • Expert
  • 20,001 posts
  • MVP
OK. We are getting close. Look at the DHCP Client service and see what its dependencies are. There should be a tab Called Dependencies. Normally there are three dependencies:

afd.sys = Ancilliary Function Driver for Winsock
netbt.sys = NETBT
tcpip.sys = TCP/IP Protocol Driver

If there are more than these 3 then what are they?

These three files should be in c:\windows\System32\Drivers\.

You can check to make sure they are working by right clicking on My Computer and selecting Manage then Device Manager. View, Show Hidden Devices. In the right pane find Non-Plug and Play Drivers. Click on the + in front of Non-Plug and Play Drivers and then look under it for:

AFD or Ancilliary Function Driver for Winsock or AFD Networking Support Environment. Is there a YELLOW OR RED MARK? Right click on it and select Properties and it should say: This device is working properly. OK (If it has a mark or isn't working properly let me know)

Now Find NETBT or NetBios over Tcpip. Do the same.

Now Find TCP/IP Protocol Driver and do the same.

If you found any extras in the dependency list they will need to be removed using regedit. Fortunately I found a page with detailed instructions: http://futureindian....dress-0000.html

Ron
  • 0

Advertisements


#47
happy01

happy01

    Member

  • Topic Starter
  • Member
  • PipPip
  • 54 posts
The dependencies under the DHCP Client are:
This service depends on the following system components
Net Bios over Tcpip
Tcp/IP protocol driver
Both of these say IPSEC driver when I click the +

There are no dependencies under the section that says: “The following system components depend on this service"

When I got to c:\windows\system32\drivers I do not see the afd.sys file. I do see netbt.sys and tcpip.sys files

When I go to the Device Manager and show hidden files and go to Non-Plug and Play Drivers, I do not see AFD or Ancilliary Function Driver for Winsock or AFD Networking Support Environment. These items are not there at all

Under Non-Plug and Play Drivers I do see NetBios over Tcpip and TCP/IP Protocol Driver. Both of these devices are working properly

I went to the registry and found the DHCP and NetBT folders under the HKEY_Local……DHCP and NetBT folders

For DHCP when I click DependOnService the Edit Multi-String appears and I see Value data:
Tcpip
Afd
NetBT

For the NetBt folder when I click on DependonSerive the Edit Multi-String appears and I see only TCpip

I did not find any lines containing SYMTDI or NISDRV to delete.

Thank you
  • 0

#48
RKinner

RKinner

    Malware Expert

  • Expert
  • 20,001 posts
  • MVP
download the attached afd.zip file and unzip it. Transfer both files to the sick PC.

afd.sys goes in C:\windows\system32\drivers

afd.reg goes on the desktop.

After you have the afd.sys in place then right click on afd.reg and Merge it into the registry.

Reboot when finished and see if dhcp is started now.

Ron
  • 0

#49
happy01

happy01

    Member

  • Topic Starter
  • Member
  • PipPip
  • 54 posts
Will do this tomorrow evening.

Thank you
  • 0

#50
happy01

happy01

    Member

  • Topic Starter
  • Member
  • PipPip
  • 54 posts
When I reboot, when windows loads, it says "The instruction at "0x7d4caa9b" referenced memory at "0x00000010". The memory could not be "read".

Click on OK to terminate the program
Click on CANCEL to debug the program

When I click Cancel, the computer freezes
When I click OK, the computer freezes

Now I cannot boot windows
  • 0

#51
RKinner

RKinner

    Malware Expert

  • Expert
  • 20,001 posts
  • MVP
Is this after installing my zip file?

See if you can boot into Last Known Good.

Restart and when you hear the beep, see the maker's logo or it mentions F8, start tapping the F8 key. Keep tapping until you see the Safe Mode Menu. Try Last Known Good if that doesn't work try Safe Mode.

Ron
  • 0

#52
happy01

happy01

    Member

  • Topic Starter
  • Member
  • PipPip
  • 54 posts
Yes I installed both of your zip files. Windows will not reboot using the last know good configuration, but it will boot in safe mode.
  • 0

#53
happy01

happy01

    Member

  • Topic Starter
  • Member
  • PipPip
  • 54 posts
The warning is an svchost.exe application error
  • 0

#54
happy01

happy01

    Member

  • Topic Starter
  • Member
  • PipPip
  • 54 posts
The debugger worked, Now I have a screen that says

Just in time debugging handler and clr remot hose

an exception unhandled win32 exception has occurred in process 1032

However, Visual Studio .NET just in time debugging has failed with the following error: They system cannot find the file specified

would you like to try debugging with the previously registered debugger

C:Probram Files\Microsoft Visual Studio\COmmon\MSDev98\Bin\msdev.exe?
  • 0

#55
happy01

happy01

    Member

  • Topic Starter
  • Member
  • PipPip
  • 54 posts
I just hit yes, and it says devedit.pkg This required file cannnot be loaded. Please re=install Microsoft Visual C++


I still cannot get online. It is still trying to acquire the network address

And a warning also popped up FOr network connectionis saying the network connections folder was unable to retrieve the list of network adaptors on your machine. Please make sure that the Network Commections service is enabled and running
  • 0

Advertisements


#56
RKinner

RKinner

    Malware Expert

  • Expert
  • 20,001 posts
  • MVP
Go into device manager (View, Show Hidden Devices) and see if afd or one of its aliases shows up now. IF so right click on it and Disable it then boot into regular mode and see if that works.

Ron
  • 0

#57
happy01

happy01

    Member

  • Topic Starter
  • Member
  • PipPip
  • 54 posts
I am going out of town for a week, and won't be able to get to this in about 10 days. Will PM you at that time. The forum will probably be closed by then, but I will PM you to open it back up again. Talk to you in about 10 days.

Thanks
  • 0

#58
RKinner

RKinner

    Malware Expert

  • Expert
  • 20,001 posts
  • MVP
OK
  • 0

#59
happy01

happy01

    Member

  • Topic Starter
  • Member
  • PipPip
  • 54 posts
Hello,

I am back from vacation. I am looking at the device manager, but don't see afd.sys and don't know what its aliases are called.

Thank you
  • 0

#60
RKinner

RKinner

    Malware Expert

  • Expert
  • 20,001 posts
  • MVP
Copy the next line:

Reg query HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ /s > \junk.txt

Start, Run, cmd, OK then right click and Paste or Edit then Paste and the above line should appear. Hit Enter. Then

notepad \junk.txt

(Space before \. Copy and paste the text from notepad into a reply.)

Ron
  • 0






Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP