[RSGsecurity]

Hi guys,
This post will be sort of following on from a post of mine from the malware section.
Recently I had various infections on my system, now over the last couple of days i have completely removed them all and computer is virus free, hurray!....

Although, im am still having a complete headake, I am unable to connect via my wired connection to virgin using vista, I have rang them and they tried a couple of things, sounded confused and just put it down to a faulty rooter and are sending me another (but I can see it is quite obvious it is not my router, as you will with all the errors lurking.
Now with that, I can use a t-mobile internet dongle to connect to the internet on the same system, now ive checked services/event log and the list of things that seem wrong are as follows. heelpppp

Services:-

The DHCP client, DNS client, have stopped and will not start, if i try to start them, i get the following error :-
"Windows could not start the DHCP client service on local computer. error 1075: the dependency service does not exist or has been marked for deletion"
Also PC tools security service has stopped and on trying to start that I get:
"Windows could not start the PC tools security service service on local computer. Error 3: the system cannot find the path specified"

Eventlog :-
All I can find related to DHCP are these errors 3 days ago:
"The DHCP Client service depends the following service: Tdx. This service might not be installed."
and
"The WinHTTP Web Proxy Auto-Discovery Service service depends on the DHCP Client service which failed to start because of the following error:
The dependency service does not exist or has been marked for deletion."


Also, windows updates will install, but upon rebooting to configure them, they get to 3 of 3 100%, comp reboots and I get the amazing "updates were not configured correctly reverting changes"

Event log throws up these messages relating to update:
Windows Servicing identified that package KB2572075(Security Update) is not applicable for this system.
and
Windows Servicing identified that package KB2564958(Security Update) is not applicable for this system.
(related/similar to this)
Installation Failure: Windows failed to install the following update with error 0x80070005: Security Update for Windows Vista (KB2564958).
and
Windows Servicing identified that package KB2567053(Security Update) is not applicable for this system.


Now this screenshot is of my event log, now this particular error highlighted started 3-4 days ago, and since is reported every few seconds, now this is roughly when my wired connection packed in so I am hoping someone knows what this means and can help resolve it as I have exhausted all my knowledge in the matter. Also find the lower screen shot is when the event seemed to first start and another log that seemed to run as much as the latest one.






Now please guys I am in desperate need of your help, baring in mind, a restore is useless as the earliest one I have is 3-4 days ago when I was rammed with infections, I am thinking maybe upon removing these viruses something in the registry has been corrupted/removed (although I have run plenty to resolve that)

The following are programs I have used over the past week trying to restore order to my comp.

Malwarebytes
Dr.web
lavasoft registry cleaner
AVG
OTL
Combofix (which is what removed all infections successfully)
Most recent being last night: Tweaking.com windows repair allinone, ran this last night and haven't ran anything since, used steps 2, 3, 4 & 5.

please guys, as-well as this being a huge problem restricting me, it is also a matter of pride now lol! I do not want to let my system beat me!

Any help is much appreciated, who accepts this challenge!

[Advertisements]

A few things to consider and try.

First I would suggest that you check if you can start the dependency service for DHCP client service.
To view the dependency services registered for DHCP Client Service, try the following steps
Click on Start and them type cmd and press Enter
In the command prompt type: CMD /K SC QC DHCP
Press Enter check if the dependency service is started.
Verify that the Dependency Service / components are running
To verify that the three dependency components are running. Follow the steps below:

• Click Start, Run and type DEVMGMT.MSC
• In the View menu, click Show hidden devices
• Double-click Non-Plug and Play drivers section
• Double-click the entry AFD, and click the Driver tab (Ancillary function Encryption Driver)
• Set the Startup type to System.
• Start the service. Note down the error message if any.
• Similarly start the two other drivers namely:
• TCP/IP Protocol Driver
• NetBios over Tcpip
• Close Device Manager and restart Windows.
• Now check if you can start the DHCP service. Some of the information from HERE

If the above step does not fix the issue then I would suggest that you try SFC scan on the computer which would scan for corrupt system files on the computer and replace them.

To determine whether the issue that you are experiencing is caused by one or more system files that are used by Windows Vista, run the System File Checker tool. The System File Checker tool scans system files and replaces incorrect versions of the system files by using the correct versions.

System File Checker merely makes sure that all system files are where they should be. The sfc /scannow command scans all protected system files and replaces incorrect versions with correct Microsoft versions.
Open an Elevated Command Prompt window. To do so, click Start, then type cmd in the Start Search box. In the results area, right-click cmd.exe, and then click Run as administrator. You will be prompted to type the password for an administrator account. Click Continue if you are the administrator or type the administrator password. Then, click Continue.

At the command prompt, type the following command, sfc /scannow and then press ENTER.

The scan may take some time to complete. Windows will repair any corrupted or missing files that it finds. If required, Windows may prompt you to insert the Operating System CD.

See if that helps.

Edited by zep516, 10 November 2011 - 08:33 AM.

[zep516]

A few things to consider and try.

First I would suggest that you check if you can start the dependency service for DHCP client service.
To view the dependency services registered for DHCP Client Service, try the following steps
Click on Start and them type cmd and press Enter
In the command prompt type: CMD /K SC QC DHCP
Press Enter check if the dependency service is started.
Verify that the Dependency Service / components are running
To verify that the three dependency components are running. Follow the steps below:

• Click Start, Run and type DEVMGMT.MSC
• In the View menu, click Show hidden devices
• Double-click Non-Plug and Play drivers section
• Double-click the entry AFD, and click the Driver tab (Ancillary function Encryption Driver)
• Set the Startup type to System.
• Start the service. Note down the error message if any.
• Similarly start the two other drivers namely:
• TCP/IP Protocol Driver
• NetBios over Tcpip
• Close Device Manager and restart Windows.
• Now check if you can start the DHCP service. Some of the information from HERE

If the above step does not fix the issue then I would suggest that you try SFC scan on the computer which would scan for corrupt system files on the computer and replace them.

To determine whether the issue that you are experiencing is caused by one or more system files that are used by Windows Vista, run the System File Checker tool. The System File Checker tool scans system files and replaces incorrect versions of the system files by using the correct versions.

System File Checker merely makes sure that all system files are where they should be. The sfc /scannow command scans all protected system files and replaces incorrect versions with correct Microsoft versions.
Open an Elevated Command Prompt window. To do so, click Start, then type cmd in the Start Search box. In the results area, right-click cmd.exe, and then click Run as administrator. You will be prompted to type the password for an administrator account. Click Continue if you are the administrator or type the administrator password. Then, click Continue.

At the command prompt, type the following command, sfc /scannow and then press ENTER.

The scan may take some time to complete. Windows will repair any corrupted or missing files that it finds. If required, Windows may prompt you to insert the Operating System CD.

See if that helps.

Edited by zep516, 10 November 2011 - 08:33 AM.

[RSGsecurity]

Thanks for your reply, cmd prompt shows this :-




With regards device manager, did forget to mention, I have tried that step before, but AFD just simply does not exist there (hidden devices shown) its not even there with a little yellow symbol signalling a problem, it has just vanished, I ran a reg edit and was able to locate it there though so it is defiantly on my system somewhere, just not showing on device manager for some reason, very odd..... also, have ran sfc /scannow more than once, runs fine, it said it has repaired errors and stored them in the log, but not my errors it seemes o.O
But yes from the looks of it, DHCP rely on AFD and TDX both seem to have packed there bags!


Latest edit:- checked to see if AFD.sys is in the right folder and it is sitting there happy as larry, windows/system32/drivers/afd.sys (same for TDX)
so its not like its not actually on my computer, but yet its not listed under device manager?

thanks again for your reply

Edited by RSGsecurity, 10 November 2011 - 11:32 AM.

[zep516]

DHCP rely on AFD and TDX both seem to have packed there bags!

The DHCP Client Service in Windows depends on these three components:
* AFD
* NetBios over Tcpip
* TCP/IP Protocol Driver
Open Windows Explorer and navigate to /Windir/System32Drivers folder. Make sure that the following files are present in that folder:
* afd.sys
* tcpip.sys
* netbt.sys

[RSGsecurity]

yep, all sitting there laughing at me... :/ here is a screen of how my device manager looks, tried repairing the two errors its showing but no joy.

[zep516]

Is that AVG Anti virus installed? Is that messing with things, just a thought. Temporarily disable AVG Network redirector through the Device manager to see what happens.

Edited by zep516, 10 November 2011 - 11:55 AM.

[RSGsecurity]

well i can always uninstall AVG then run a sfc /snannow see if that helps, also whilst typing this, malaware bytes just reported it blocked this succesfully, dident know if it means anything

type: outgoing
38158
btdna.exe

this is what malware bytes is showing which is new, all listed in the logs just now


17:50:10 rob IP-BLOCK 194.165.0.3 (Type: outgoing, Port: 38158, Process: btdna.exe)
17:51:39 rob IP-BLOCK 194.165.0.3 (Type: outgoing, Port: 38158, Process: btdna.exe)
17:51:47 rob IP-BLOCK 83.128.128.97 (Type: outgoing, Port: 38158, Process: btdna.exe)

Edited by RSGsecurity, 10 November 2011 - 11:54 AM.

[RSGsecurity]

Is that AVG Anti virus installed? Is that messing with things, just a thought. Temporarily disable AVG Network redirector through the Device manager to see what happens.

cant disable it as it has it is already stopped, if u look at my screen shot of device manager, it shows an error next to it, so unable to disable it as its not even running

[zep516]

well i can always uninstall AVG then run a sfc /snannow see if that helps

Go ahead and try it. I can not comment on any errors from Malwarebytes due to present training. If Malwarebytes is finding stuff you may need to return to your thread there.

[RSGsecurity]

well i can always uninstall AVG then run a sfc /snannow see if that helps

Go ahead and try it. I can not comment on any errors from Malwarebytes due to present training. If Malwarebytes is finding stuff you may need to return to your thread there.

Rodger that!

[RSGsecurity]

still no jooyyy lol

[zep516]

RSGsecurity,

Reviewing your thread in Malware HERE I see that Essexboy spent quite a bit of time on what we just did and with more expertise in this field then I. If I had read the thread in the removal forum at the start of this thread, I more then likely would have said "not much more to try". At this time I would strongly consider reinstalling as you mentioned in the last post of that thread if the new router that is due tomorrow does not solve the problem.

Joe.

[RSGsecurity]

new router arrived today, all hooked up, problem still stands... tried re-install of windows of the disc, get an error message, basically, I am just F@!#$, full package with virgin and I cant even use there sodding internet, brilliant -.-

[zep516]

tried re-install of windows of the disc, get an error message,

What error are you getting?

The disk:

Is this disk a retail version of Vista or recovery disk for that computer?

[Essexboy]

Did you try the inplace upgrade ?

An in-place upgrade is the final alternative before you have to reinstall the operating system.
Note that it takes the same amount of time to do the upgrade as to reinstall the operating system. Also, some of your customized Windows settings may be lost through this process.

How to perform a repair installation of Windows Vista, Windows Server 2008, Windows 7 or Windows Server 2008 R2. Performing a repair installation will restore the current Windows installation to the version of the installation DVD. This also requires the installation of all updates that are not included on the installation DVD.

Note Performing a repair installation will not damage files and applications that are currently installed on your computer.

To perform a repair installation of Windows Vista, Windows Server 2008, Windows 7 or Windows Server 2008 R2, follow these steps:

1.Close all the running applications.
2.Insert the Windows Vista, Windows Server 2008, Windows 7 or Windows Server 2008 R2 DVD in the computer's DVD drive.
3.In the Setup window, click Install Now.

Note If Windows does not automatically detect the DVD, follow these steps:

A.Click Start, and then type Drive:\setup.exe in the Start Search box.
Note The Drive placeholder is the drive letter of the computer's DVD drive.
B.In the Programs list, click Setup.exe.
C.In the Setup window, click Install Now.


4.Click Go online to obtain the latest updates for installation (recommended).
5.Type the CD key if you are prompted to do this.
6.Select the operating system in "Install Windows" page you want to Upgrade or Inplace.
7.Click Yes to accept the Microsoft Software License Terms.
8.On the Which type of installation do you want? screen, click Upgrade.
9.When the installation is complete, restart your computer.