afd.sys issue

At first my computer would go staight to a blue screen saying the hard drive had crash . It seemed to happen when i accessed the internet via internet explorer . After i noticed that i did a full system scan with avast internet security . It would say to complete actions (like deleting infected files or move to chest) restart computer . After i did that the blue screen would appear . So i did a system scan again ignoring the reboot message , finding the exact place the infected files were then deleted then manualy . A couple were .sys files , one of which was afd.sys . Then i read somewhere to seach computer and delete every file thats relates to afd.sys . So stupidly i did . The blue screen has stopped but still no internet access (page cannot be displayed) . I need help . The only access to the internet i have is my cell phone .

Im running windows 7 and Do not have the disc .

Anyhelp would be great .

 

Hi and welcome to Major Geeks, BKyo!

Are you able to download from your phone to transfer to a PC? If so:

http://img97.imageshack.us/img97/8120/fss.gif Please download Farbar Service Scanner and run it on the computer with the issue.

• Make sure all the options are checked
• Press "Scan".
• It will create a log (FSS.txt) in the same directory the tool was run.
• Please attach FSS.txt to your next message. (How to attach)

If not, please boot into Safe Mode with Command Prompt and type in the following: sfc /scannow
Then press ENTER.

 

Im tring to download FSS but my pc wont reconize my cell phone ... I will keep tring though .

Now my pc is doing a startup repair and will not let me cancel it . Im not really sure of what to do now.

 

You can let it finish Startup Repair. Won't hurt anything.

Did you get a BSOD again?

 

Ok the repair didnt do anything . I didnt get the blue screen again i went to RUN then Command and tryed sfc scannow . It says "you must be an administrator running a console session in order to use the sfc utility" .

 

Ok i did the sfc scam with command prompt , it was unable to repair and made a CBS log . I went to the log and it says access is denied .

 

Any luck with downloading FSS.exe?

 

Nope ... i do not own a flash drive and the computer wont reconize my phone . I guess im pretty much screwed for now .

 

Flash drives are pretty affordable. You should be able to find for around $15. It will come in handy for future use and it would help tremendously for this type of issue.

 

Yeah , im going to go out tomorrow and grab one . I would tonite but i dont have much time . Thanks Thisisu , i shall be back on tomorrow .

 

Ok

 

Sorry it took so long but i finally borrowed another computer and bought a flashdrive . Here is my FSS .

 

No problem.

I have attached afd_tdx_7.zip (1.2 KB)
Extract the contents of this .zip file onto your desktop.

You should have both AFD.reg and tdx.reg on your desktop.

Now double-click click AFD.reg and allow it to merge into the registry. Let me know if it was successful or not.

Then do the same thing for tdx.reg.

Now reboot your PC.

Once you have rebooted...

Then download and save ComboFix.exe to your desktop. Do not run it yet. Read the below first.

__

http://img194.imageshack.us/img194/4930/combofix.gif Fixing items using ComboFix
Make sure that ComboFix.exe that you downloaded is on your desktop -- but do not run it.
If it is not on your desktop, the below will not work.
Shut down your protection software now (antivirus, antispyware...etc) to avoid possible conflicts.
Open Notepad and copy/paste the text in the below code box into Notepad:

Code:

[COLOR="DarkRed"]KillAll::[/COLOR]
[COLOR="DarkRed"]MIA::[/COLOR]
c:\Windows\system32\drivers\tdx.sys

Save this file as CFScript.txt to your desktop. So now you should have both CFScript.txt and ComboFix.exe on your desktop.
Now use your mouse to drag CFScript.txt on top of ComboFix.exe and then release.
http://softvisia.com/users/Night_Raven/Security/cfsdnd2.gif
This will launch ComboFix.
Note: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.
Allow ComboFix to update itself if prompted.
When ComboFix finishes, a log will be produced at C:\ComboFix.txt
Attach this log to your next message. (How to attach)

Test your internet afterwards.

 

Ok , I did everything listed step by step . the 2 regs worked . I'm not sure where to find the combofix.txt log . I did find a bootsqm.dat file but i cant attach it :/

Internet still not working .

 

If it created a log, it would be at c:\ComboFix.txt

 

All i see is a combofix.exe in local disc (C . Im guessing it didnt create a log ?

 

Try this:

http://img205.imageshack.us/img205/1894/otl.gif Please download OTL by OldTimer.

• Save it to your desktop on the computer with the issue.
• Double click on the OTL icon on your desktop. (Vista/7 right-click and select Run as Administrator)
• Check the "Scan All Users" checkbox.
• Check the "Standard Output".
• Change the setting of "Drivers" and "Services" to "All"
• Copy the text in the code box below and paste it into the http://img14.imageshack.us/img14/66/otlcustomfix.png text-field.
  
  Code:

  msconfig
  safebootminimal
  activex
  drivers32
  netsvcs
  /md5start
  afd.sys
  i8042prt.sys
  netbt.sys
  nsiproxy.sys
  svchost.exe
  tcpip.sys
  tdx.sys
  /md5stop
  %systemdrive%\*.*
  %windir%\$ntuninstallkb*. /120
  %windir%\system32\drivers\*.sys /lockedfiles
  %windir%\*.* /mp
  %windir%\*.* /rp
  %windir%\*.* /sl
  

• Now click the http://img171.imageshack.us/img171/2405/runscanotl.png button.
• Two reports will be created:
  • OTL.txt <-- Will be opened
  • Extra.txt <-- Will be minimized
• Attach OTL.txt to your next message. (How to attach)

 

Cool , I got it . Here it is.

 

Uninstall AVG and Avast before proceeding

http://img205.imageshack.us/img205/1894/otl.gif Fix items using OTL by OldTimer

Double-click OTL.exe to run. (Vista/7 right-click and select Run as Administrator)
Shut down your protection software now (antivirus, antispyware...etc) to avoid possible conflicts.
Copy the text in the code box below and paste it into the http://img14.imageshack.us/img14/66/otlcustomfix.png text-field.

Code:

[COLOR="DarkRed"]:otl[/COLOR]
SRV - File not found [On_Demand | Stopped] --  -- (WcsPlugInService)
SRV - File not found [Auto | Stopped] --  -- (NecUsb3)
SRV - File not found [Auto | Stopped] --  -- (CscService)
SRV - File not found [On_Demand | Running] --  -- (AeLookupSvc)
SRV - [2009/07/13 20:14:41 | 000,005,632 | ---- | M] (Oak Technology Inc.) [Auto | Running] -- C:\Windows\System32\p1131vid.dll -- (symevent)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (VGPU)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (tsusbhub)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (Synth3dVsc)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (iscFlash)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (catchme)
NetSvcs: symevent - C:\Windows\System32\p1131vid.dll (Oak Technology Inc.)
[2012/02/21 22:25:22 | 000,000,000 | -HSD | C] -- C:\found.001
[2012/02/19 14:47:32 | 000,000,000 | -HSD | C] -- C:\found.000
[2012/03/07 20:41:57 | 004,430,732 | R--- | C] (Swearware) -- C:\Users\user\Desktop\ComboFix.exe.exe
[2012/02/18 23:52:24 | 000,000,000 | -HS- | M] () -- C:\Windows\System32\dds_trash_log.cmd
[2012/01/13 18:52:19 | 000,009,327 | ---- | C] () -- C:\Users\user\AppData\Local\ff394f58
[2012/01/13 18:52:19 | 000,009,324 | ---- | C] () -- C:\Users\user\AppData\Roaming\dc42e9b2
[2012/01/13 18:52:19 | 000,009,288 | ---- | C] () -- C:\ProgramData\5f1ad582
[COLOR="DarkRed"]:services [/COLOR]
symevent
[COLOR="DarkRed"]:files[/COLOR]
C:\Windows\System32\p1131vid.dll
c:\windows\system32\drivers\tdx.sys|C:\Windows\winsxs\x86_microsoft-windows-tdi-over-tcpip_31bf3856ad364e35_6.1.7600.16385_none_ea141e6f3d693e28\tdx.sys /replace
rd /s/q C:\Windows\$NtUninstallKB14186$ /c
C:\Windows\winsxs\x86_microsoft-windows-winsock-core_31bf3856ad364e35_6.1.7601.17603_none_d9f97e05bca8003a\afd.sys
xcopy /y C:\Windows\System32\drivers\afd.sys C:\Windows\winsxs\x86_microsoft-windows-winsock-core_31bf3856ad364e35_6.1.7601.17603_none_d9f97e05bca8003a /c
xcopy /h/i/s/y "%temp%\smtmp\1" "%programdata%\start menu" /c
xcopy /h/i/s/y "%temp%\smtmp\2" "%appdata%\microsoft\internet explorer\quick launch" /c
xcopy /h/i/s/y "%temp%\smtmp\3" "%appdata%\microsoft\internet explorer\quick launch\user pinned\taskbar" /c
xcopy /h/i/s/y "%temp%\smtmp\4" "%programdata%\desktop" /c
[COLOR="DarkRed"]:commands[/COLOR]
[emptytemp]
[resethosts]

Now click the http://img3.imageshack.us/img3/407/otlrunfix.png button.
If the fix needed a reboot please do it.
Click the OK button (upon reboot).
When OTL is finished, Notepad will open. Close Notepad.
A log file will be located at C:\_OTL\MovedFiles\mmddyyyy_hhmmss.log, where mmddyyyy_hhmmss is the date of the tool run.
Attach this log to your next message. (How to attach)

http://img600.imageshack.us/img600/2693/mgtools.gif Now download the latest MGtools.exe to the root of your c: drive.

• Replace your existing MGtools.exe with this one.
• Now run this new MGtools.exe by double-clicking it. (Vista/7 right-click and select Run as Administrator)
• When it is finished, attach c:\MGlogs.zip to your next message. (How to attach)

 

Avg wont let me uninstall it . Should i still follow thru with the next steps ?

 

Not yet.

Download this and transfer it to the PC with the issue: avg_remover_stf_x86_2012_1796.exe
Then run it. This should force uninstall AVG.

Then you can proceed with the other steps I have outlined for you.

 

I have attached OTLfix.txt

You can save this to your flash drive and transfer it to your infected PC.

You can then drag and drop OTLfix.txt into the http://img14.imageshack.us/img14/66/otlcustomfix.png text-field of OTL.

All the text should be transferred over.

 

Avg was removed . I did the OTlfix , and saved the log on flash drive . But im a bit confused about what to do with mgtools . I cant seem to find an existing mgtools file in the C Drive . And i didnt want to run the new one without replacing it .

 

Sorry I should have taken that part out.

Just copy MGtools.exe to the root of C: and then double-click it.

When it's finished, C:\MGlogs.zip should be present. Attach that.

 

No problem . I hope i did this right heres the files .

 

Yes you did

http://img205.imageshack.us/img205/4783/regeditb.gif Attached is netbt.zip
Inside is netbt.reg
Extract netbt.reg onto the desktop with the issue.
Now double-click it and allow it to merge into the registry.
Let me know if it was successful or not.
If it was successful - reboot and test internet.

Do this while I review the rest of your logs.

 

http://img97.imageshack.us/img97/8120/fss.gif After you get done with the above, run another scan with Farbar Service Scanner and attach the new log.

 

PRAISE JESUS , FOR HE HAS SENT ME AN ANGEL BY THE NAME OF THISISU .

It was successful and internet is now working In fact Im posting this from the once infected computer . Now if i can ask your awsome self one more thing . What free anti virus will prevent this from happening again . Any precations i should take or anything like that ?

I cant thank you enough man , seriously !

 

Heres the FSS.txt

 

:cool

Glad to hear it.

You're welcome.

I will post more about this later. There is still some malware in your logs and Windows Firewall is still broken, but the infection is inactive now. Just some traces to clean up. Do not install anything on your own until we are finished with malware removal.

http://img850.imageshack.us/img850/4124/mbam.gif First, follow these instructions: Using Malwarebytes Anti-Malware

http://img196.imageshack.us/img196/3557/tdsskiller.gif I want you to read and follow these instructions: TDSSKiller - How to run

http://img194.imageshack.us/img194/4930/combofix.gif Now we need to run ComboFix.
Read this guide on how to run it: http://www.bleepingcomputer.com/combofix/how-to-use-combofix
When it starts talking about uninstalling ComboFix, stop reading. Just attach the log for me to review.

http://img17.imageshack.us/img17/3214/baticonvista7.gif Now run C:\MGtools\GetLogs.bat by right-mouse clicking it and then selecting Run as Administrator
This updates all of the logs inside MGlogs.zip.
When it is finished, attach C:\MGlogs.zip to your next message. (How to attach)

 

ComboFix will give you an alert about Rootkit ZeroAccess. Don't panic; it's one of the last traces to be removed.

 

OK , I got the logs . The internet doesnt work again and is saying a file has been moved or deleted . Im sure Its part of the process .

 

Explain this a bit more. Your MGlogs.zip are showing that you have internet access. At least on your wireless, we may need to refresh your wired connection.

In any case, reboot and let me know if you are still experiencing the same problems.

 

Yeah , the restart did the trick . I also turned off wifi and tested a wired connection and it works fine aswell :-D .

Whats next boss ?

 

Good job

Here are the next steps:

http://img196.imageshack.us/img196/3557/tdsskiller.gif Re-scan with TDSSKiller with the parameters you used before.
This time if TDSS File System appears, delete it!
Then attach the latest TDSSKiller log. (How to attach)

http://img850.imageshack.us/img850/4746/programsandfeatureswin7.gif From Programs and Features (via Control Panel), please uninstall the below:

• Java(TM) 6 Update 26

http://img194.imageshack.us/img194/4930/combofix.gif Fixing items using ComboFix
Make sure that ComboFix.exe that you downloaded earlier is on your desktop -- but do not run it.
If it is not on your desktop, the below will not work.
Shut down your protection software now (antivirus, antispyware...etc) to avoid possible conflicts.
Open Notepad and copy/paste the text in the below code box into Notepad:

Code:

[COLOR="DarkRed"]KillAll::[/COLOR]
[COLOR="DarkRed"]ClearJavaCache::[/COLOR]
[COLOR="DarkRed"]Driver::[/COLOR]
AVGIDSShim
[COLOR="DarkRed"]File::[/COLOR]
c:\windows\system32\DRIVERS\AVGIDSShim.Sys
[COLOR="DarkRed"]RegLock::[/COLOR]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
[COLOR="DarkRed"]Registry::[/COLOR]
[-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{F0795DE0-256A-4C88-9126-E7BD5D75080F}]
[-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{C04B7D22-5AEC-4561-8F49-27F6269208F6}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Firefox\extensions]
"{1E73965B-8B48-48be-9C8D-68B920ABC1C4}"=-
"wrc@avast.com"=-

Save this file as CFScript.txt to your desktop. So now you should have both CFScript.txt and ComboFix.exe on your desktop.
Now use your mouse to drag CFScript.txt on top of ComboFix.exe and then release.
http://softvisia.com/users/Night_Raven/Security/cfsdnd2.gif
This will launch ComboFix.
Note: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.
Allow ComboFix to update itself if prompted.
When ComboFix finishes, a log will be produced at C:\ComboFix.txt
Attach this log to your next message. (How to attach)

http://img195.imageshack.us/img195/9049/javaz.gif Now install the current version of Sun Java from: jre-7u3-windows-i586.exe

http://img17.imageshack.us/img17/3214/baticonvista7.gif Now run C:\MGtools\GetLogs.bat by right-mouse clicking it and then selecting Run as Administrator
This updates all of the logs inside MGlogs.zip.
When it is finished, attach C:\MGlogs.zip to your next message. (How to attach)

Let me know how the system is running after you have completed these steps.

 

Also test out Windows Firewall again. It is working according to your latest logs.

 

Firewall is running great . Public and private have green sheilds with check marks in the middle Also the java update didnt uninstall but updated instead (Hope that didnt mess anything up) . I did sucessfuly install the newer version of java .

 

Nope, it did not.

Delete this file: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\ce16a11a

The rest of your logs are clean.

Make sure you read the link at the very bottom of this post entitled "How to protect yourself from malware".

__

If you are not having any other malware problems, it is time to do our final steps:

1. We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.
2. If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)
   • Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required
   • "%userprofile%\Desktop\combofix" /uninstall
     • Notes: The space between the combofix" and the /uninstall, it must be there.
     • This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.
3. Go back to step 6 of the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.
4. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
5. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
6. If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
7. Go to add/remove programs and uninstall HijackThis if it present
8. Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders
   related to MGtools and some other items from our cleaning procedures.
9. If you are running Win 7, Vista, Windows XP or Windows ME, do the below:
   • Refer to the cleaning procedures pointed to by step 7 of the READ ME
     for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.
   • Then reboot and Enable System Restore to create a new clean Restore Point.
10. After doing the above, you should work through the below link:
    • How to Protect yourself from malware!

Be safe

 

Scaned with all listed programs and all came clean except for some cookies in temp file which were deleted after :-D Should I also delete

1.) TDSSKiller_Quarantine

2.) _OTL

files from C drive ?

Just wanted to make sure before going thru with it .

ohh and do you need any logs from the scans ? I already deleted them but i could run them again if needed .

 

Step #8 of the cleanup instructions will remove these.

No I do not. Thanks for asking though. Surf safely! :cool

 

Cool.

Thanks again man .

You are awsome !