Hey guys, fellow PC tech here. We've been seeing an influx of a specific type of malware damage to Win7 machines lately, usually results in a reinstall. I'm trying to expand my knowledge a little bit on this issue.
After all malware is removed and cleaned up, one issue that remains is AFD service refuses to start. It's not listed under the hidden devices in devmgmt either. Two other things that were broken that I did manage to fix were DHCP and DNScache. I've got reg entries saved from a working machine, from both service pack 0 and 1, and every flavor of Win 7 (honestly haven't checked to see if I'm doubling up on saves, I just haven't had time to examine the differences, if any, between those that came from different versions). FSS was a lot of help there as I'm sure you know. I identified some files that were broken or missing which wasn't a problem as I also had back ups of those on my flash drive.
I've had to fix DHCP, DNScache, and other items in the food chain before, that's old hat and fairly straight forward. But the amount of information on the web regarding AFD is lacking to say the least. When I have time, I've been experimenting on systems that are low priority when they come in with this kind of damage, but anymore, I take a few minutes to look for AFD damage and just advise a clean install because I haven't figured out a way to fix that yet. It seems to be the parent service that many other child services call dependent in the networking hierarchy.
What I'm after:
Say AFD is completely hosed in a system. Asuming I can fix it with SFC /scanfile (and if not, using the backup from my flashdrive), what's required to properly reinstall in the device manager? Ancillary Function Driver for Winsock is missing entirely from device manager, which explains the 1058 error. Its normally in non-plug and play drivers. If anyone had an .INF for it, it seems like it would be pretty straight forward.
Thanks guys. Keep fighting the good fight.
EDIT: I wanted to add that I've already copied the registry structure for AFD from a working computer like I did for DHCP and DNScache, which fixed those problems. The problem doesn't seem to be registry related. It seems to be that the device just isn't there; need to re-add it in device manager.
Edited by boopme, 13 November 2012 - 09:40 PM.