tidserv! inf dhcp wont start ddayww.sys error

[dtureaud]

my dhcp wont start

1608 error.
i have to use a static ip in order to connect.

vista home premium 32

the dependencies are

ancilliary function driver for winsock
network store interface service
nsi proxy service
tdx

when I try net start tdx i get system error 2 cannot find the file specified.

i had the backdoor.tidserv!inf virus and it infected tdx.sys

I think norton deleted the file.

when my computer goes to desktop i get ddayww.sys missing.

 

[tom982]

Is this a recent problem? If not, you could try a system restore:

http://www.vistax64.com/tutorials/76905-system-restore-how.html

 

[dtureaud]

i got the virus less than 5 days ago and my restore points are turned off

 

[tom982]

Why are your restore points turned off?

 

[dtureaud]

because most viruses i see these days infect the restore points and i just didnt want to waste the space on it. is there a way to extact system files 1 by 1 like there was for win95? or some program I can run to restore the relevant registry entries? i think this particular virus overwrote my tdx.sys file with its own version and norton latched on to anything associated with it in the registry and wiped it out. the error about the ddayww file seems to have cleared up but I still cant acquire a dhcp address. It only goes as far as the identifying phase and then sticks me with an apipa address which would be fine if i wanted to change my router to use the 169.254.x.x range of addresses but Im sure theres gotta be a way to fix this. can I reinstall the tdx service from cd perhaps?

 

[tom982]

Just put in the vista disc and select repair. That should work if you are missing system files

 

[dtureaud]

is ddayww.sys a virus or a vista system file. my searches on ddayw.sys say its a virus, but ive found nothing on ddayww

 

[tom982]

I'm sorry, but I don't know, this thread is the only website that has the exact phrase "ddayww.sys".

I have found that ddayww.dll is a virus though. Since nobody seems to know anything about ddayww.sys, it is likely that it is associated with the ddayww.dll, the virus.

Do you still have the Vista installation disc?

 

[dtureaud]

I do have it but I am not familiar with Vista's repair function. I havent attempted one since NT 4.0 and I remember the process to be unreliable due to the tendency of the operating system to interfere with legit installed software. How do I find which program is calling ddayww? Ive checked hklm/software/microsoft/windows/current ver/run etc as well as msconfig. Either the program being called isnt starting from there or the key I delete/uncheck is being regenerated by some other process. I get duplicate ddayww messages, not just one.

 

[tom982]

Viruses can be run under different aliases. Sometimes they will modify the svchost.exe to run the virus on startup.

Download the AVG rescue disc, burn it and then boot from it to scan for viruses.

More detailed instructions can be found here:

AVG Rescue Disk – Free AVG Bootable Antivirus CD

(As well as a download link for the ISO)

 

[tom982]

From what I can find, ddayww.dll is found in C:\Windows\System32

But I don't know about ddayww.sys

 

[dtureaud]

is there a trick to creating this iso disk? I used roxio creator 9 and the imgburn that is linked from the instructon page you provided. ive burned like 9 coaters that dont boot

 

[dtureaud]

Weird thing happened. My DVD drive cant read cd-r. I booted from my burner though and it worked fine. However, all it found was a bunch of tracking cookies and it didnt do anything about my ddayww errors so Im guessing theyre being called from somewhere in the registry. I am noticing that items in hklm\software\microsoft\windows\current ver\run that I delete are being recreated. I think they might be the source of the ddayww errors, but the ddayww file does not exist. Im also seeing reference to qomlii.dll in that reg key.

I didnt do the repair yet, will that fix my dhcp issue at least? Like I said Im a bit apprehensive about doing that so if you could address those concerns Id be much appreciative. Thanks

 

[tom982]

Well it's good that it didn't find any viruses. We'll try one more thing first to check your DHCP:

Open the start menu
Type cmd in the search box
Right click on it and Run As Administrator
Type:

sfc /scannow

And let it run
Repeat this process two more times

Let me know if it finds any corruptions

 

[dtureaud]

it found audiodev.dll and mofd.dll and it says the file in the store is also corrupted.

2 more symptoms possibly related

I have a Buffalo NAS Hard Drive. It runs a stripped linux and samba in order to share itself on to my network. The scan software that came with it can find it for the purposes of changing IP and passwords but it won't show up in net places nor can I get to it by typing \\host\share in the run box. ive also tried \\ip address. So that also means I cant map to it. I can ping the IP. all works fine from my laptop.

Also I get code 80070643 when I try to install .NET Framework 3.5 sp1. I know this update isnt vital but I am sensative to all errors at this point considering whats happened.

I also found something peculiar in my task scheduler.

On 5:30 2010 at 4:59 and again each hour something call seupd.exe is scheduled to run. I call it peculiar because it uses XP conventions (c:\doc and set vs. vista c:\users) I disabled it. There are also some google updater lines in there which I wasnt sure about.

 

[tom982]

Can you open up command prompt and type:

netsh winsock reset

Then try connecting again, does it work?

 

[dtureaud]

the reset was successful however i still cannot connect to the NAS. I also found that I cannot connect to file or printer shares hosted on my vista desktop(the one Ive been troublesooting) from my XP laptop, and vice versa. I was able to do this before I got this virus.

 

[tom982]

I'm sorry, I'm all out of ideas Perhaps somebody with more experience will be able to help. If nobody else comments, then repost the question and tell people what you have done to try and fix it.

Sorry again,

Tom

 

[dtureaud]

should i or should I not run the windows repair? what specific benefits/risks are involved in my particular situation

 

[tom982]

Well, I would do a full backup of your data and important documents, and then try.

Take a look at Brink's tutorial:

http://www.vistax64.com/tutorials/88236-repair-install-vista.html

Tom