VDNT32.SYS, VDNT_16.SYS, and possibly others

Viruses and worms
1

I am new at having these sorts of problems so I am unsure what details to give. I have been using one form of virus protection or other for years with no problem. I always update my virus defs 2 or 3 times a week. I recently switched to AVAST free. Not complaining about any of my anti-virus programs – just delineating what is going on here. Below is my best recollection of the past 2 days. Sorry if I give more info than is useful, but I I really don’t know what is useful info & what is not. I did not keep good notes until recently so some of the info is a bit sketchy.

I have a dual boot system. Win-98(SE) and Win-XP (SP1 installed). I was backing up my system with Cobian 6 backup. I had just re-formatted the partition where backups were stored, so no chance of just restoring from backups. There are no full backups. Most all my work is done from Windows-XP. Win-98 no longer has internet access. Unless otherwise noted, all the paragraphs below are events which happened while I was working in Win-XP.

I am not sure if the problem arose from a malicious e-mail which had gotten past AVAST or from something ancient on my hard drive which became active during the backup process. AVAST found some problems during system scan earlier (which my previous ant-virus software had not found), and had moved the files to the CHEST. I was doing the backup while reading my mail. I got a notice from AVAST. I pressed the button to send to CHEST, but AVAST was unable to move to CHEST. I was not paying attention to the name of the problem file. I told AVAST to delete. This repeated itself a few more times. Each time I told AVAST to delete the file. I probably deleted 3 or 4 files, maybe 5.

Then Cobian backup appeared to crash my system. I started keeping crude notes of files which appeared to crash my system, but did not keep good notes as to which action caused which message to appear. A full list appears below.

I assumed the problem was with Cobian. Their message boards had not answered a previous question of mine, so I did not bother to write them. I rebooted in safe mode to disable Cobian, re-booted again in normal mode, then I un-installed, then re-installed Cobian. Cobian bombed my system again. I then re-booted in safe mode so I could remove Cobian from my startup.

At some point I went into Win-98 to attempt to look see which files Cobian had backed up from Win-XP. Win-98 bombed. When Win98 re-booted, it altered the registry. I had no way to tell it not to. I really hat it when Windows does stuff like that! Win98 then would not re-boot. I tried Safe mode. That would not work either. I got fragmentary messages as the system was locking up. I finally got the message
Write initiating Device VKD
Windows Protection Error

I went back on Win-XP. I tried to use Windows search function to track down the various filenames which had been causing me errors & re-boots, but Windows Search also caused a re-boot.

I used google to begin looking for “Device VDK” as well as the other filenames which appeared when Windows re-booted.

Device VDK appears to be a keyboard driver problem caused by a mal-functioning multi-purpose keyboard. Had it appeared with no other problems, I might believe I needed a new keyboard. But as the keyboard works fine in Win-XP & there are all these other problems too, I am dubious.

I found an on-line virus scanner. I tried it. My system re-booted. I came to this board & began reading http://forum.avast.com/index.php?board=4;action=display;threadid=5373

I downloaded the AVAST tool for checking viruses. It caused a re-boot. Not right away. It checked memory as being OK then bombed while checking drive C. I renamed to EXE file into a COM file. That also caused a re-boot while checking drive C. I tried again after a name change to a SCR file. This time I tried to catch the name of the file causing the problem, but it happened too fast.

Over this time period I have re-booted a dozen or more times. Each time Windows starts, Kerio Personal Firewall has started seemingly OK, then at some point, I get one or more of these three messages appearing on screen.

Msg Digest Compute MD5 unable to open
G:\Windows\System 32
error 5

Kerio Firewall gives me box asking if it is OK to connect System 32 to 64.191.91.71 port 80 (I always say NO).

And Kerio Personal Firewall Driver then goes belly up. Sorry I did not get the full text of the error message before the message disappeared from the screen.
Kerio Personal Firewall Dricver:
AppendFragmentToLongPath:
GetLongFile

This next part may or may not be helpful. I jotted down a few filenames which came up as Windows re-booted, but I did not write down details.

VDNT32.SYS

rascd.sys (or maybe it was rasacd.sys)

agp440.sys

VDNT_16.SYS.

This last time I shut my computer off rather than re-boot. When Windows-XP was on the logon screen as it was shutting down I got an error message about AshServer.EXE (not sure of spelling) The message disappeared from the screen before I could copy it down.

I just checked Windows task manager. I am not connected to the internet at present & have not much running. I see two task which are running with high CPU. No idea if this is a part of the problem or not.
tgshell.exe
tgcmd.exe

My system contains no banking or credit card info. None of the passwords on my machine are for any sites which could harm me financially. I do have various e-mail, yahoogroups, & bulletin boards. Ebay password is here, but as I don’t use paypal, credit cards, or sell anything it does not seem like much of this would be useful to anyone else.

I’d really rather not format everything & start over. I have a lot of software on my hard drives which I really do not want to re-install or have to re-configure. Some of it I no longer have the original installation disks. And a lot of data files I really do not want to lose.

I have been going on-line for short periods of time only, then closing my DSL connection. I have not checked my normal mail account as I have no anti-virus connection. I re-boot after Kerio firewall goes belly-up. I have no real clear idea as to what my next steps need to be. I am trying hard not to panic. I would really appreciate help and guidance.

Alobar

2

tgshell.exe and tgcmd.exe are spyware.

VDNT32.SYS and VDNT_16.SYS is the Haxdoor trojan.

agp440.sys belongs to the ATi Catalyst Package and is know to cause problems.

Could it be Rasacd.sys? If so that is the RAS Automatic Connection Driver from Microsoft.

I suggest removing the catalyst driver and clean you system from any malware. (see malware removal section on the page in my signature)

Let us know if it solved the problem.

3

Thanks for your rapid and clear response. I hate to sound dense but I want to verify with you before I do anything as I am nervous.
Are you saying it is OK to just delete (or move?) agp440.sys?

I looked at your page. I saw section on virus removal. Is this the same thing as malware?

Whatever is on my system has stopped both my firewall & my AVAST anti-virus. Are you saying that AVAST will work if I boot into safe mode? Will this clean the Haxdoor trojan?

aswclnr.exe won’t work on my system now. Will aswclnr work in safe mode? Or do I need other programs for this?

I assume getting rid of spyware is of a lower priority here, and that the other things get a higher priority.

Many thanks.

Alobar

4

[qoute]Are you saying it is OK to just delete (or move?) agp440.sys?


No, I am saying to remove the catlist drivers for the video card. (agp440.sys is only a part of that) and use the normal video drivers.

I looked at your page. I saw section on virus removal. Is this the same thing as malware?
There is no virus removal section. It is malware removal. Malware is a 'collective' name for everything that is harmfull to a system like viruses, trojans, worms etc. [url=http://212.204.166.18/smf/index.php?topic=2.0](See HERE for definitions)[/url] The section there makes sure that all malware will be gone, not only viruses.

If you can’t get Avast to work (either in safe mode or normal mode), use at least 2 online scanners. Make sure you enable the option to repair/delete infected items.

I assume getting rid of spyware is of a lower priority here, and that the other things get a higher priority
Since it is not clear what exactly is causing your problems since you have multiple things going on, I would say they are of equal importance and should by number 1 on your "to-do-list"
5

I am finally back on line and found my way back here. I could not get the malware weeded from my system. Avast would not work in safe mode, and in normal mode, the system kept rebooting. I finally just scrubbed the Win-XP partition and re-installed. Since the re-install, I have had NO problems with my video drivers or anything else. Avast was then working fine and there were no problems present. Then one of my USB hard drives blew. I am limping along right now on just internet explorer because all my installed programs and data are on the blown disk. A new disk is on order which I shall install asap, then install what I can from back-ups.

Alobar