Deleted AFD.sys file from NT 4.0 Workstation. Why?

Posted on 2001-09-13
Last Modified: 2006-11-17
I've had this happen twice now within a couple of months.  One of our external laptop users called and couldn't get onto the network so we took a look at his machine.  There was an error 7000:

"The AFD Networking Supoport Environment service failed to start due to the following error: The system cannot find the file specified."

The file AFD.sys was missing from the c:\winnt\system32\drivers directory. I replaced the file and it works fine.  

My question is what would cause this file to be deleted?  We use a Winnt domain and the users connect with cable to our VPN.  Any ideas?


Question by:dgwest
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 4
  • 3
LVL 41

Expert Comment

ID: 6480215
My first thought would be users
the second virus/trojans

Author Comment

ID: 6480244
The users say they didn't do it. There really is no reason to delete that file.  As far as viruses go, the computers get updated to the latest stuff when they log onto the network. It's possible but I doubt it.
LVL 41

Expert Comment

ID: 6480272
I'm just guessing here
the users kids?
Nothing personal againt the user, but end users are mistaken sometimes
I know there is no reason to delete the file, but.....
If it is a one time occurance, you might never know, but if it repeats it self, then you can try and track down what is causing it
Easy, flexible multimedia distribution & control

Coming soon!  Ideal for large-scale A/V applications, ATEN's VM3200 Modular Matrix Switch is an all-in-one solution that simplifies video wall integration. Easily customize display layouts to see what you want, how you want it in 4k.


Author Comment

ID: 6480279
It's happened to 2 different users.
LVL 41

Accepted Solution

stevenlewis earned 50 total points
ID: 6480369
enable monitoring on the file access, deletion, etc and see what event viewer reports
LVL 41

Expert Comment

ID: 6639066
So how was it being deleted?

Author Comment

ID: 6641798
I have no idea.  It hasn't happened since.  I was just clearing up some outstanding questions I've asked and you gave me some ideas.


Featured Post

Technology Partners: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
fabric 1 56
Vyos VLANs 14 58
How to append an output to existing file with DOS and IPerf 2 60
Vmotion configuration 4 54
Don’t let your business fall victim to the coming apocalypse – use our Survival Guide for the Fax Apocalypse to identify the risks and signs of zombie fax activities at your business.
I had an issue with InstallShield not being able to use Computer Browser service on Windows Server 2012. Here is the solution I found.
Get a first impression of how PRTG looks and learn how it works.   This video is a short introduction to PRTG, as an initial overview or as a quick start for new PRTG users.
Here's a very brief overview of the methods PRTG Network Monitor ( offers for monitoring bandwidth, to help you decide which methods you´d like to investigate in more detail.  The methods are covered in more detail in o…

756 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question