Quick Fix: AFD.sys / AFD Service is missing Windows XP

I had a customer email me yesterday with the following symptoms…


This particular client is located in France, so a site visit is a little tricky. Luckily they had a second computer, and we could talk through Skype. I did some basic connectivity tests like ipconfig, the IP was reported as with a subnet mask of I tried to do a netsh int ip reset resetlog.txt which didn’t help to resolve the issue, we also tried things like safe mode, system restore etc.

I then asked the user to set a static IP, which after a reboot gave them local network access, and more importantly allowed me to login to the computer through RDP.

I looked in the services console to check for DHCP Client, which was not running. When i tried to run it, it complained about a dependency being either deleted or marked for deletion. Very odd. Checking in the event logs, sure enough i found a lot of events similar to this.


The AFD service seemed to be the culprit. Not one i had heard of before so i did a little investigating and found it is tightly integrated into the WinSock and TCP/IP Stack. So kind of critical to network function.

At this point we still did not have full internet access, so downloading Malware scanners or patches was difficult, and i was having to download them first to the Server, then browse the network for them.

I used Kaspersky’s famous TDSS Killer, which came up with zero threats and also found a few forum posts to look through, none of which gave me any solution.

Looking through the registry at HKLM\System\CurrentControlSet\Services\ I could not see anything called AFD. I switched over to my Hyper-V server which has an XP Client running for reference, sure enough on this box there was indeed an AFD service at that location.

I also noticed on the clients PC that AFD.sys was missing from the C:\Windows\System32\Drivers folder, so i found a copy in one of the $NTUninstall$ folders, and copied it back.

I then exported the Registry Key for the AFD service on my reference machine, copied it across to the Clients PC, imported the registry key and rebooted.


After a reboot all of the services that were failing are now started, and the computer can access the internet.

Has this post helped you out? If so, please consider donating to Room to Read by way of showing your appreciation!


About Robert Pearman
Robert Pearman is a UK based Small Business Server enthusiast. He has been working within the SMB IT Industry for what feels like forever. Robert likes Piña colada and taking walks in the rain, on occasion he also enjoys writing about Small Business Technology like Windows Server Essentials or more recently writing PowerShell Scripts. If you're in trouble, and you can find him, maybe you can ask him a question.

43 Responses to Quick Fix: AFD.sys / AFD Service is missing Windows XP

  1. John Duquette says:

    Thanks for posting this. The same thing happened on my son’s laptop. Avast was also complaining with Error 10050 while this was occuring, and when I fixed the AFD registry Avast found the malware ‘rootkit’ had been installed. Coincidence?

  2. Matt McArthy says:

    I’m having the same problem, except AFD.sys is in my system32 folder, but the registry key is missing.

    “I then exported the Registry Key for the AFD service on my reference machine”

    Can you explain how you did that please? Would be very helpful.

    Thanks in advance!

    • Hi Matt.
      On a working reference Windows XP system, i opened the registry editor, found the AFD service. (HKLM>System>CurrentControlSet>Services) Then eported that registry key to a .REG file.

      I then copied that .REG file to the broken XP machine and imported it into the registry. Then i rebooted. Make sure the AFD.sys file also exists in \System32\Drivers

      • Matt McArthy says:

        Yes. I found it out just before you posted your reply :) Quite unbelievable that so many processes are depending on ONE driver with a registry key…

      • Tim says:

        thanks bro, I was looking high and low for a resolution found this thread and 2 mins later firewall back with no problems. Thank you for posting.

  3. Matt McArthy says:

    Nevermind.I exported the keys via your example. Thanks again! (registry editor, find the AFD folder and export from there) It’s all working properly now.

  4. Max says:

    Very Nice! Thanks a lot :-)

  5. Mik2k says:

    Just want to go on record that this afd.sys file and registry entry is a pain whenever something decides to remove them from the system. After about 3 hours of troubleshooting, I ended up here and copied afd.sys from my working machine to the broken machine, rebooted and all is well now.

    For anyone else that ends up here here is the troubles my friend had:
    Limited or No connectivity message with wireless or wired connection
    Windows Firewall ICS service would not start (A socket encountered a dead network error)
    Network Location Awareness (NLA) service would not start (Depends on the “non existent” service AFD)
    Wireless zero configuration service would not start

  6. Kevin says:

    Sure wished I had happened across this site about 4 hours ago! Your solution fixed it. Many thanks. My issue stemmed after Avast notified me of the infection…

  7. Terri Lynn says:

    Also, if you don’t have a different XP machine to copy the registry keys from, you can export the keys from one of the backup control sets ( HKLM\system\controlsetXX). I ran into this situation where I only had wn7 machines around so this was my solution.

    Great Post btw, this really saved my bacon today!

    • No worries.

      If it was really that useful i would be very grateful if you would consider a small donation to Room to Read via my Room to Read page at the top of the screen.


    • Terri Lynn says:


      I forgot to mention that after you export the keys to a .reg file, you will need to edit the file (with notepad) and change the “controlsetXX” to “currentcontrolset”. Then when you import (just doubleclick the .reg file, itwill mport the keys to the correct location.

      HTH – thanks gain.

  8. Mario A says:

    Awesome! You are the man! Had been searching for solution for couple of days. You are a life saver!

  9. Sammy P says:

    Oh snap!!!! This was so simple, if only I had found this a week ago. Been racking my brain and trying every suggestion on every technical website I could find. This was my first instinct to do, but I couldn’t figure out which files to transfer from my other system with XP. Thanks Man!

  10. Jimmy says:

    still no joy, reboot and the service is still not running

  11. mikeitx says:

    You are a lifesaver! This one was driving me a little bit crazy!

  12. pauls4 says:

    Hi MANY(!!) thanks for this information; it was exactly what I needed to get win-7 and DHCP working again after an infection!! You are a life-saver!

  13. Tom says:

    followed your directions exactly and after import and reboot, still don’t see AFD service nor AFD in the hidden device manager. DHCP client still won’t start.

  14. grayson says:

    I seem to be having this problem and its driving me insane.

    What i have found is that AFD is no running in the services
    the system32 afd file exists. I dont understand coping the registry keys yall are talking about nor do i have a machine to copy from. any ideas?


    • To copy a registry key, you will need another copy of the key. You may find one under, CurrentControlSet# (where # is a number)

      Otherwise you may be better off taking your pc to a repair shop.

  15. Dean says:

    Would doing a system restore to the last restore point fix the registry issue as well as return afd.sys to C:\windows\system32\drivers folder?

    • I tried that with the affected system and it didn’t work.

      It’s worth a try, just to see if it works for you.

      Remember that it would also undo anything else that had occurred between today and the RP, whereas if you can grab a copy of that key/ file and import them that should solve it.

  16. David says:

    can i export the AFD file to a flash drive then drag it into the affected afd folder? The AFD folder exsists in HKEY but i got an error that the computer cant it cant find it when trying to start AFD manually

  17. sharath says:

    Thank you very much. I experienced the same problem and it works now after copying the afd.sys and exporting the registry entry of afd of other machine into the problem machine.

  18. Chris G says:

    Same problem here. I spent 8 hours gratis at a little-old-lady customer’s house trying to fix this. It was my 2nd visit, as when I fixed it the first time using System Restore, the problem cropped up again. System restore again fixed the problem, but it happened again after a couple of reboots. I never did get around to a full Malwarebytes scan, thinking it would take too long on an older machine, but TDSSKiller showed nothing and I saw no other suspicious processes with autoruns or taskmgr. Even a repair XP install did not fix it, though it did restore the AFD service to the registry. At one point I thought I had it licked, as DHCP, firewall, etc were working, but DNS lookups failed, even after restarting the DNS client service and purging the cache, though I could ping an external DNS server by IP. I found that afd.sys kept disappearing from the drivers folder, but a compressed copy remained in the dllcache folder, so I uncompressed it and repointed the registry’s path to it.
    This fixed the problem.

  19. Passing Stranger says:

    Interesting. I have a friend who got themselves infected with the Sirefef.2 nasty; I cleaned it off successfully but they’re now got a variant of this problem.
    Browsing, DHCP, DNS lookups et cetera are fine, the only manifestation is the WLAN system tray icon is constantly flickering in the ‘acquiring network address’ state. I tried to start NLA, which usually is the cause of this, but it failed (Error 127). It appears AFD isn’t running though the file and reg key are there. Odd.

  20. Lucie says:

    Took me 3 weeks to learn about Services, “Event Viewer” (which gave me the clue: missing AFD file, but did not explain it). This page came out top yesterday when I googled the error message on AFD (on my main computer)… Clear explanation, Clear solution, I was back online in 10 minutes!! The virus “Internet Security” had ERASED both afd.sys file and the Registry entry. I would never have been able to find that out by myself! Many, many thanks.
    An old lady who will officially be “senior” in two weeks…

  21. JeffMIS says:

    This is really a great tip. I have been manually removing viruses for many years and this adds a real tool to resolving the damage done to the Windows\system32\drivers files, left by Rootkits and some viruses. In some cases the systems are unbootable because of damaged driver files, like for TCPIP or the hard drives.

    One thing about the file you are replacing, in this case AFD.SYS. Want to try and make sure the file you are copying from the old uninstall folders is around the same date as other files in the drivers folder. I copied the newest afd.sys and it didn’t work, went back and got the one that was the same date as other files around afd.sys and it came up right away.

  22. 02befree says:

    Was excited to find this post. I run a tech service and thought this would be easy, and it was, but still no connectivity. Several services (TCIP/IP, DHCP, etc) still depend on AFD and still aren’t running. Any other options? Will try cleaning tools again to see if there’s a persistent infection that is blocking this repair. Exported the registry file and found a similar date AFD file and put them in place, but still the same. Ran WinsockXPfix and still nothing. Ideas welcome.

  23. frustrated says:

    Could anyone email me an afd.sys for a vista 64bit machine. I am attempting a repair for a family member but only have 7 machines. I really don’t understand why microsoft can’t provide essential system drivers online. Any help would be greatly appreciated.

  24. VojtechSoukup says:

    damn i have quite a problem here right now i have just this notebook with vistas on it and a pc with xp which seems doesnt have an afd service nor the file (found it and placed it in sys32 drivers folder) nor registry entry (in whole reg) i need to make it running asap so after i found afd.sys file and copied it in the folder you said i restarted the pc the current state is… that i have the file there so nothing deleted it (yet:-D) but the service is missing and im registry i found it just in HKLM\SYSTEM\Controlset001\Control\Safeboot\Network and there is a “folder” AFD with one entry which is service just that (REG_SZ type) then in HKLM\SYSTEM\Controlset001\enum\Root\LEGACY_AFD000 there seemsdceto be some complete service entry with key classes devicedesc etc. then in controlset002 (same destination and state(1 entry in it)) and also the legacy_afd (same as in controlset001) and the same is for currentcontrolset which means that in safeboot mode it should work… now i need it to get running in normal mode too i desperately need a help

    • VojtechSoukup says:

      solved i found cd copy and extracted the file with sfc and then i found the reg key for xp on net and was lucky that it was working

  25. Bob Kadis says:

    Your solution to the missing afd registry entry helped me discover how to solve a related problem. A trojan horse Agent_r.ATS had infected NetBT.sys. I removed the file and had replaced it with a good NetBT.sys. The XP Pro connected to a router with a dedicated IP address. Everything worked well for several weeks until last Saturday, when Comcast replaced their modem with one that supported 4 wired ports and WiFi and removed the router. They wanted the IP address to be assigned automatically. The system wouldn’t do that. It reported “acquiring network address”. I found that the NetBT registry entry was missing. It probably was taken out by the trojan horse virus. I exported the NetBT registy key from another system and imported it to the system that did not have it. I did a reboot. The XP Pro came up with an IP address. Thanks!

  26. stephen says:

    Thank you for this Bob. I was having problems with BSOD and followed advice to use the VERIFY dos command to check for problems. Following which after a reboot I had all of the above problems with services not running, I copied the afd.sys from a similar machine and was able to restart services and get back on the network. If my car crashed as much as my pc I would be uninsurable ;)

  27. Marcelo says:

    Just the exporting process seemed to have fixed my problem! Thank you so much! :))

  28. Vincent XI says:

    Hi, I recently run combofix on my computer…and noticed on the the log file.. it listed the file afd.sys as missing…later on..I could not connect to the internet…after alot of struggle…i did a search for the afd.sys file on drive C: and found the file quarantined by Qoobox and saved under the folder: C:\Qoobox\Quarantine\C\WINDOWS\system32\drivers and renamed to afd.sys.vir…..(Qoobox is the malware remover combofix uses..and its folder plus the combofix log file is automatically saved directly under drive C:) so i renamed the file back to afd.sys copied it and pasted it on C:\WINDOWS\system32\drivers..after rebooting I successfully connected to the internet.

  29. You have saved my life, I will be grateful forever… Thanks!!!

Leave a reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

%d bloggers like this: