Strange SCSI adapter installed - seems to be useless

[blutach]

I have recently updated my NVIDIA display and some MB drivers (as well as some other drivers).

I now notice that my device manager shows a weird description (afsvbqxn) and its driver is a non-existent sys file of that name under SCSI and RAID Controllers. Autoruns shows it to load under HKLM\System\CCS\Services with the description of an IDE/ATAPI port driver. I searched the location of the driver files but can not find it (C:\WINDOWS\SYSTEM32\DRIVERS\afsvbqxn.sys). Autoruns does not show the file as not found! - smelling rootkit here.

I can uninstall it without apparent consequences as my other SCSI driver is fine (SiS 3114 Soft Raid Controller). However, if I run a search for new hardware, it comes back again but with a weird name of just 8 random letters.

Relevant Everest reports attached along with the reg key containing it.

Do you think it might have something to do with Daemon Tools or ASPI? Doesn't that install some SCSI driver? Or perhaps NVIDIA trying to install a RAID driver in competition with the SiS one?

Anyway, how to fix? And should I be worried?


EDIT- Additional Info: After uninstall and reboot, Windows automatically finds a device and installs a CD-Rom (leads me to suspect DTools). It also brings back this device and the name always seems to start with A (it's now called anp3ww6f). Weird, huh? (Every reboot, it seems to change its name but always starting with an A). According to Autoruns, the driver is 94k, version 5.01.2600.5512 (M$ driver, right?), is verified by M$, and dated 14 April 2008. However, the icon in Autoruns is the same as the drivers which are reported as File Not Found (eg Changer.sys). It also reports that Process Explorer says the process is not running (which is awful strange for an IDE driver). I reckon this is actually atapi.sys (and it is now showing in IDE ATA/ATAPI controllers but on reboot it is back in SATA RAID Controllers).

BTW: Rootkit Revealer revealed nothing abnormal. SPTD (Daemon Tools) was inaccessible but that is normal.

Regards

[Abuilder]

Les
Just for the heck of it run Hijackthis on your system and see if it thinks it's hijacker.

http://www.download.com/Trend-Micro-HijackThis/3000-8022_4-10227353.html

[blutach]

Yeah, I thought of that as I went to bed. Here's the log. Those 2 services look funny, don't they?

EDIT: Deleted them and rebooted, but it comes back with a new name (begining with a) and same driver info. Uniblue's Driver Scanner gives this driver as up to date and its inf as c:\windows\inf\pnpscsi.inf (so it's got to be atapi.sys, right?). BUt the hardware ID is totally crazy: Nijmn-4703

Also, that {5C255C8A-E604-49b4-9D64-90988571CECB} in the HJT log is of no consequence. It's that new Windows Live Call, which I elected not to install into my browser.

Regards

[Abuilder]

Les
Google on just "HKLM\System\CCS\Services" and you will find a bunch of people with the say problem but always with a different random ******.sys file loading. A MS tech on one page declared it as not a threat. For What that's worth! ZIP

[blutach]

I'll do that and thanks for the info mate (wonder how to get rid of it, though and what introduced it!!!).

Just for reference (perhaps more mine than anyone's), I have done a full Everest Report and attached it now.

Regards

[blutach]

Hmmm - can't seem to find a link where a M$ guy says anything about this issue.

Regards

[Abuilder]

Les
I was looking at your Everest report and it looks to me that, that odd key is the one assigned by windows to the hard disk that is attached to your:
SCSI/RAID Controller Silicon Image SiI 3114 SoftRaid 5 Controller
The Sil3114 is your SATA controller but that controller chip (Sil3114) treats all devices hooked up to it as independent hotplug devices (SCSI).
Hence the “IDE” in the line: (Because it really is)
SCSI/RAID Controller ASNFP8AR IDE Controller
If you delete the key or device Windows will find it again as new hardware but retain the old key as a reference.
Here is a reference to your SATA controller chip that Windows is treating as a SCSI device.

http://www.siimage.com/products/product.aspx?pid=28

I bet all of this is pointing to your 575 Gb SATA drive.
BTW:
Home edition
Another 1024Mb of ram would help a lot.
The bios on your ASUS board is really old. “08/10/2006”
ASUS is about the best for bios updates. You might consider checking into it.
I wouldn’t let MS install anything that has to do with that Nokia

IMO: It looks to me to be a false positive situation.

[blutach]

First, many thanks for your help.

I don't think there is a newer BIOS - I checked into that a few months ago. I'll look again though.

So, you reckon, just delete the controller? Trouble is, every time I uninstall the rogue controller, it returns. Are you saying delete the SiS one, too?

As for the Nokia, I use it rarely to send SMSs, update the phone's firmware and the like. I suspect I can get rid of the software, but it does no harm.

Regards

[Abuilder]

So, you reckon, just delete the controller?

You could but but the next time you boot up, new hardware will be found and windows will give it a new key. If you disable the device you will most likely have problems due to it's your HD/controller.

[blutach]

Well, I tried that, and what you predicted happened - it just found it all again.

And, as you say, I kinda need the SiS controller, don't I?

Maybe, I am SOL and should just forget about it.

Regards

[blutach]

I wonder what put it there in the first place though?

My thoughts:

1. NVIDIA as a competing RAID driver.
2. An update to the SiS driver - perhaps a rollback to a previous version would cure it?
3. Daemon Tools - an uninstall would know for sure, but as you say, it's seems to be connected to the HDs and not virtual drives.

Any other ideas?

The Device ID is weird - haven't seen that on google at all - it's always the same - 4&6FCC33EF&0

EDIT: AHA! I think I have it...... More to come.

Regards

[doctorhardware]

Have you tried to roll back the drivers to see if that will eliminate the problem controller.

[Abuilder]

Any other ideas?

Yeah!
If it ain't broke don't fix it. LOL

[blutach]

It's Daemon Tools!!!!! All those drives are virtual drives under Daemon Tools. THAT'S why it found CD-ROM when it reinstalled in post 1.



And it ain't broke!

So, no need to rollback anything. But you'd think it'd ID itself nicer. And for sure the driver is actually atapi.sys

Regards

[MilesAhead]

It's Daemon Tools!!!!! All those drives are virtual drives under Daemon Tools. THAT'S why it found CD-ROM when it reinstalled in post 1.

[ATTACH]15550[/ATTACH]

And it ain't broke!

So, no need to rollback anything. But you'd think it'd ID itself nicer. And for sure the driver is actually atapi.sys

Regards

I was just coming on here to post cuz I have Daemon tools too. I don't have it autoload on startup. My CD Drive Door Open/Close thingy shows 2 optical drives because of it. Mine is named EZ3315G and some other stuff with lots of Qs and Ys and Zs.

Glad it ain't busted.