Thanks for this thread.
billmo -- what CD booted utility did you use to find the virus (Trojan) in wdf01000.sys? I have pulled the HDD from my HP W7 laptop, connected it to my XP tower, and run both Malwarebytes and SUPERAntiSpyware against the drive. SAS did remove a trojan in
a restore file, but when the drive was reconnected to the laptop, KB2685811 still fails to install. Please update us with your results after you replace the wdf01000.sys file. BTW, where did you get a clean copy of the file?
Wei -- the error messages I find in cbs.log differ from the messages you outline in your post. Instead, I see the following messages:
2012-12-01 13:55:52, Error
CSI 00000001@2012/12/1:21:55:52.751 (F) Logged @2012/12/1:21:55:03.596 : [ml:100{50},l:98{49}]"MOF (install online) $(runtime.wbem)\Wdf01000.mof"
[gle=0x80004005]
2012-12-01 13:55:52, Error
CSI 00000002@2012/12/1:21:55:52.751 (F) CMIADAPTER: Inner Error Message from AI HRESULT = 8004402f [Error,Facility=FACILITY_ITF,Code=16431 (0x402f)]
[
[210]"Parsing MOF file: C:\Windows\system32\wbem\Wdf01000.mof
Error 80 in Function CMofLexer::CMofLexer line 615
C:\Windows\system32\wbem\Wdf01000.mof (1): error SYNTAX 0X8004402f: Error creating temporary file
"
]
[gle=0x80004005]
2012-12-01 13:55:52, Error
CSI 00000003@2012/12/1:21:55:52.751 (F) CMIADAPTER: AI failed. HRESULT = 8004402f [Error,Facility=FACILITY_ITF,Code=16431 (0x402f)]
Element:
[137]"<mof xmlns="urn:schemas-microsoft-com:asm.v3" name="$(runtime.wbem)\Wdf01000.mof" uninstallmof="$(runtime.wbem)\Wdf01000Uninstall.mof" />"
[gle=0x80004005]
2012-12-01 13:55:52, Error
CSI 00000015@2012/12/1:21:55:52.751 (F) d:\win7sp1_gdr\base\wcp\cmiadapter\installers.cpp(352): Error 8004402f [Error,Facility=FACILITY_ITF,Code=16431 (0x402f)] originated in function Windows::WCP::CmiAdapter::CMIWrapperBasicInstaller::ResolveAndInvokeInstaller
expression: hr
[gle=0x80004005]
2012-12-01 13:55:56, Error
CSI 00000004@2012/12/1:21:55:56.277 (F) CMIADAPTER: Exiting with HRESULT code = 8004402f [Error,Facility=FACILITY_ITF,Code=16431 (0x402f)].
[gle=0x80004005]
2012-12-01 13:55:56, Error
CSI 00000016@2012/12/1:21:55:56.277 (F) d:\win7sp1_gdr\base\wcp\cmiadapter\installers.cpp(123): Error 8004402f [Error,Facility=FACILITY_ITF,Code=16431 (0x402f)] originated in function Windows::WCP::CmiAdapter::CMIWrapperBasicInstaller::Install
expression: hr
[gle=0x80004005]