Thanks for this thread.
billmo -- what CD booted utility did you use to find the virus (Trojan) in wdf01000.sys? I have pulled the HDD from my HP W7 laptop, connected it to my XP tower, and run both Malwarebytes and SUPERAntiSpyware against the drive. SAS did remove a trojan in
a restore file, but when the drive was reconnected to the laptop, KB2685811 still fails to install. Please update us with your results after you replace the wdf01000.sys file. BTW, where did you get a clean copy of the file?
Wei -- the error messages I find in cbs.log differ from the messages you outline in your post. Instead, I see the following messages:
2012-12-01 13:55:52, Error CSI 00000001@2012/12/1:21:55:52.751 (F) Logged @2012/12/1:21:55:03.596 : [ml:100{50},l:98{49}]"MOF (install online) $(runtime.wbem)\Wdf01000.mof"
[gle=0x80004005]
2012-12-01 13:55:52, Error CSI 00000002@2012/12/1:21:55:52.751 (F) CMIADAPTER: Inner Error Message from AI HRESULT = 8004402f [Error,Facility=FACILITY_ITF,Code=16431 (0x402f)]
[
[210]"Parsing MOF file: C:\Windows\system32\wbem\Wdf01000.mof
Error 80 in Function CMofLexer::CMofLexer line 615
C:\Windows\system32\wbem\Wdf01000.mof (1): error SYNTAX 0X8004402f: Error creating temporary file
"
]
[gle=0x80004005]
2012-12-01 13:55:52, Error CSI 00000003@2012/12/1:21:55:52.751 (F) CMIADAPTER: AI failed. HRESULT = 8004402f [Error,Facility=FACILITY_ITF,Code=16431 (0x402f)]
Element:
[137]"<mof xmlns="urn:schemas-microsoft-com:asm.v3" name="$(runtime.wbem)\Wdf01000.mof" uninstallmof="$(runtime.wbem)\Wdf01000Uninstall.mof" />"
[gle=0x80004005]
2012-12-01 13:55:52, Error CSI 00000015@2012/12/1:21:55:52.751 (F) d:\win7sp1_gdr\base\wcp\cmiadapter\installers.cpp(352): Error 8004402f [Error,Facility=FACILITY_ITF,Code=16431 (0x402f)] originated in function
Windows::WCP::CmiAdapter::CMIWrapperBasicInstaller::ResolveAndInvokeInstaller expression: hr
[gle=0x80004005]
2012-12-01 13:55:56, Error CSI 00000004@2012/12/1:21:55:56.277 (F) CMIADAPTER: Exiting with HRESULT code = 8004402f [Error,Facility=FACILITY_ITF,Code=16431 (0x402f)].
[gle=0x80004005]
2012-12-01 13:55:56, Error CSI 00000016@2012/12/1:21:55:56.277 (F) d:\win7sp1_gdr\base\wcp\cmiadapter\installers.cpp(123): Error 8004402f [Error,Facility=FACILITY_ITF,Code=16431 (0x402f)] originated in function
Windows::WCP::CmiAdapter::CMIWrapperBasicInstaller::Install expression: hr
[gle=0x80004005]
I used AVG rescue disc that you can download from AVG site. It runs on Linux and you can therefore scan with AVG without booting the PC. You then use the file manager utility to rename the file and to copy across the new copy that you need to have ready on
a usb card. I got a copy of wdf01000.sys from another PC.