Corrupt Files After Virus

Brick · Aug 29, 2013

My account is an administrator, so i guess that is yes, i am on an admin account

Brick · Sep 2, 2013

Used a windows update troubleshooter, got this log to see what is the problem

Brick · Sep 3, 2013

After attempting the reg exports again, i managed to get the hkey current user one, so here is the exports for niemiro again.

In regedit i could get all the way up to current version, as group policy objects didn't exist.

P.S: I also tried on a freshly made admin account, still with no luck

Brick · Sep 12, 2013

Hi again i re-ran sfc and it is finding errors now.

tom982 · Sep 12, 2013

Hello Brick,

It is finding errors because you have illegally installed gpedit on Windows 7 Home Premium/Starter.

Code:

2013-09-12 23:08:41, Info                  CSI    00000662 [SR] Repairing 4 components
2013-09-12 23:08:41, Info                  CSI    00000663 [SR] Beginning Verify and Repair transaction
2013-09-12 23:08:41, Info                  CSI    00000664 Hashes for file member \SystemRoot\WinSxS\x86_microsoft-windows-fde_31bf3856ad364e35_6.1.7601.17514_none_aa136561b9ed4ae4\fde.dll do not match actual file [l:14{7}]"fde.dll" :
  Found: {l:32 b:ofJrYBMvfbcRFAtPFwvTqckgU78Xi+9tWAnhLEg79/w=} Expected: {l:32 b:rD8UQlH7wg0krCTlExE3A4g0I9dsTh7xIycF/LkD9Wc=}
2013-09-12 23:08:41, Info                  CSI    00000665 [SR] Cannot repair member file [l:14{7}]"fde.dll" of Microsoft-Windows-fde, Version = 6.1.7601.17514, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch
2013-09-12 23:08:41, Info                  CSI    00000666 Hashes for file member \SystemRoot\WinSxS\x86_microsoft-windows-g..policy-admin-gpedit_31bf3856ad364e35_6.1.7600.16385_none_ce0882b8c63afdf6\gpedit.dll do not match actual file [l:20{10}]"gpedit.dll" :
  Found: {l:32 b:kr66STTQJj/SGCfMluAmidqauu1XH+iINrNGn3DUoo4=} Expected: {l:32 b:APoyRFs/y8q5FUUUqvnYUu7WNOvG8O1t5PIwVEdODBg=}
2013-09-12 23:08:41, Info                  CSI    00000667 [SR] Cannot repair member file [l:20{10}]"gpedit.dll" of Microsoft-Windows-GroupPolicy-Admin-Gpedit, Version = 6.1.7600.16385, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch
2013-09-12 23:08:41, Info                  CSI    00000668 Hashes for file member \SystemRoot\WinSxS\x86_microsoft-windows-fdeploy_31bf3856ad364e35_6.1.7601.17514_none_e1bcfc28af006dea\fdeploy.dll do not match actual file [l:22{11}]"fdeploy.dll" :
  Found: {l:32 b:X2Mxr15BWaSKXy2mybUslwVk9Y/FqInLy5D57coBHZA=} Expected: {l:32 b:owbRu8ISPrlmbl0Vz49ljrBofAkNgg5OBFcHetYH9Ps=}
2013-09-12 23:08:41, Info                  CSI    00000669 [SR] Cannot repair member file [l:22{11}]"fdeploy.dll" of Microsoft-Windows-fdeploy, Version = 6.1.7601.17514, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch
2013-09-12 23:08:41, Info                  CSI    0000066a Hashes for file member \SystemRoot\WinSxS\x86_microsoft-windows-grouppolicy-gptext_31bf3856ad364e35_6.1.7600.16385_none_372622adf05a6587\gptext.dll do not match actual file [l:20{10}]"gptext.dll" :
  Found: {l:32 b:4R/wpzngnfdc0a94M7qP6Hg+i5N+LV89wlqPbSNLqTs=} Expected: {l:32 b:BsDN+s9AhmnbH9IGM3kEZrPP60pDJbd5sBO9ucrTILY=}
2013-09-12 23:08:41, Info                  CSI    0000066b [SR] Cannot repair member file [l:20{10}]"gptext.dll" of Microsoft-Windows-GroupPolicy-Gptext, Version = 6.1.7600.16385, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch
2013-09-12 23:08:41, Info                  CSI    0000066c Hashes for file member \SystemRoot\WinSxS\x86_microsoft-windows-fdeploy_31bf3856ad364e35_6.1.7601.17514_none_e1bcfc28af006dea\fdeploy.dll do not match actual file [l:22{11}]"fdeploy.dll" :
  Found: {l:32 b:X2Mxr15BWaSKXy2mybUslwVk9Y/FqInLy5D57coBHZA=} Expected: {l:32 b:owbRu8ISPrlmbl0Vz49ljrBofAkNgg5OBFcHetYH9Ps=}
2013-09-12 23:08:41, Info                  CSI    0000066d [SR] Cannot repair member file [l:22{11}]"fdeploy.dll" of Microsoft-Windows-fdeploy, Version = 6.1.7601.17514, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch
2013-09-12 23:08:41, Info                  CSI    0000066e [SR] This component was referenced by [l:202{101}]"Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~6.1.7601.17514.WindowsFoundationDelivery"
2013-09-12 23:08:41, Info                  CSI    0000066f Hashes for file member \??\C:\Windows\SysWOW64\fdeploy.dll do not match actual file [l:22{11}]"fdeploy.dll" :
  Found: {l:32 b:X2Mxr15BWaSKXy2mybUslwVk9Y/FqInLy5D57coBHZA=} Expected: {l:32 b:owbRu8ISPrlmbl0Vz49ljrBofAkNgg5OBFcHetYH9Ps=}
2013-09-12 23:08:41, Info                  CSI    00000670 Hashes for file member \SystemRoot\WinSxS\x86_microsoft-windows-fdeploy_31bf3856ad364e35_6.1.7601.17514_none_e1bcfc28af006dea\fdeploy.dll do not match actual file [l:22{11}]"fdeploy.dll" :
  Found: {l:32 b:X2Mxr15BWaSKXy2mybUslwVk9Y/FqInLy5D57coBHZA=} Expected: {l:32 b:owbRu8ISPrlmbl0Vz49ljrBofAkNgg5OBFcHetYH9Ps=}
2013-09-12 23:08:41, Info                  CSI    00000671 [SR] Could not reproject corrupted file [ml:48{24},l:46{23}]"\??\C:\Windows\SysWOW64"\[l:22{11}]"fdeploy.dll"; source file in store is also corrupted
2013-09-12 23:08:41, Info                  CSI    00000672 Hashes for file member \SystemRoot\WinSxS\x86_microsoft-windows-fde_31bf3856ad364e35_6.1.7601.17514_none_aa136561b9ed4ae4\fde.dll do not match actual file [l:14{7}]"fde.dll" :
  Found: {l:32 b:ofJrYBMvfbcRFAtPFwvTqckgU78Xi+9tWAnhLEg79/w=} Expected: {l:32 b:rD8UQlH7wg0krCTlExE3A4g0I9dsTh7xIycF/LkD9Wc=}
2013-09-12 23:08:41, Info                  CSI    00000673 [SR] Cannot repair member file [l:14{7}]"fde.dll" of Microsoft-Windows-fde, Version = 6.1.7601.17514, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch
2013-09-12 23:08:41, Info                  CSI    00000674 [SR] This component was referenced by [l:202{101}]"Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~6.1.7601.17514.WindowsFoundationDelivery"
2013-09-12 23:08:41, Info                  CSI    00000675 Hashes for file member \??\C:\Windows\SysWOW64\fde.dll do not match actual file [l:14{7}]"fde.dll" :
  Found: {l:32 b:ofJrYBMvfbcRFAtPFwvTqckgU78Xi+9tWAnhLEg79/w=} Expected: {l:32 b:rD8UQlH7wg0krCTlExE3A4g0I9dsTh7xIycF/LkD9Wc=}
2013-09-12 23:08:41, Info                  CSI    00000676 Hashes for file member \SystemRoot\WinSxS\x86_microsoft-windows-fde_31bf3856ad364e35_6.1.7601.17514_none_aa136561b9ed4ae4\fde.dll do not match actual file [l:14{7}]"fde.dll" :
  Found: {l:32 b:ofJrYBMvfbcRFAtPFwvTqckgU78Xi+9tWAnhLEg79/w=} Expected: {l:32 b:rD8UQlH7wg0krCTlExE3A4g0I9dsTh7xIycF/LkD9Wc=}
2013-09-12 23:08:41, Info                  CSI    00000677 [SR] Could not reproject corrupted file [ml:48{24},l:46{23}]"\??\C:\Windows\SysWOW64"\[l:14{7}]"fde.dll"; source file in store is also corrupted
2013-09-12 23:08:41, Info                  CSI    00000678 Hashes for file member \SystemRoot\WinSxS\x86_microsoft-windows-grouppolicy-gptext_31bf3856ad364e35_6.1.7600.16385_none_372622adf05a6587\gptext.dll do not match actual file [l:20{10}]"gptext.dll" :
  Found: {l:32 b:4R/wpzngnfdc0a94M7qP6Hg+i5N+LV89wlqPbSNLqTs=} Expected: {l:32 b:BsDN+s9AhmnbH9IGM3kEZrPP60pDJbd5sBO9ucrTILY=}
2013-09-12 23:08:41, Info                  CSI    00000679 [SR] Cannot repair member file [l:20{10}]"gptext.dll" of Microsoft-Windows-GroupPolicy-Gptext, Version = 6.1.7600.16385, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch
2013-09-12 23:08:41, Info                  CSI    0000067a [SR] This component was referenced by [l:202{101}]"Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~6.1.7601.17514.WindowsFoundationDelivery"
2013-09-12 23:08:41, Info                  CSI    0000067b Hashes for file member \??\C:\Windows\SysWOW64\gptext.dll do not match actual file [l:20{10}]"gptext.dll" :
  Found: {l:32 b:4R/wpzngnfdc0a94M7qP6Hg+i5N+LV89wlqPbSNLqTs=} Expected: {l:32 b:BsDN+s9AhmnbH9IGM3kEZrPP60pDJbd5sBO9ucrTILY=}
2013-09-12 23:08:41, Info                  CSI    0000067c Hashes for file member \SystemRoot\WinSxS\x86_microsoft-windows-grouppolicy-gptext_31bf3856ad364e35_6.1.7600.16385_none_372622adf05a6587\gptext.dll do not match actual file [l:20{10}]"gptext.dll" :
  Found: {l:32 b:4R/wpzngnfdc0a94M7qP6Hg+i5N+LV89wlqPbSNLqTs=} Expected: {l:32 b:BsDN+s9AhmnbH9IGM3kEZrPP60pDJbd5sBO9ucrTILY=}
2013-09-12 23:08:41, Info                  CSI    0000067d [SR] Could not reproject corrupted file [ml:48{24},l:46{23}]"\??\C:\Windows\SysWOW64"\[l:20{10}]"gptext.dll"; source file in store is also corrupted
2013-09-12 23:08:41, Info                  CSI    0000067e Hashes for file member \SystemRoot\WinSxS\x86_microsoft-windows-g..policy-admin-gpedit_31bf3856ad364e35_6.1.7600.16385_none_ce0882b8c63afdf6\gpedit.dll do not match actual file [l:20{10}]"gpedit.dll" :
  Found: {l:32 b:kr66STTQJj/SGCfMluAmidqauu1XH+iINrNGn3DUoo4=} Expected: {l:32 b:APoyRFs/y8q5FUUUqvnYUu7WNOvG8O1t5PIwVEdODBg=}
2013-09-12 23:08:41, Info                  CSI    0000067f [SR] Cannot repair member file [l:20{10}]"gpedit.dll" of Microsoft-Windows-GroupPolicy-Admin-Gpedit, Version = 6.1.7600.16385, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch
2013-09-12 23:08:41, Info                  CSI    00000680 [SR] This component was referenced by [l:202{101}]"Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~6.1.7601.17514.WindowsFoundationDelivery"
2013-09-12 23:08:41, Info                  CSI    00000681 Hashes for file member \??\C:\Windows\SysWOW64\gpedit.dll do not match actual file [l:20{10}]"gpedit.dll" :
  Found: {l:32 b:kr66STTQJj/SGCfMluAmidqauu1XH+iINrNGn3DUoo4=} Expected: {l:32 b:APoyRFs/y8q5FUUUqvnYUu7WNOvG8O1t5PIwVEdODBg=}
2013-09-12 23:08:41, Info                  CSI    00000682 Hashes for file member \SystemRoot\WinSxS\x86_microsoft-windows-g..policy-admin-gpedit_31bf3856ad364e35_6.1.7600.16385_none_ce0882b8c63afdf6\gpedit.dll do not match actual file [l:20{10}]"gpedit.dll" :
  Found: {l:32 b:kr66STTQJj/SGCfMluAmidqauu1XH+iINrNGn3DUoo4=} Expected: {l:32 b:APoyRFs/y8q5FUUUqvnYUu7WNOvG8O1t5PIwVEdODBg=}
2013-09-12 23:08:41, Info                  CSI    00000683 [SR] Could not reproject corrupted file [ml:48{24},l:46{23}]"\??\C:\Windows\SysWOW64"\[l:20{10}]"gpedit.dll"; source file in store is also corrupted

If you wish to use gpedit then you must pay for the feature, which is only included in Windows 7 Professional and above. I suggest you do a clean install:

https://www.sysnative.com/forums/wi...-install-windows-windows-7-windows-vista.html

Tom

Brick · Sep 14, 2013

Wait so.. i need to do a clean install now? I didn't think installing gpedit would be illegal

tom982 · Sep 14, 2013

Yes, I'm afraid so, as I dread to think what the installer did to your system in order to get gpedit to work on an unsupported OS. If there is a feature in the more expensive flavours of Windows that isn't included in yours, and you have to use a third party tool to make it work, then the chances are that it's illegal!

Brick · Sep 15, 2013

All i did was copy surtain files over from system32 to syswow64

Brick · Sep 15, 2013

Wait nvm, but anyway i'm not gonna go a clean install, got to much stuff to re-download if i do

Brick · Oct 10, 2013

can i get any more help or do i just have to do a system restore?

tom982 · Oct 10, 2013

Yes, System Restore would be your best bet :)

Tom

Brick · Oct 30, 2013

I have done a Repair Install of windows. sfc /scannow shows nothing but the .net framework 4 is still failing to install with error code 643

Machiavelli · Oct 30, 2013

Take a quick look from here: Error codes ?0x80070643? or ?0x643? occur when you install the .NET Framework updates and report back if the problem is solved now.

Brick · Oct 30, 2013

Unfortunately i had allready tried that multiple times but it is entirely useless, i fixed it though by doing a complete uninstall on .net framework 4 via a .net complete removal tool and then was able to install all but one ofthe update after re-installing .net framework 4. I think i have found a fix for that update, waiting for it to install as i speak

Machiavelli · Oct 30, 2013

I didn't take a read over the whole Thread ... but you said in your first post that you removed the Malware with several AntiMalwareScanners - are you sure the Malware is gone? In the Security Arena of the Forum can somebody look over your PC if the issues doesn't go away.

Brick · Oct 30, 2013

Yeah i'm sure, anyway that final update installed but thanks anyway :)

Machiavelli · Oct 30, 2013

OK and no problem! :)

Corrupt Files After Virus

Brick

Active member

Brick

Active member

Attachments

Brick

Active member

Attachments

Brick

Active member

Attachments

tom982

Emeritus

Brick

Active member

tom982

Emeritus

Brick

Active member

Brick

Active member

Brick

Active member

tom982

Emeritus

Brick

Active member

Machiavelli

Security Analyst

Brick

Active member

Machiavelli

Security Analyst

Brick

Active member

Machiavelli

Security Analyst