After removing malware from this one Vista computer, we had several corrupt drivers (PEauth.sys, processor, and chipset).  Poking around in the removal logs, I found WDF01000.sys had been removed.  I ran SFC and it threw back an error about the replacement file in the store being corrupt too.  So I found a good copy of wdf01000.sys from another vista box, and replaced the file in %windir%system32Drivers with the know good file.  SFC still refused to accept the file as being good.  Looking in the driver store, the actually file was missing, therefore I copied the known good file into the driver store too.  

This fixed all the problems in SFC, but still did not fix the problems in Device Manager (error code 34, if I remember correctly).  After spending, what felt like days, examining files and registry keys, I realized the service information for the driver was missing from the registry.  After exporting a copy of the driver info from another Vista box, and importing the registry information, everything appeared correct.  I rebooted the unit, and all the drivers started up correctly, and the PS/2 mouse and keyboard started working again.  

 

Here is a link (http://www.box.com/s/8464f244b4748b850d0b) to the copy of the WD01000.sys registry file — it was made for Vista x86, but should work on Windows 7 x86/x64, and Vista x64. 

Advertisements