Solved BSOD after avast anti virus scan need help replacing Windows 7 files

[Abonafide]

So I ran avast and it found a virus in the windows files and I deleted it so I ran sfc /scannow and this is what I'm missing View attachment 392375 I don't know how to replace them yet or where to find them. I have Windows 7 Professional 64bit and I can't find the disc at the moment. I'd really appreciate any and all help because I do NOT want a clean install, thank you for even taking your time to read this.

 

[BorisTheAnimal]

Hello Abonafide and welcome to 7 Forums!

I would recommend that you uninstall Avira:

Avast Uninstall Utility

and replace it with MSE:

MSE

And the file that the sfc /scannow found and couldn't repair is pkeyconfig.xrm-ms which is the Windows 7 activation file.

Please run this tool:

Windows Genuine and Activation Issue Posting Instructions

Cheers, Boris

 

[Abonafide]

Diagnostic Report (1.9.0027.0):
-----------------------------------------
Windows Validation Data-->

Validation Code: 0
Cached Online Validation Code: N/A, hr = 0x8007043c
Windows Product Key: *****-*****-J8D7P-XQJJ2-GPDD4
Windows Product Key Hash: xgsndMkYdJsYmUng0qIJ/thx+HI=
Windows Product ID: 00371-868-0000007-85808
Windows Product ID Type: 1
Windows License Type: KMS Client
Windows OS version: 6.1.7601.2.00010100.1.0.048
ID: {07D48E2D-1B11-4C76-9C53-A5040403E450}(3)
Is Admin: Yes
TestCab: 0x0
LegitcheckControl ActiveX: N/A, hr = 0x80070002
Signed By: N/A, hr = 0x80070002
Product Name: Windows 7 Professional
Architecture: 0x00000009
Build lab: 7601.win7sp1_ldr.160902-0600
TTS Error: 
Validation Diagnostic: 
Resolution Status: N/A

Vista WgaER Data-->
ThreatID(s): N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002

Windows XP Notifications Data-->
Cached Result: N/A, hr = 0x80070002
File Exists: No
Version: N/A, hr = 0x80070002
WgaTray.exe Signed By: N/A, hr = 0x80070002
WgaLogon.dll Signed By: N/A, hr = 0x80070002

OGA Notifications Data-->
Cached Result: N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
OGAExec.exe Signed By: N/A, hr = 0x80070002
OGAAddin.dll Signed By: N/A, hr = 0x80070002

OGA Data-->
Office Status: 109 N/A
OGA Version: N/A, 0x80070002
Signed By: N/A, hr = 0x80070002
Office Diagnostics: 025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3

Browser Data-->
Proxy settings: N/A
User Agent: Mozilla/4.0 (compatible; MSIE; Win32)
Default Browser: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
Download signed ActiveX controls: Prompt
Download unsigned ActiveX controls: Disabled
Run ActiveX controls and plug-ins: Allowed
Initialize and script ActiveX controls not marked as safe: Disabled
Allow scripting of Internet Explorer Webbrowser control: Disabled
Active scripting: Allowed
Script ActiveX controls marked as safe for scripting: Allowed

File Scan Data-->

Other data-->
Office Details: <GenuineResults><MachineData><UGUID>{07D48E2D-1B11-4C76-9C53-A5040403E450}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7601.2.00010100.1.0.048</OS><Architecture>x64</Architecture><PKey>*****-*****-*****-*****-GPDD4</PKey><PID>00371-868-0000007-85808</PID><PIDType>1</PIDType><SID>S-1-5-21-521315532-3645877554-3813421559</SID><SYSTEM><Manufacturer>ASUS</Manufacturer><Model>All Series</Model></SYSTEM><BIOS><Manufacturer>American Megatrends Inc.</Manufacturer><Version>2205</Version><SMBIOSVersion major="2" minor="8"/><Date>20150212000000.000000+000</Date></BIOS><HWID>7AF33F07018400F4</HWID><UserLCID>0409</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>Eastern Standard Time(GMT-05:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM/><GANotification/></MachineData><Software><Office><Result>109</Result><Products/><Applications/></Office></Software></GenuineResults>  

Spsys.log Content: 0x80070002

Licensing Data-->
On a computer running Microsoft Windows non-core edition, run 'slui.exe 0x2a 0x8007043C' to display the error text.
Error: 0x8007043C 

Windows Activation Technologies-->
HrOffline: 0x00000000
HrOnline: 0x00000000
HealthStatus: 0x0000000000000000
Event Time Stamp: 7:3:2016 06:30
ActiveX: Registered, Version: 7.1.7600.16395
Admin Service: Not Registered - 0x8007043c
HealthStatus Bitmask Output:


HWID Data-->
HWID Hash Current: NAAAAAEAAQABAAEAAQADAAAAAwABAAEAhFEWleqWrA789lT4POASxZwq+nUQXFJf3FjI9g==

OEM Activation 1.0 Data-->
N/A

OEM Activation 2.0 Data-->
BIOS valid for OA 2.0: yes, but no SLIC table
Windows marker version: N/A
OEMID and OEMTableID Consistent: N/A
BIOS Information: 
  ACPI Table Name	OEMID Value	OEMTableID Value
  APIC			ALASKA		A M I
  FACP			ALASKA		A M I
  HPET			ALASKA		A M I
  MCFG			ALASKA		A M I
  FPDT			ALASKA		A M I
  SSDT			Ther_R		Ther_Rvp
  SSDT			Ther_R		Ther_Rvp
  SSDT			Ther_R		Ther_Rvp
  SSDT			Ther_R		Ther_Rvp
  SSDT			Ther_R		Ther_Rvp
  UEFI			ALASKA		A M I

 

[Abonafide]

Hello Abonafide and welcome to 7 Forums!

I would recommend that you uninstall Avira:

Avast Uninstall Utility

and replace it with MSE:

MSE

And the file that the sfc /scannow found and couldn't repair is pkeyconfig.xrm-ms which is the Windows 7 activation file.

Please run this tool:

Windows Genuine and Activation Issue Posting Instructions

Cheers, Boris

Also, thank you for taking out the time to help me, thank you very much. I'm talking to you through safe mode right now.

 

[BorisTheAnimal]

Okay.

It looks to be okay.

Could you please read through and run the tool in here:

Blue Screen of Death (BSOD) Posting Instructions

Cheers, Boris

 

[Abonafide]

Ok, here it is. View attachment 392414

 

[torchwood]

Hi Abonafide,

Your system IS currently infected by NeshtaB.,
downloaded from
W7-CyborgGamer-MrGamer, from 4 sept or earlier, so any restore points after this date are useless

IT IS STILL ON YOUR SYSTEM.
(showing in your event log)
MSE keeps identify it and tries to remove it

please run the following and report any Failed

Start > Run type in %WINDIR% and it will go to your windows folder. Then find a folder called Debug and within will be a file msert.log. Open this with Notepad and search for 'failed'. This will provide you with a list of files that did not clean properly.


This is an insidious little devil,
your BEST course of action is a CLEAN install.


As for the Mga report, it gives some info but its not complete as you ran it in Safe mode.

What it has told me is that the version you are using is NON standard.
The install is/was volume activated, either via your company or College, if not then you will have to purchase a new copy of W7

Roy

 

[Abonafide]

So should I just give up and do a clean install? ;/

 

[torchwood]

MOST DEFINATELY

That virus changes .exe programs and most AV's then remove the file,
(MSE is a bit more selective and tries to repair them)
Unfortunately the files it takes aim at, are vital to the system, and as you have found.


Roy

 

[Abonafide]

Well, I just backed up everything and did a clean install, thank you torchwood and BorisTheAnimal for trying to save my OS, thank you so much, I really appreciate the help you do here, you guys are amazing.