[SOLVED] SFC Unable to Remove GPEDIT Leftovers

[hateburn]

Hi there. Upon being unable to figure out how to write my own SFCFix script, I'm finally posting before I unintentionally ruin my system.

I'm running Windows 8.1 on my laptop here, and my buddy sends me some files to tell me I can turn off my Windows QoS, increase my network speed, etc. I say that's okay, whatever.

After installing the files, I learn that it's indeed illegal to do so! I went ahead and uninstalled the file from my Programs and Features, but the files still remain, and deleting them seems to do nothing.

It shows on SFC as corrupt files, and obviously DISM is unable to download from Windows Update the correct files, since it's unavailable!

I apologize for my ignorance. I'm sure it's not common knowledge, knowing how to make a SFCFix script, since I can't seem to find any documentation on these forums or on Google anywhere!

I'm attaching my logs.

View attachment CBS.zip
View attachment SFCFix.txt


Maybe somewhere else I can find assistance turning my Indexing back on...

 

[Go The Power]

Hello hateburn and welcome to Sysnative :)

Before we get started on working on fix. What Edition of windows do you have? Did you also install a program for GPEDIT? I can see that the files are corrupt just trying to work out if they are meant to be there or not :).

If you dont know what version of Windows you are running open up Command prompt and copy and paste in the following:
systeminfo | findstr /B /C:"OS Name" /C:"System Type"

 

[hateburn]

The version is Windows 8.1. The edition is not professional. I guess I don't know what it's called. If I hadn't had to reinstall TeamViewer because of a refresh, I would look now, but I cannot from my work. They are most definitely not supposed to be there. I was sent a program that appeared to install the files, and showed up in the removable programs list. I uninstalled it a while ago. I attempted to remove the files sfc listed as corrupted and that dism couldn't find a source for, but obviously that doesn't work like that.

I did end up doing a refresh. Sad to say that I was losing stability on my machine, since indexing, prefetching, and superfetch were also disabled via advice I took, and I was unable to restart the majority of those services without refreshing.

I do appreciate the reply, and I really would like to know if it's secret knowledge to write scripts for sfcfix. I'd love to see what the script would be for this situation, and if there's any documentation available. As far as I can tell, I could not find anything.

tl;dr I refreshed, it's fixed, please teach me your ways?

 

[Go The Power]

As this version of Windows 8.1 is not Pro GPEDIT is not supposed to be on the system. as the files are not meant to be there then it would of been a case of a reverse engineering to remove the files from your machine. If you still have the installer can you please send me a private message with the installer? or a link to the installer? I would like to install this on one of my test machines to take a look at it.

The script for this sort of issue would not of been a lot different to the ones we normally use on the forums. We would of been focusing on finding what system\registry files were modified\added your system to get gpedit to work. Then it would of been a case of repairing the files it modified and removing the ones that are not supposed to be there.

The reason why there is no documentation available online for SFCFix and constructing SFCFix Scripts, is if the scripts were used incorrectly and replaced the wrong files it could cause the OS to fall over. This was done to ensure that the users of SFCFix will not damage there machine if used incorrectly, its just a safety precaution :)

 

[hateburn]

I know that it's not Pro, and I know GPEDIT is not supposed to be on there, as of recently and henceforth why I posted.

I do not have a copy of the installer. It was sent over Skype File Share, and I cannot ask for another copy.

I did try and pick apart a few scripts I had found, and I even ended up asking for a copy of the same exact script I would have needed, and was absolutely refused, which is understandable.

I just wish this information wasn't a secret. I would have loved to fix my own problems like I usually do. I did search for and remove the files listed in the cbs.log, and looked for them in the registry, and sfc still listed them as corrupt. I'm guessing it's deeper than that somehow. Oh well. Still, understandable about safety. Thanks for your help.

 

[tom982]

Alex the only one I'm aware of is this: Add GPEDIT.msc by Drudger on deviantART

I extracted the setup and here's the installation script:

@echo off
echo x86
takeown /f %WinDir%\System32\gpedit.dll
icacls %WinDir%\System32\gpedit.dll /grant:r %username%:f
takeown /f %WinDir%\System32\fde.dll
icacls %WinDir%\System32\fde.dll /grant:r %username%:f
takeown /f %WinDir%\System32\gptext.dll
icacls %WinDir%\System32\gptext.dll /grant:r %username%:f
echo.
echo.

takeown /f %WinDir%\System32\appmgr.dll
icacls %WinDir%\System32\appmgr.dll /grant:r %username%:f
takeown /f %WinDir%\System32\fdeploy.dll
icacls %WinDir%\System32\fdeploy.dll /grant:r %username%:f

IF NOT EXIST %WinDir%\System32\GPBAK\NUL MKDIR %WinDir%\System32\GPBAK
takeown /f %WinDir%\System32\GPBAK\*
icacls %WinDir%\System32\GPBAK\* /grant:r %username%:f

IF EXIST %WinDir%\System32\gpedit.dll copy %WinDir%\System32\gpedit.dll %WinDir%\System32\GPBAK\gpedit.dll
IF EXIST %WinDir%\System32\fde.dll copy %WinDir%\System32\fde.dll %WinDir%\System32\GPBAK\fde.dll
IF EXIST %WinDir%\System32\gptext.dll copy %WinDir%\System32\gptext.dll %WinDir%\System32\GPBAK\gptext.dll
IF EXIST %WinDir%\System32\appmgr.dll copy %WinDir%\System32\appmgr.dll %WinDir%\System32\GPBAK\appmgr.dll
IF EXIST %WinDir%\System32\fdeploy.dll copy %WinDir%\System32\fdeploy.dll %WinDir%\System32\GPBAK\fdeploy.dll
IF EXIST %WinDir%\System32\gpedit.msc copy %WinDir%\System32\gpedit.msc %WinDir%\System32\GPBAK\gpedit.msc

copy gpedit.dll %WinDir%\System32\gpedit.dll
copy fde.dll %WinDir%\System32\fde.dll
copy gptext.dll %WinDir%\System32\gptext.dll
copy appmgr.dll %WinDir%\System32\appmgr.dll
copy fdeploy.dll %WinDir%\System32\fdeploy.dll
copy gpedit.msc %WinDir%\System32\gpedit.msc

IF NOT EXIST %WinDir%\System32\GroupPolicy\NUL MKDIR %WinDir%\System32\GroupPolicy
IF NOT EXIST %WinDir%\System32\GroupPolicy\adm\NUL MKDIR %WinDir%\System32\GroupPolicy\adm

copy system.adm %WinDir%\System32\GroupPolicy\Adm\system.adm
copy inetres.adm %WinDir%\System32\GroupPolicy\Adm\inetres.adm
copy conf.adm %WinDir%\System32\GroupPolicy\Adm\conf.adm
copy wmplayer.adm %WinDir%\System32\GroupPolicy\Adm\wmplayer.adm
copy wuau.adm %WinDir%\System32\GroupPolicy\Adm\wuau.adm

regsvr32 /s %WinDir%\System32\gpedit.dll
regsvr32 /s %WinDir%\System32\fde.dll
regsvr32 /s %WinDir%\System32\gptext.dll
regsvr32 /s %WinDir%\System32\appmgr.dll
regsvr32 /s %WinDir%\System32\fdeploy.dll

Doesn't look too intrusive :)