glnz

Heinoganda- thanks. Yes, I'm using Avast. However, this time I turned it off before installing pCloud, but explorer froze again, and I got a BSOD when restarting. However, you have just proven that it's not the POS hack. Too bad for me - frustrating. Thanks for testing - much obliged.

Team MSFN - I tried twice to install pCloud on my XP machine and it crashed explorer.exe both times. Uninstalled both times. Is there any chance that the POS updates might somehow interfere with it? I wanted to try pCloud because I need a replacement for the free versions of Cubby and SugarSync, both of which were discontinued. They gave me PC-to-PC Immediate Folder Sync over the web (as well as a cloud-related "drive"). Thanks.

CRK: You quoted w2k4eva as follows, and I add my answers here: To dencorso and glnz, could you both check what account is the owner of the folders: C:\Documents and Settings\Default User -- Administrators C:\Documents and Settings\Local Service -- Administrators C:\Documents and Settings\Network Service -- Administrators C:\Documents and Settings\ (your account name) -- Administrators Mine are all owned by the "Administators" group, I'm thinking that glnz may have this too but perhaps dencorso does not? -- Yes for glnz Also could you both open a cmd prompt and type cd c:\Documents and Settings cacls "Default User" > perms.txt cacls LocalService >> perms.txt cacls NetworkService >> perms.txt cacls (your account name) >> perms.txt then paste the contents of perms.txt here? C:\Documents and Settings\Default User NT AUTHORITY\SYSTEM:(OI)(CI)F BUILTIN\Administrators:(OI)(CI)F BUILTIN\Users:R BUILTIN\Users:(OI)(CI)(IO)(special access:) GENERIC_READ GENERIC_EXECUTE BUILTIN\Power Users:R BUILTIN\Power Users:(OI)(CI)(IO)(special access:) GENERIC_READ GENERIC_EXECUTE Everyone:R Everyone:(OI)(CI)(IO)(special access:) GENERIC_READ GENERIC_EXECUTE C:\Documents and Settings\LocalService NT AUTHORITY\LOCAL SERVICE:F NT AUTHORITY\SYSTEM:F BUILTIN\Administrators:F NT AUTHORITY\LOCAL SERVICE:(OI)(CI)(IO)F NT AUTHORITY\SYSTEM:(OI)(CI)(IO)F BUILTIN\Administrators:(OI)(CI)(IO)F C:\Documents and Settings\NetworkService NT AUTHORITY\NETWORK SERVICE:F NT AUTHORITY\SYSTEM:F BUILTIN\Administrators:F NT AUTHORITY\NETWORK SERVICE:(OI)(CI)(IO)F NT AUTHORITY\SYSTEM:(OI)(CI)(IO)F BUILTIN\Administrators:(OI)(CI)(IO)F C:\Documents and Settings\[my name] DELLOPTIPLEX755\[my name]:F NT AUTHORITY\SYSTEM:F BUILTIN\Administrators:F DELLOPTIPLEX755\[my name]:(OI)(CI)(IO)F NT AUTHORITY\SYSTEM:(OI)(CI)(IO)F BUILTIN\Administrators:(OI)(CI)(IO)F But I've forgotten what this means. Will Hillary win the election?

dencorso and jaclaz - well, using TIdo.cmd to start both regedit and regscanner64 running as TI, I manually changed Permissions in 67± registry keys to give Full Control for SYSTEM. Then I did an "Online Repair" of Office 2016 through O365, which looks just like a re-installation. Unfortunately, I still got 99 Warnings that Protected Registry Keys could not be changed. A group of 58 Warnings at 5:20pm and a group of 41 Warnings at 5:48pm, probably these being the start and end of the re-installation process. And I can see that at least some of these Warnings are the same keys that I changed -- and they still show SYSTEM with Full Control. Well, as far as I can tell, Office works, so I surrender. Thanks, however, for the TIdo.cmd process, which definitely let me skip the steps of manually changing Owner on each key (and changing it back). Both regedit and regscanner64 thought I was Trusted Installer, and F8 in regscanner64 did indeed take me to keys in regedit (which still thought I was TI) to make changes to Permissions without having to change Owner.

HOLD ON - I'M EDITING BELOW Gents - all good advice as always. My emails back to 2008 are the only reason I'm holding on to my XP machine with OE6 anyway. Time to plan a migration to my better dual-booting Win 7 - 10 machine - to put an email client on both parts and somehow move my old emails there. But I think it won't be easy, especially as I would like both parts of the machine to look at the same email databases on a second drive and keep current with each other. Just FYI - I got a security alert email yesterday from Chase Bank that led me to call them. Straightened everything out - no problem - but the security emails from Chase generate this new warning about ActiveX when I try to view them: And I have also attached a Word doc with screenshots from Natural Rug email's original error message from a few days ago that I described above. EDIT - I am also attaching the der .cer file from the Natural Rug email - I opened it in notepad and it's in Chinese !!! Is that normal ??? We've ordered from that company before and they're here in the US. Thanks !! Natural Rug certificate error messages 2-2-17.doc Natural Rugs DER info.cer

EDITED AT BOTTOM dencorso - I haven't looked at more than a few keys. On most, as to Permissions, TI has Full Control, and other user accounts have only "Read" permissions. I'm certainly going to leave TI with "Full Control" but will also give "Full Control" to System and -- not sure -- Administrators ? But then, if the Owner is TI, I'd prefer to leave it that way. Unless you think I should move Owner to a different user account? And, per your "Yes", I hope that going first to TIdo.cmd and running regedit from there will let me skip the steps of changing Owner in order to change Permissions. I'm going to to have to do this manually, so the fewer steps , the better. I'll let you know when I get a chance to dive in. EDIT - I used regscanner64 to search for the keys and (using CTRL+k and then paste) to make a manual list of the keys in a notepad .txt file, as the EventViewer Warning message did not give complete key names. And regscanner 64 is faster than regedit to get around. But if I right-click on a regscanner64 search result line to go to that key in regedit, I won't be in TI anymore. Is there a way to run both regedit and regscanner64 in the same TI bubble? Or does regscanner64 have a secret step that works directly on the registry (in this case as TI) without going to regedit? Thanks.

dencorso - From fixing other errors, I learned a tiny bit about Ownership and Permissions. It seems I should change the Permissions on the 67± registry keys so that System or Administrators (or maybe Everyone) has "Full Control", and then reinstall O365. However, to change Permissions, I would first need to change Ownership of each key to Administrators and then change it back to whatever it was - usually Trusted Installer. But -- if I run regedit from TI.cmd, could I skip the two "change Ownership" steps because regedit thinks I'm Trusted Installer? (I would still need to change the Permissions on each key manually.) Does that sound right? Thanks.

Gents - I'll get back to you shortly with more screenshots from this certificate error. Meanwhile, I just found this in my Event Viewer on my XP machine - and it seems to have been an automatic thing - not done by me manually: So - is my PC updating certificates automatically, without my running Heinoganda's Cert_Updater? Thanks.

Unless he smokes the Gauloises. I did notice that the TrustedInstaller.exe process in Task Manager disappeared about 2/3 of the way through the lengthy installation, but the OfficeClickToRun processes had been running for some time, so I doubt that's the issue. I do have a list of the keys and can probably change their permissions manually to give Full Control to ... what? System? Everyone? (Hey, if I run regedit from the TIcmd window, will I need to change Owner to add the Permissions?)

Well, guys, thanks very much for help and teaching me something new. The new install of O365 Home again triggered 69 Warnings about not being able to change Protected Registry Keys. Maybe instead of installing as Trusted Installer, can we install as Donald Trump?

jaclaz - thanks. FYI, right now, from my day office, when I clicked on your link for RunAsTI.exe, the Symantec security gave me a warning: Anyway, dencorso's two RunAs items do work through steps 1 - 7 in my email above. I haven't yet run the O365 installation. But it sounds like I'm not missing anything in the steps above.

dencorso - PRELIMINARY: I followed your links and their links and saw that the brilliant jschicht combined the two commands as a single RunAsTI on github at > RunAsTi < . UNFORTUNATELY, even though I'm signed in to github, I cannot download his files. I get error messages that the server won't connect or (occasionally) that the files aren't complete on the server. SO, I shall follow your instructions, which seem very promising. NOW: Let's see if I actually understand your instructions, as I am only a notary public who types love letters for friends, not a code wizard like yourself and everyone on MSFN. By the way, I did a full Macrium Reflect backup of my entire hard drive earlier today - just in case. 1) From the links you gave (not github), I have downloaded RunasSystem_v1.0.0.3.zip and RunFromToken_v1.0.0.2.zip, and using 7-zip I have now extracted both as sub-folders in my Downloads folder. Each folder has the pseudonymous files - *.exe, *.au3 and *64.exe, all of whose last modified dates are 10/3/2012. 2) I will copy all six files into C:\Windows\System32 because that folder also includes both cmd.exe and net.exe (I checked). 3) On my desktop, I will make a new file called TIdo.cmd. In it I will insert the lines and save. 4) I will move TIdo.cmd into C:\Windows\System32 ... because that's where the party is !! 5) I will right-click TIdo.cmd and select Run as administrator. 6) A black cmd window will open up and it will say C:\Windows\System32> 7) Now, let's take a break, light a Gauloise and be morbidly philosophical like Michel Houellebecq: what if I type whoami? (French coders hit that one 15 times a day.) Normally, I see my computer-name\glnz. If TIdo.cmd is working, I should see nt authority\system, yes? (I checked already, and, yes, these steps 1 - 7 give me nt authority\system. Zut, alors!) Interesting!! Do you think that might be enough to overcome the 67± protected registry keys? I understand (from other posts here on MSFN and on 7Forum) that "nt authority\system" is the same as "SYSTEM" in the Permissions change windows, yes? Will that truly be as high and mighty as Trusted Installer? I suppose we shall see. I ask because (if I remember correctly) in a few of the protected keys, System does not have Full Control permission !!! 8) At this point, before taking the plunge, I should turn off my anti-virus, etc. 9) In this TIdo-created new cmd window, I now type pushd C:\Users\glnz\Downloads\O365HomePremRetailExtracted\Office <Enter> I should then see C:\Users\glnz\Downloads\O365HomePremRetailExtracted\Office\> and I should then type Setup64<Enter> 9) O365 should now install, and that takes quite some time. I might have to identify myself (for the 45th time). When it's all over, I'll see what's what in Event Viewer and let you know whether those 67± Warnings returned. 10) If the TIdo-created cmd window is still open after all the above is finished, I can just type exit, yes? I don't have to type popd, do I? 11) If everything has settled down but if Trusted Installer is still showing in my Task Manager, I can manually End Process it, yes? Do you think I've missed anything? Is there anything that could further strengthen the O365 installation? Merci mille et un fois !!!

Gents - thanks for looking out for me. MSFN always feel like ... family !!! I always intended to make a complete disk backup first, using Macrium Reflect free. Everything. Not to worry. And as it turns out, my wife has more important things for me this weekend anyway. So much for hobbies. FYI - Everything is currently actually working, and it's UEFI, but Secure Boot is turned off and some legacy something is turned on in the Dell Optiplex 7010 MT BIOS settings. (Legacy ROMs?)

To all - My Dell Optiplex 7010 MT dual-boots Win 7 Pro 64-bit and Win 10 Pro 64-bit. Because I have nothing better to do with my time, I might do a "non-destructive repair" of ONLY the Win 7 Pro 64-bit, but only if I can figure out how to do that without ruining my dual-boot. That's the big question - how do I do it while retaining the Win 10 partition and the other hidden boot-load/MBR partitions I have for the dual-booting? And I've been doing some reading about "non-destructive repair" if I end up trying it. There are some other possible issues before I even get started: First - I've succeeded in downloading a Win 7 Pro 64-bit img file from Heidoc.net Win Download Tool, but that source and some other folks warn that, on my Dell system, I might need the "COEM" version and not the plain version. What do you think? My machine is a Dell Optiplex 7010 Mini-Tower, and I originally installed the Win 7 from an extra Dell CD that Dell was kind enough to send me (not from a plain vanilla Microsoft CD). Second - before I do anything with the Win 7 Pro 64-bit img file, should I first try to use NTLite (for the first time ever) to integrate into the Win 7 Pro 64-bit img file the updates that Ed Bott recommends at Four steps to reduce the pain of Windows 7 installations using cumulative updates - Tech Pro Research ? Third - if your answer to "Second" is yes, please note how Ed recommends first installing KB3020369: April 2015 Servicing Stack Update for Windows 7 and Windows Server 2008 R2 and then installing his others. I've never used NTLite, but I'm guessing it doesn't work in stages (or does it)? How do I do things in the order Ed Bott recommends? Thanks !!!

Heinoganda - I run your cert_updater from time to time on my XP. The latest cert updates are still November 2016. But in my incoming emails, I now get certificate warnings from time to time, when I never got them up to a year ago. For example, I receive promo emails from Natural Area Rugs, from whom I've bought a few small floor rugs over the years, and now a Certificate Warning pops up. See attachment here. Similarly for emails from UPS.com that originate in their office in Thailand, which handles shipments for my wife's business. Those are not promo emails; I frequently respond to their emails, a few times per month. (FYI - my emails come in on Outlook Express 6, and my many old emails on OE6 are why I want to keep my XP machine running.) Are we sure the Cert_updater is getting good lists of current certificates? I'm sure it's working, but is it reaching for the right source data? Thanks.

dencorso - many thanks for what might be a great shortcut. And of course my friends would NEVER accuse me of looking a gift horse in the mouth. But some Qs: 1) To run the re-install of O365 Home 64-bit, it looks like I should be running C:\Users\glnz\Downloads\O365HomePremRetail(1).img\Office\Setup64.exe. Or maybe I first use 7-Zip to extract that img archive into a new folder so it would be something like C:\Users\glnz\Downloads\O365HomePremRetailExtracted\Office\Setup64.exe So, when I get the cmd box with TI credentials, will I be able to specify either path? I would guess yes, but just to confirm. 2) If I re-install "as the TI," will later automatic updates to Word and Excel be able to run, or will they be blocked because now my PC thinks that EVERYTHING in Office is TI only, and so non-TI updates are barred at the airport? FYI - As far as I can tell, I've only had the 67 ± Warnings of protected registry keys for Click-to-Run (sometimes called C2R) and "ink" aspects of O365, not the other basic aspects of Office (but of course don't know that 100%), and I get those Warnings on each update as well as on each re-install. If I install as TI, maybe I won't get those 67 Warnings, but will I get 103,587 Warnings on the next automatic update? 3) If I install "as TI", will it later be impossible to uninstall? 4) Can I get a "TI" badge? Thanks.

I am going to manually change Permissions in every one of the 67 ± keys that throw up a Warning that such key is protected, to permit changes by SYSTEM (I think), and then reinstall O365 Home 64-bit. However, the Event Viewer Warnings don't give the complete key names, so I am using nirsoft's Regscanner to find each key by searching for the part of the key shown in the Event Viewer Warning. Problem is that for each key name-fragment shown in Event Viewer, there can be many keys. Another problem is that Regscanner sometimes lists the same key twice - once showing type REG_EXPAND_SZ with no Name, and second showing type REG_SZ and Name ThreadingModel. But it's the same key with two pieces of data in it. So, when I change its permissions, is this one key or somehow two keys? Now, a dumber question: If I change First ownership and Second permissions and Third change ownership back in a key that starts with HKEY_CLASSES_ROOT or HKCR, will that automatically change the ownership and permissions in the matching key that starts with HKEY_LOCAL_MACHINE or HKLM ? Finally, take a look at my post in TenForums >HERE< , which has links to an interesting powershell program higher in that thread that might help me and to my two posts in MS forums - would love to have your thoughts. Thanks.

Hey Heinoganda and maybe harkaz ? -- I still use your Cert_Updater.exe from time to time on my XP. (By the way, its Modified Date is 2-16-16, so I hope it's still good.) Please take a look at this article on ArsTehnica: http://arstechnica.com/security/2017/01/already-on-probation-symantec-issues-more-illegit-https-certificates/ Given the dates in the article for the bad TLS certificates and the dates I see when I run Cert_Updater.exe (some 2015 and some Nov 2016), I don't think that Cert_Updater.exe is protecting against the bad TLS certificates in the Ars article. What do you think? Happy Trump New Year, and thanks again!

Dear Mathwiz - I just realized your post above at [Link to comment=1133576] quoted my post of a year ago. I still have the install file WindowsXP-KB955704-x86-ENU.exe . It's 3,324 KB. I put it in my OneDrive - try this OneDrive link - https://1drv.ms/u/s!ArpWuno4XUAMgRgqMK0ndGBrBv58

I ask the title question because Ask Woody is still at defcon 2. What do you all think? Woops - I'm in the wrong topic. Am I able to move this to Win 7?

Penpals everywhere - all 9 are good. Merry Christmas and Happy New Year !!!

heinoganda and dencorso - thanks. heinoganda - you wrote "Make sure the MSI 4.5 (KB942288-v3) is installed!". Sorry, how do I do that? If it's not installed, what should I do? And you are right about svchost.exe - it ran 50% of my CPU for a long time last night, but I let it go. It's not doing that now. It seems that XP is finally becoming more vulnerable, now that POS is no longer included in certain .NET updates or mrt. I no longer do any banking or similar on mine. In my neighborhood in NYC, a very nice houseware and hardware store suddenly closed - Gracious Home. It's the only place I know personally that used XP POS terminals. Maybe our days are numbered.

Ok, penpals who speak English, French, Portuguese, Spanish, Italian, Catalan, German, Japanese and Esperanto -- I count nine (9) updates, including a few for Office 2003+2007. Before I try, are there any 재해 災難 взрывы or ריחות רעים ??

XP fans - little by little the usability of my trusty XP Optiplex 755 is whittled away. The most recent loss was the free 5GB of Cubby, which I used both (a) to back up and (b) to sync across some different PCs a bunch of small business files. In turn, Cubby had replaced the free 5GB of SugarSync. Both gone. So, what should I use for free that will both back up designated folders AND sync them across a bunch of different PCs, starting with folders on my XP but syncing them with the same folders on a few Win 7s? The nice thing about Cubby and (before that) SugarSync was that all I needed to do was right-click the folder (wherever it is) and designate it to start backing up/syncing in the program. No need to move the folder into a fake "drive". And even in a fake "drive" like OneDrive, it just won't run on XP. I know this is off-topic a bit, so please just point me in right direction. Or soon these machines will just be attractive table ornaments. Thanks.

Today, in my Optiplex 780 Desktop with Win 7 Pro 64-bit and 8GB RAM, I cloned my hard drive from old drive to new drive. To do that, I went into BIOS (which is the A14 version), went to Drives, enabled SATA2, and plugged the new empty hard drive into the SATA2 socket on the motherboard. The original drive has always been in the SATA0 socket, and the CD-DVD has always been in the SATA1 socket. The clone went well (using Macrium Reflect Free in a USB stick). When I took out the old drive and connected the new cloned drive to the original SATA0 socket, the Optiplex gave me errors on the reboot. It said it was missing a drive in SATA2 and did i want to Continue, go into System or run Diagnostics. After a few reboots with that error, I went back into BIOS - Drives and disabled SATA2. Then reboot went very well without errors, a few times. All good. However, those errors aren't right. I should be able to enable SATA2 in BIOS and not get errors just because no actual drive is plugged into the SATA2 socket on the motherboard. (That's how it works in a different Dell Optiplex 3010 I have). So what's going on? Why am I getting this error? (By the way, the old drive was a 10-year old Maxtor 500GB, and the new drive is a Seagate Firecuda ST1000DX002. Do you think the SATA2 socket fell so in love with the Firecuda that it just can't let go?) Thanks. \ /