glnz

heinoganda - thank you - my files are 3.1. Is there any danger if I install 4.5 and then re-run KB3072630?

Ok MSFN fans - it's another patch tuesday. Hey - you all jump in first and let me know! I never said I was brave.

w2k4eva - First, I have attached a .txt file with info from the regkeys WITH NOTES I inserted manually with ► or ►►. Some of the regkeys are me, the second user on my PC, and other known user profiles, but there is not a one-for-one correspondence between the "extra" regkeys and the five "Account Unknowns". Second, in C:\Documents and Settings\LocalService, right-click - Properties - Security shows that Administrators, LOCAL SERVICE and SYSTEM have Full Control and in C:\Documents and Settings\NetworkService, the same thing shows that Administrators, NETWORK SERVICE and SYSTEM have Full Control Any thoughts? Thanks. Copy of Profile List 7-12-15.txt

jaclaz - noted, thanks and again please accept my appreciation for your superb forum and your knowledgeable contributors. Just as an example, this is the only thread anywhere that deals intelligently with the POS 2009 updates for XP - nowhere else. That's why I don't want to miss anything!!

Bluebolt - your fix is working on my XP machine! I created a new system restore point, immediately restored to that point, rebooted, and no more error messages. Two or three reboots now. The odd temp folders in Documents and Settings are gone. The folders LocalService and NetworkService in Documents and Settings are showing a "Date Modified" time of my first successful reboot just now. (I recall they were stuck on a January date before.) The only odd thing is that in System Properties - Advanced - User Profiles - Settings, there are still five "Account Unknown"s last modified 6-23-15, each with a size of 20.4MB. (My own profile is 2.86GB, last modified today.) Should I try deleting those "Account Unknown"s? (Where are they on C:\ drive anyway?) Of course, this just might be only cosmetic - what do I know? Is there a deeper level I should check? Thanks! [PS - for some reason, after May 27, I no longer get email alerts whenever someone posts here. But my profile on this forum is to get those alerts. What happened?]

Wow - no thoughts from anyone?

To experts here - and I'm a nerd not a geek so be gentle - I have the following possible issue when I try to AVOID the automatic upgrade from Win 7 to Win 10, and I wonder if you can help. Also, I wonder whether rn10950's removal tool you all discuss at http://www.msfn.org/board/topic/173961-windows-10-gwx-update-removal-tool-for-windows-7-and-windows-81/ will fix this issue: The facts: On three Win 7 SP1 64-bit machines, the Win 10 upgrade icon was NOT showing in the tray. I then uninstalled KB3035583, and that caused all the various files and folders with "GWX" to disappear after maybe 15 minutes. Also, a refresh of Windows Update did NOT re-download KB3035583, and so there was no need (or easy way) to hide it. So, on those three machines, it looks like I am successful in preventing the future upgrade. Good. HOWEVER, on a fourth Win 7 SP1 64-bit machine, the Win 10 upgrade icon was there in the tray. So I first opened its window, went to the hamburger index and found the link to UNreserve the future upgrade. It confirmed it was now UNreserved. I then uninstalled KB3035583. This time, a refresh of Windows Update showed that KB3035583 would be re-downloaded, so I hid it. HOWEVER, the numerous folders and files with GWX are still there. Also, there are a few registry entries with GWX in them. These GWX items are not disappearing as they did on the first three machines. What's the diff? Also, is the fourth machine still going to upgrade in some stealthy manner? Should I run rn10950's removal tool on the fourth machine, and are there any risks? Thanks.

For "#456 w2k4eva Posted 28 May 2015 - 04:55 AM " -- FIRST PART OF THIS POST: w2k4eva - Many thanks again for your time and detail. There's a lot there for me to learn, and given my utter lack of experience in this area, I hesitate to do anything. FYI - I did not do anything - did not try any CACL instructions at all, or anything else. Is there any way I can try to do something without running huge risks? Also, is there an XP version of this very interesting article you suggested: https://support.microsoft.com/en-us/kb/947215 ? Following that article, please see the txt file I have uploaded here. It is a copy of a portion of my registry from what that article discusses - any thoughts? SECOND PART OF THIS POST: w2k4eva - going back to your post #456, you wrote: Sorry for noob question, but how do I "check out NT AUTHORITY\Local Service and NT AUTHORITY\Network Service"? How do I get there? THIRD PART OF THIS POST: Please also see my second attachment "Permissions for LocalService and Network Service", a Word doc with screenshots. I am showing what I see under Properties for three different user folders, and maybe there's a clue somewhere. Thanks. Copy of Part of ProfileList 6-27-15.txt Permissions for LocalService and NetworkService 6-28-15.doc

heinoganda - Thanks for your concern. For what it's worth, speccy shows that everything is OK in my Optiplex 755 running XP Pro SP3. Let's see what happens next month.

heinoganda - for some reason, my earlier download of KB3058515 worked just now, I ran it, and Belarc shows it as installed. Who knows? Thanks.

heinoganda - The MS pages are very slow. Finally downloaded X86-en-ie8-windowsxp-kb3058515-x86-embedded-enu_717559af98d947c349c9165b35e7dc3b7eb124b5.exe but when I try to run it, my machine tells me it's a corrupt file. Has now happened twice. (I have IE 8.) Any thoughts? I think the other one worked - says I completed the setup wizard. (By the way, I am having this problem on my good Dell Optiplex 755 with 4GB RAM. I also have a slow Dell GX 280 with 2GB RAM with XP SP 3 for testing purposes only. ALL the June 9 MS updates have installed without problem. I don't know why my good Dell Optiplex 755 has had the problems with these two KB items.)

heinoganda - thanks. But where do I go to download manually - these two? Also, I am NOT getting emails when someone replies here. But my setting is still to get emails. Any idea? Thanks.

First, to "Security Update for WEPOS and POSReady 2009 (KB3033890) Wednesday, June 24, 2015 Microsoft Update Windows XP Embedded Cumulative Security Update for Internet Explorer 8 for WEPOS and POSReady 2009 (KB3058515) Wednesday, June 24, 2015 Microsoft Update What should I do about that? Can I download and install manually? It seems the posts above are for a version of one of them in a different language. Where would I get these in good ol' American English? Third, I am no longer getting emails from this wonderful forum when someone posts something new here although my settings still call for notification emails. Is it because I'm still jetlagged? Thanks.

Yo, buds - what's happening? Just back from a nice break in South of France and catching up. But first some home movies: Nutty grand dame hotel Le Negresco in Nice is great as a stopping point if you're running around the area as we did. Should be able to get great rates if you dig a bit. Wonderful service. Truly spectacular Grand-Hotel du Cap Ferrat - an experience by itself - can offer some good rates if booked in advance and not in super-high season (which has just started). At the other end of the scale (which at first disorientated us), we took a detour to Southeast Corsica, where rustic Hotel Ambassador Palombaggia has a wonderful owner - Madame Martine - and is one of the few only a walk from the beach. Two good dinners there as well, with a great evening view of Jupiter, Venus and a crescent moon almost kissing. We were sorry we didn't have another day. Now, to what's TRULY IMPORTANT - POS upgrades for XP: So, how are the upgrades offered June 9? Any problems? I'm seeing these: HIGH PRIORITY - Security Update for WEPOS and POSReady 2009 (KB3033890) - Security Update for WEPOS and POSReady 2009 (KB3057839) - Cumulative Security Update for Internet Explorer 8 for WEPOS and POSReady 2009 (KB3058515) - Windows Malicious Software Removal Tool - June 2015 (KB890830) OPTIONAL - Update for WEPOS and POSReady 2009 (KB3065979) - Update for WEPOS and POSReady 2009 (KB3020338) - Update for Skype for Windows desktop 7.0 (KB2876229) ALSO - Are there any new .NET updates to find and install manually? Merci bien!

w2k4eva: First, a word of appreciation for your hard work! I don't understand yet what you've found, but you've clearly spent some time on it and found some smart clues. Many thanks. If I'm hitting the right buttons*, I confirm that C:\Documents and Settings\Default User C:\Documents and Settings\Local Service C:\Documents and Settings\Network Service C:\Documents and Settings\ (your account name) are all "owned" by Administrators (DELLOPTIPLEX755\Administrators). [FYI - DELLOPTIPLEX755 is the name of my XP Pro SP3 computer.] [* On each of the above folders, I did right-click -- Properties -- Security -- Advanced -- Owner. Correct? And you are correct that there is no option shown to change "Owner" to LocalService or NetworkService.] I turned your suggested cmd request into a .bat file, and here are the results: C:\Documents and Settings\Default User NT AUTHORITY\SYSTEM:(OI)(CI)F BUILTIN\Administrators:(OI)(CI)F BUILTIN\Users:R BUILTIN\Users:(OI)(CI)(IO)(special access:) GENERIC_READ GENERIC_EXECUTE BUILTIN\Power Users:R BUILTIN\Power Users:(OI)(CI)(IO)(special access:) GENERIC_READ GENERIC_EXECUTE Everyone:R Everyone:(OI)(CI)(IO)(special access:) GENERIC_READ GENERIC_EXECUTE C:\Documents and Settings\LocalService NT AUTHORITY\LOCAL SERVICE:F NT AUTHORITY\SYSTEM:F BUILTIN\Administrators:F NT AUTHORITY\LOCAL SERVICE:(OI)(CI)(IO)F NT AUTHORITY\SYSTEM:(OI)(CI)(IO)F BUILTIN\Administrators:(OI)(CI)(IO)F C:\Documents and Settings\NetworkService NT AUTHORITY\NETWORK SERVICE:F NT AUTHORITY\SYSTEM:F BUILTIN\Administrators:F NT AUTHORITY\NETWORK SERVICE:(OI)(CI)(IO)F NT AUTHORITY\SYSTEM:(OI)(CI)(IO)F BUILTIN\Administrators:(OI)(CI)(IO)F C:\Documents and Settings\glnz DELLOPTIPLEX755\glnz:F NT AUTHORITY\SYSTEM:F BUILTIN\Administrators:F DELLOPTIPLEX755\glnz:(OI)(CI)(IO)F NT AUTHORITY\SYSTEM:(OI)(CI)(IO)F BUILTIN\Administrators:(OI)(CI)(IO)F I'm not going to try your fix yet. Would like to see first your response to the above and how others are faring. I'm the most noob person posting here (I hope), and it's best for me to watch the experts (such as yourself) first. Ever see Disney's "The Sorcerer's Apprentice"?

To all: My Add-or-Remove Programs and Belarc don't show ANY of the .NET 1.1 updates on wlu-blackcat, which is odd because the dates of some of wlu-blackcat's updates to 1.1 go back to 2010. Wouldn't those have come through on normal Windows Update? Am I looking at the right stuff? Thanks.

Dencorso and w2k4eva - I was able to go to the UpdateCatalog per w2k4eva's instruction, but I'm up to date so don't want to download anything. Just now, I "switched users" to the other user on my good XP machine. Started an app - no problem. Just logged out. Is that the test?

w2k4eva - cool - thanks. But what about Avast? Who here has Avast Free on his XP machine? Do you have the six Event Viewer errors?

w2k4eva - Happy to read I'm not the only one and that your machine is also running nicely. Interesting that we both have Avast. Does anyone else have Avast and NOT have the error messages? I also do not use TeaTimer in Spybot S&D. Yes, I have another "real" user on my good machine, and will check that I can access it. That other "user" hasn't actually been used in any real way since 2008. (But on my old GX280 test machine, which also has the Event Viewer error messages, there is only one real "user".) How would I check whether I am "able to use the UpdateCatalog on any/all of the user accounts on [my] machine?" Not sure what that means. (And I would not want to trigger a re-download of the last 5,432 XP updates.) Thanks.

PLEASE ALSO SEE EDIT AT END OF THIS POST: Dencorso and Jaclaz - Much appreciate your tips and attention. Shall not do anything on my important XP machine without first doing twelve or so backups and hiding a few of them around the apartment just in case. But to assuage my evil twin, I ran chkdsk /f on my GX280 test machine. It did not fix the issue, as after each subsequent reboot I get the same six "Application" error lines in Event Viewer. But the machine still seems to run (or in this case walk). The chkdsk results are the following: Event Type: Information Event Source: Winlogon Event Category: None Event ID: 1001 Date: 5/4/2015 Time: 12:32:20 AM User: N/A Computer: [GX280 test machine name] Description: Checking file system on C: The type of the file system is NTFS. A disk check has been scheduled. Windows will now check the disk. Cleaning up minor inconsistencies on the drive. Cleaning up 869 unused index entries from index $SII of file 0x9. Cleaning up 869 unused index entries from index $SDH of file 0x9. Cleaning up 869 unused security descriptors. CHKDSK is verifying Usn Journal... Usn Journal verification completed. 39021246 KB total disk space. 22691132 KB in 64146 files. 21816 KB in 6991 indexes. 0 KB in bad sectors. 180418 KB in use by the system. 65536 KB occupied by the log file. 16127880 KB available on disk. 4096 bytes in each allocation unit. 9755311 total allocation units on disk. 4031970 allocation units available on disk. Internal Info: 20 1a 01 00 ec 15 01 00 54 8a 01 00 00 00 00 00 .......T....... 53 01 00 00 04 00 00 00 2b 0a 00 00 00 00 00 00 S.......+....... 8e cb c6 07 00 00 00 00 6c 3a c1 38 00 00 00 00 ........l:.8.... 3e 1f 5f 1b 00 00 00 00 00 00 00 00 00 00 00 00 >._............. 00 00 00 00 00 00 00 00 2c 9d c1 65 00 00 00 00 ........,..e.... 00 a1 7b a6 00 00 00 00 b0 3a 07 00 92 fa 00 00 ..{......:...... 00 00 00 00 00 f0 f4 68 05 00 00 00 4f 1b 00 00 .......h....O... Windows has finished checking your disk. Please wait while your computer restarts. For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp. ______________ EDIT: The above chkdsk symptoms led me to this MS KB article: https://support.microsoft.com/en-us/kb/831374 Does the stuff in that article have anything to do with the six error lines in my XP Event Viewer? Thanks.

Dencorso and Jaclaz - what about chkdsk /f ? (Might it be dangerous?)

Jaclaz - OK - much appreciate your further thoughts. I think what you're suggesting is simply to run secedit /configure /cfg %windir%\repair\secsetup.inf /db secsetup.sdb /verbose and NOT do the other registry changes in the two KB articles you mention. Correct? I used Aomei Backupper Pro 2.5 yesterday to do an incremental backup to my November backup. However, I have NEVER restored and so don't know if it works. Also, I see two Event Viewer error messages at the time of yesterday's incremental backup related to vssadmin, so I have no faith in the backup. (Probably because I was dumb enought to do the backup when my CryptoPrevent security was on - it puts a lock on vssadmin to help prevent any ransomware attacks.) I will sometime soon a] do a new total backup when CryptoPrevent is off, and using the Aomei Backupper Pro 2.5 Win PE disk only, and b] then install an empty hard drive and do a Restore to that empty hard drive (again using the Aomei Backupper Pro 2.5 Win PE disk only) to first make sure I can even do a Restore at all. Then, I'll try your suggestion above on the new hard drive. (But please advise re my first question here.) Many thanks !!

JACLAZ - Before I start, which of my users might be corrupt? MYNAMEA (which doesn't seem to have any problems or i couldn't write this to you now or get all those emails from my schmendrick brother and his moron dog), or the ones named in the Event Viewer errors: NT AUTHORITY\NETWORK SERVICE and NT AUTHORITY\LOCAL SERVICE ? EDIT - Also, although the update log files from my important XP machine (attached 11 posts above) mention the MYNAMEA folder in Documents and Settings, the log files from my test GX280 machine (attached 2 posts above) do not. Yet both machines have the same Event Viewer errors. Are we sure it's a user corruption? NEW EDIT - Just now, i rebooted three times: first time Safe Mode into Administrator - did nothing second time Safe Mode into MYNAMEA - did nothing third time normal into MYNAMEA - the usual. In Event Viewer: For the first two boots (Safe Mode) the same three "Application" error messages appear, but ONLY for NT AUTHORITY\NETWORK SERVICE . For the third boot (Normal), all six error messages appear, for both NT AUTHORITY\NETWORK SERVICE and NT AUTHORITY\LOCAL SERVICE. Appreciate the suggestion, by the way, but I hesitate to monkey with my good XP machine. Of course, I'll experiment on my test GX280 first, but it is so slooooooow. Also, I don't have that much room left on the good XP machine's hard drive. Probably don't have enough to clone MYNAMEA. Aargh. [EDIT - my current MYNAMEA User Profile is approx. 2.7GB. I DO have enough room to clone just that, but not enough to clone everything in Documents and Settings\MYNAMEA.] Any other ideas? Not just try to re-install KB3021674 ? But many thanks for your attention. If you see some kind of eruption over NYC, you'll know it's only me.

Dencorso and other experts: Attached here are the similar log files from my test XP machine, which, as noted above, is showing the same problems as my good one. I attach only the same three as I did above for my good machine. However, as I posted, on my test machine I also did a lot of other updates on Jan 13. If you'd like to see those logs too, please let me know. On my test machine, I started to UNinstall the KB3021674 update from January, but I got an MS warning that a whole bunch of other things might stop working, so I canceled. Then I saw the same warning on my good machine, so I also canceled. Very curious to know what you all think about these issues, or how I should proceed. Many thanks. Always a learning experience. Hey, is anyone still running WIndows 3.1? EDIT: On both XP machines, I am also running Cubby, which is LogMeIn's competitor to SugarSync. It syncs designated folders across computers. Any chance this is caused by Cubby? ALSO: Way back when, I stopped a whole bunch of unneeded services from running on XP. Never saw a problem, over many years. But might these Event Viewer error messages result from a particular service not running (either always or when I installed the Jan. updates)? Copy of KB3021674 from test GX280.txtCopy of KB3020393-v2 from test GX280.txtCopy of KB3019215 from test GX280.txt

Dencorso and others - just FYI - my older, test XP machine (Dell GX 280) has the same error messages as my important XP machine, starting Jan 13. On that date, on that older machine, I installed the same three and KB2920792, KB2920790, KB3013126, KB3013410, KB3012176, KB3008923, and KB890830. However, the overlap is only the three I listed above, and, on other OSes, KB3021674 gets some bad reviews having to do with user accounts, etc. I'm trying to think why my two XP machines might be vulnerable to these errors when yours aren't. Both of mine have Avast Home Free with "Enable Hardware Virtualization" on, although only my more important machine has the CPU capacity for HAV. I instaled CryptoPrevent only AFTER these errors started, and these errors repeated on a reboot of my better machine today with CryptoPrevent set to "None". Firefox with lots of security? SpywareBlaster? Spybot S&D? Malwarebytes Anti-Exploit Free? Seems unlikely that these have anything to do with it. Well, could it be Avast's new features? Who else out there has Avast Home Free on his XP machine and does NOT have these Event Viewer errors?