POSReady 2009 updates ported to Windows XP SP3 ENU

[dencorso]

Dencorso - good to read that it's probably only a minor glitch, but this XP machine is still quite important to me, so I'm concerned.

 

The version of userenv.dll I have in both

      C:\Windows\system32

      and

      C:\Windows\system32\dllcache

is 5.1.2600.6689, last modified 12/6/2014 at 3:28am.  (Was installed by KB3021674 ? )

Yes it was. And it's OK.

 

So, what should I do without risking a melt-down?

For the moment nothing. Proceed as if nothing were wrong. And arm yourself with lots of patience.

There's no reason for any anxiety, so do not panic. Let's let others chime in, in their own time.

Meanwhile, do tell me: Do you have any full backups that are known good?

[glnz]

Dencorso - no full backups since November, before installing my first POS update.  Too long ago, I'm afraid.  Lots of important emails on OE 6 since then.  So much for my smarts.

 

Promise not to panic (and cause this thread to get wrinkled), but do you think these errors can do anything?  I suppose not, since they've been occurring since Jan 15, but still.

[Jody Thornton]

So if I may ask (summary-wise without having to read through the whole thread) the following:

 

• Can I now assume that entering the registry patch and just ruinning and installing all POSReady updates without any intervention or workarounds is not possible without some added effort?
• Am I correct that at some point, there will be at least some DLL issues to contend with?  I'm not going to be installing any .NET framwork or updates, and I'm already aware of the update that negatively impacts font rendering.

Thanks

Edited May 2, 2015 by JodyT

[glnz]

Dencorso and others - just FYI - my older, test XP machine (Dell GX 280) has the same error messages as my important XP machine, starting Jan 13.  On that date, on that older machine, I installed the same three and KB2920792, KB2920790, KB3013126, KB3013410, KB3012176, KB3008923, and KB890830.

 

However, the overlap is only the three I listed above, and, on other OSes, KB3021674 gets some bad reviews having to do with user accounts, etc.

 

I'm trying to think why my two XP machines might be vulnerable to these errors when yours aren't.  Both of mine have Avast Home Free with "Enable Hardware Virtualization" on, although only my more important machine has the CPU capacity for HAV.  I instaled CryptoPrevent only AFTER these errors started, and these errors repeated on a reboot of my better machine today with CryptoPrevent set to "None".  Firefox with lots of security?  SpywareBlaster?  Spybot S&D?  Malwarebytes Anti-Exploit Free?  Seems unlikely that these have anything to do with it. 

 

Well, could it be Avast's new features?  Who else out there has Avast Home Free on his XP machine and does NOT have these Event Viewer errors?

Edited May 2, 2015 by glnz

[dencorso]

Hi, Jody!

Well, up to now, for me and for most users nothing wrong has happened.

Yes, there was that update that impacted fonts, but it was correted next month (KB3034344 has a new win32k.sys inside, v. 5.1.2600.6755, which is OK).

I never had automatic updates on, however, so I always initiated the monthly updates by hand, but that's nothing more than precaution.

Now, glnz is having this issue, but it's the first such case I know of.

 

Am I correct that at some point, there will be at least some DLL issues to contend with?

 

There may well be, at some point, but up to now there is none. But we'll deal with that when it happens, as was the case with the win32k.sys that impacted rendering. Observe that just hiding it and waiting for the next month was enough to solve that but, even before that had happened, harkaz had released an unofficial fix.

[dencorso]

Promise not to panic (and cause this thread to get wrinkled), but do you think these errors can do anything?  I suppose not, since they've been occurring since Jan 15, but still.

No. Whatever had to happen would already have happened long ago. So do create a full backup right away. Afterwards we may think of ways of recreating the missing profile. But we won't be messing with any non-backed-up system, in no way, OK?

[Jody Thornton]

Hi, Jody!

Well, up to now, for me and for most users nothing wrong has happened.

Yes, there was that update that impacted fonts, but it was correted next month (KB3034344 has a new win32k.sys inside, v. 5.1.2600.6755, which is OK).

I never had automatic updates on, however, so I always initiated the monthly updates by hand, but that's nothing more than precaution.

Now, glnz is having this issue, but it's the first such case I know of.

 

Am I correct that at some point, there will be at least some DLL issues to contend with?

 

There may well be, at some point, but up to now there is none. But we'll deal with that when it happens, as was the case with the win32k.sys that impacted rendering. Observe that just hiding it and waiting for the next month was enough to solve that but, even before that had happened, harkaz had released an unofficial fix.

 

That sounds good to me.  So I'll proceed with updating my mom's machine and see what happens.  Thanks for the report in a nutshell.  I needed that.

[dencorso]

That sounds good to me.  So I'll proceed with updating my mom's machine and see what happens.  Thanks for the report in a nutshell.  I needed that.

My pleasure! But do keep us posted: this thread is serving as a meeting point where we exchange info on what's happening, all the time. Whenever an issue occurs, it's posted here, and so are solutions and workarounds.

[glnz]

Dencorso and other experts:  Attached here are the similar log files from my test XP machine, which, as noted above, is showing the same problems as my good one. 

 

I attach only the same three as I did above for my good machine.  However, as I posted, on my test machine I also did a lot of other updates on Jan 13.  If you'd like to see those logs too, please let me know.

 

On my test machine, I started to UNinstall the KB3021674 update from January, but I got an MS warning that a whole bunch of other things might stop working, so I canceled.  Then I saw the same warning on my good machine, so I also canceled.

 

Very curious to know what you all think about these issues, or how I should proceed.

 

Many thanks.  Always a learning experience.

 

Hey, is anyone still running WIndows 3.1?

 

EDIT:  On both XP machines, I am also running Cubby, which is LogMeIn's competitor to SugarSync.  It syncs designated folders across computers.  Any chance this is caused by Cubby?

ALSO: Way back when, I stopped a whole bunch of unneeded services from running on XP.  Never saw a problem, over many years.  But might these Event Viewer error messages result from a particular service not running (either always or when I installed the Jan. updates)?

 

Copy of KB3021674 from test GX280.txtCopy of KB3020393-v2 from test GX280.txtCopy of KB3019215 from test GX280.txt

Edited May 3, 2015 by glnz

[jaclaz]

@glnz

It seems to me like the "base" issue is a corrupted user profile.

 

Before anything else, I would see if the machine works fine with a new user.

 

Then I would try making a duplicate user from the old one to the new one:

http://windowsxp.mvps.org/dupprofile.htm

 

jaclaz

[glnz]

JACLAZ - Before I start, which of my users might be corrupt? 
MYNAMEA (which doesn't seem to have any problems or i couldn't write this to you now or get all those emails from my schmendrick brother and his moron dog),

or the ones named in the Event Viewer errors:   NT AUTHORITY\NETWORK SERVICE    and    NT AUTHORITY\LOCAL SERVICE  ?

 

EDIT - Also, although the update log files from my important XP machine (attached 11 posts above) mention the MYNAMEA folder in Documents and Settings, the log files from my test GX280 machine (attached 2 posts above) do not.  Yet both machines have the same Event Viewer errors.  Are we sure it's a user corruption?

 

NEW EDIT - Just now, i rebooted three times:

first time Safe Mode into Administrator - did nothing

second time Safe Mode into MYNAMEA - did nothing

third time normal into MYNAMEA - the usual.

In Event Viewer:
For the first two boots (Safe Mode) the same three "Application" error messages appear, but ONLY for
NT AUTHORITY\NETWORK SERVICE . 
For the third boot (Normal), all six error messages appear, for both
NT AUTHORITY\NETWORK SERVICE    and    NT AUTHORITY\LOCAL SERVICE.

 

Appreciate the suggestion, by the way, but I hesitate to monkey with my good XP machine.  Of course, I'll experiment on my test GX280 first, but it is so slooooooow.

 

Also, I don't have that much room left on the good XP machine's hard drive.  Probably don't have enough to clone MYNAMEA.  Aargh. 
[EDIT - my current MYNAMEA User Profile is approx. 2.7GB.  I DO have enough room to clone just that, but not enough to clone everything in Documents and Settings\MYNAMEA.]

 

Any other ideas?  Not just try to re-install KB3021674 ?

 

But many thanks for your attention.  If you see some kind of eruption over NYC, you'll know it's only me.

Edited May 3, 2015 by glnz

[jaclaz]

JACLAZ - Before I start, which of my users might be corrupt? 

MYNAMEA (which doesn't seem to have any problems or i couldn't write this to you now or get all those emails from my schmendrick brother and his moron dog),

or the ones named in the Event Viewer errors:   NT AUTHORITY\NETWORK SERVICE    and    NT AUTHORITY\LOCAL SERVICE  ?

 

My bad  , I was sure to have posted this piece of info (while I evidently only thought about it):

You can take the actual C:\Documents and Settings\LocalService\NTUSER.DAT and C:\Documents and Settings\NetworkService\NTUSER.DAT from your old backup, normally these profiles don't change.

You will need of course to replace those while offline (like when booted to another install or from a PE).

 

My previous post revolved around the idea that something in the "current user" (i.e. MYNAMEA) may be causing the issue, because it "lost" some permissions/authorizations/whatever, and creating (temporarily) a new user might be a way to see if that is the case and possibly "reset" the settings.

 

In the end, it is possible that there is no need for anything above and all that is needed is a

https://support.microsoft.com/en-us/kb/873148

https://support.microsoft.com/en-us/kb/313222

secedit /configure /cfg %windir%\repair\secsetup.inf /db secsetup.sdb /verbose

but I would attempt that only once you have a good backup of your current situation, which is anyway better than (possibly) a non working system.

 

jaclaz

.

[glnz]

Jaclaz - OK - much appreciate your further thoughts. 

 

I think what you're suggesting is simply to run

     secedit /configure /cfg %windir%\repair\secsetup.inf /db secsetup.sdb /verbose

and NOT do the other registry changes in the two KB articles you mention.

Correct?

 

I used Aomei Backupper Pro 2.5 yesterday to do an incremental backup to my November backup.  However, I have NEVER restored and so don't know if it works.  Also, I see two Event Viewer error messages at the time of yesterday's incremental backup related to vssadmin, so I have no faith in the backup.  (Probably because I was dumb enought to do the backup when my CryptoPrevent security was on - it puts a lock on vssadmin to help prevent any ransomware attacks.)

 

I will sometime soon
a] do a new total backup when CryptoPrevent is off, and using the Aomei Backupper Pro 2.5 Win PE disk only, and
b] then install an empty hard drive and do a Restore to that empty hard drive (again using the Aomei Backupper Pro 2.5 Win PE disk only) to first make sure I can even do a Restore at all.

Then, I'll try your suggestion above on the new hard drive.  (But please advise re my first question here.)

 

Many thanks !!

Edited May 3, 2015 by glnz

[jaclaz]

Yep , the symptoms are similar to those connected with access permissions/security settings *somehow* changed/corrupted and generically resetting them by running the given command line may solve the issue, the point is that there is a risk in running that command, so your plan of testing the backup first sounds perfectly appropriate .

 

Remember that you SHOULD NOT have connected at the same time two hard disks with a same signature (i.e. the original disk and the one to which you restore the backup through the WinPE) as the Windows OS will - silently and at boot time - change the Disk Signature of one of the two disk to a different one (to avoid conflicts in the enumeratign of the devices) or have anyway a separate backup of the MBR (or just jolt down the current disk signature) in case it is needed to restore it.

 

jaclaz

[Bleeder]

Not 3.1, but 3.11.. mostly for old games that were written for 3.1x, like SimTower.

 

Hey, is anyone still running WIndows 3.1?