glnz Posted May 4, 2015 Author Share Posted May 4, 2015 Dencorso and Jaclaz - what about chkdsk /f ? (Might it be dangerous?) Link to comment Share on other sites More sharing options...
dencorso Posted May 4, 2015 Share Posted May 4, 2015 If chkdsk /f finds something, I'd really start to get worried... but even if it finds anything, it cannot recreate a good profile from a damaged one. However, that's another thing you should do only after you have a good backup. Your plan to put in another disk and restore the backup on it, then work on the new disk is sound and safe. Don't try to get a shortcut... usually that's something one regrets afterwards. This is the sort of situation where Murphy's Law applies: so, one has to make sure nothing relevant may go wrong, and then nothing at all will. BTW, is your XP installed on NTFS or on FT-32? I have assumed it's on NTFS, but the only way to be sure is by asking you, of course. Link to comment Share on other sites More sharing options...
jaclaz Posted May 4, 2015 Share Posted May 4, 2015 @glnzYes, for the record if chkdsk finds an issue with file/folder permissions it attempts to fix it, but not necessarily it fixes it "right", so running it is (on the new, redeployed backup) is a very good idea , but unlikely it will be able by it's own to fix the issue. An example (not necessarily what happened or happens to you):a bit or a set of bits are corrupted on the filesystemyou cannot manually (because it throws an error) change the owner or permissions of a fileyou then run chkdsk (which will hopefully repair the $MFT or *whatever* holding the permissions data)chkdsk very likely will reset those data to a "default" that may (or may not be the desired setting)then you reattempt changing the owner/permissions of that file to the desired ones and this time it works because the underlying structure is "fixed" In theory verifying the filesystem structures is a "common enough" and "safe enough" activity, but in practice - particularly when there is a suspect of a filesystem level corruption - it is much safer to make a full backup before. The three golden rules of backup:Backup Backup another time to another media. While pondering on the duality and redundance in the essence of the previous two rules, do backup AGAIN on a third media. jaclaz Link to comment Share on other sites More sharing options...
w2k4eva Posted May 4, 2015 Share Posted May 4, 2015 Hey, is anyone still running WIndows 3.1? . . . . ALSO: Way back when, I stopped a whole bunch of unneeded services from running on XP. Never saw a problem, over many years. But might these Event Viewer error messages result from a particular service not running (either always or when I installed the Jan. updates)?Not as a daily surfer, and it's been an age since I booted it, but yes, I *DO* still have a Win3.1 system (it dualboots an old slackware install too). I think I even have those old install floppies that came with it. As for the services, lots of people tweak those. I think you would have started seeing any potential issues years ago, like at the next reboot after you adjusted them. If they didn't give trouble back then I doubt they are relevant now. In any case there is always the reference stuff compiled at http://www.blackviper.com/service-configurations/black-vipers-windows-xp-x86-32-bit-service-pack-3-service-configurations/ if you can't remember what the default values are or want to look up more details. Link to comment Share on other sites More sharing options...
Tripredacus Posted May 4, 2015 Share Posted May 4, 2015 Reading about potentially corrupt OSes... I got to wonder. Has anyone had to do a repair install on an XP OS that was franken-POSReady-2009 yet? Link to comment Share on other sites More sharing options...
glnz Posted May 4, 2015 Author Share Posted May 4, 2015 (edited) PLEASE ALSO SEE EDIT AT END OF THIS POST: Dencorso and Jaclaz - Much appreciate your tips and attention. Shall not do anything on my important XP machine without first doing twelve or so backups and hiding a few of them around the apartment just in case. But to assuage my evil twin, I ran chkdsk /f on my GX280 test machine. It did not fix the issue, as after each subsequent reboot I get the same six "Application" error lines in Event Viewer. But the machine still seems to run (or in this case walk). The chkdsk results are the following: Event Type: InformationEvent Source: WinlogonEvent Category: NoneEvent ID: 1001Date: 5/4/2015Time: 12:32:20 AMUser: N/AComputer: [GX280 test machine name]Description:Checking file system on C:The type of the file system is NTFS.A disk check has been scheduled.Windows will now check the disk. Cleaning up minor inconsistencies on the drive.Cleaning up 869 unused index entries from index $SII of file 0x9.Cleaning up 869 unused index entries from index $SDH of file 0x9.Cleaning up 869 unused security descriptors.CHKDSK is verifying Usn Journal...Usn Journal verification completed. 39021246 KB total disk space. 22691132 KB in 64146 files. 21816 KB in 6991 indexes. 0 KB in bad sectors. 180418 KB in use by the system. 65536 KB occupied by the log file. 16127880 KB available on disk. 4096 bytes in each allocation unit. 9755311 total allocation units on disk. 4031970 allocation units available on disk.Internal Info:20 1a 01 00 ec 15 01 00 54 8a 01 00 00 00 00 00 .......T.......53 01 00 00 04 00 00 00 2b 0a 00 00 00 00 00 00 S.......+.......8e cb c6 07 00 00 00 00 6c 3a c1 38 00 00 00 00 ........l:.8....3e 1f 5f 1b 00 00 00 00 00 00 00 00 00 00 00 00 >._.............00 00 00 00 00 00 00 00 2c 9d c1 65 00 00 00 00 ........,..e....00 a1 7b a6 00 00 00 00 b0 3a 07 00 92 fa 00 00 ..{......:......00 00 00 00 00 f0 f4 68 05 00 00 00 4f 1b 00 00 .......h....O...Windows has finished checking your disk.Please wait while your computer restarts.For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp. ______________ EDIT: The above chkdsk symptoms led me to this MS KB article:https://support.microsoft.com/en-us/kb/831374 Does the stuff in that article have anything to do with the six error lines in my XP Event Viewer? Thanks. Edited May 4, 2015 by glnz Link to comment Share on other sites More sharing options...
jaclaz Posted May 4, 2015 Share Posted May 4, 2015 EDIT: The above chkdsk symptoms led me to this MS KB article:https://support.microsoft.com/en-us/kb/831374 Does the stuff in that article have anything to do with the six error lines in my XP Event Viewer? Thanks. Maybe though if you read that article you need to have either of:a $MFT larger than 4 Gb (which I would tag as "uncommon" ) more than 4,194,303 files on the volume (which I would tag as "very, very uncommon" )AND the problem (considering that that article has been written around the end of 2003 should be pertaining to XP Gold and SP1, probably fixed in SP1a but surely fixed in SP2. jaclaz Link to comment Share on other sites More sharing options...
w2k4eva Posted May 4, 2015 Share Posted May 4, 2015 I have just discovered that, in my XP Pro SP3, I have Event Viewer error messages starting Jan 15 of this year and repeating frequently (probably with each reboot) that MAYBE are related to three POS updates I did that day -- KB3021674, KB3020393 and KB3019215.. . . . I see that these error messages involve either NT AUTHORITY\NETWORK SERVICE or NT AUTHORITY\LOCAL SERVICE, not my User name (my logon name). If I open an explore window and and go to C:\Documents and Settings, I can see that the NTUSER.DAT file in each of LocalService and NetworkService has a last modified date of 1/15/2015. (The NTUSER.DAT in my own user folder is modified today.) [NOW, MAYBE THE FOLLOWING ADDITIONAL DETAIL IS NOT RELEVANT, BUT JUST IN CASE: If I go to System Properties - Advanced - User Profiles - Settings button, my own User Profile (my User Name) is updated today (because I just rebooted), but there are five "Account Unknown"s of approx. 20MB each with "Last Modified" dates of either 12/5/2014 or 3/17/2015.If I open an Explore window and go to C:\Documents and Settings, I see a bunch of Users I recognize from the past and also :TEMPTEMP.NT AUTHORITYandTEMP.NT AUTHORITY.000but their file modification dates are not stopped at 1/15/2015.] So, experts, what do you think? Is my XP machine in trouble? Thanks. FWIW, reading your post made me go check my event logs (I hadn't otherwise had any reason to look since nothing seems to have gone wrong here) and I have those same 6 event log entries at each reboot starting from the day I installed those 3 updates. I also have 2 of the extra entries for TEMP and TEMP.NT AUTHORITY (but not the 3rd .000 one) under Documents and Settings, timestamped at last boot. However I do not have the extra "Account Unknown"s. The date of updating my profile matches the date I installed the updates, despite having rebooted several times since then. And the timestamp under Documents and Settings for my profile folder is some six months old, and does not match last boot time nor the date under the User profile display. Not so sure it is anything serious as there are no symptoms here other than the eventlog entries, or at least nothing that changed on that date - I have had the weird permissions thing described in my other thread for as long as I've had this machine, prior to installing those updates. I did also install other updates that day as well. The version of userenv.dll I have in both C:\Windows\system32 and C:\Windows\system32\dllcacheis 5.1.2600.6689, last modified 12/6/2014 at 3:28am. (Was installed by KB3021674 ? ) Likewise here. I also have the proper version mrxdav.sys 5.1.2600.6708 from KB3019215. The only version of tlntsess.exe I have is buried under windows\$hf_mig$\kb960859\sp3qfe - in hindsight I probably shouldn't have bothered with KB3020393 since I am running XP Home which does not have the telnet server. I'm trying to think why my two XP machines might be vulnerable to these errors when yours aren't. Both of mine have Avast Home Free with "Enable Hardware Virtualization" on, although only my more important machine has the CPU capacity for HAV. I instaled CryptoPrevent only AFTER these errors started, and these errors repeated on a reboot of my better machine today with CryptoPrevent set to "None". Firefox with lots of security? SpywareBlaster? Spybot S&D? Malwarebytes Anti-Exploit Free? Seems unlikely that these have anything to do with it. I also run Avast Free but am using version 6, with the sandboxing features turned off; this is an older system that does not have the hardware to support virtualization. I do not have CryptoPrevent nor MBAE. I do have FF w/Noscript, SpywareBlaster 4.6, Spybot 1.6.2 and MBAM 1.75.0.1 but do not use TeaTimer so none of these should affect booting, Avast would be the only one in that category. EDIT: On both XP machines, I am also running Cubby, which is LogMeIn's competitor to SugarSync. It syncs designated folders across computers. Any chance this is caused by Cubby? I do not have Cubby (or any other sync app) either so that can be ruled out.. Just for giggles, are you able to use the UpdateCatalog on any/all of the user accounts on your machine? Do you even have more than one "real" user account? Link to comment Share on other sites More sharing options...
glnz Posted May 4, 2015 Author Share Posted May 4, 2015 (edited) w2k4eva - Happy to read I'm not the only one and that your machine is also running nicely. Interesting that we both have Avast. Does anyone else have Avast and NOT have the error messages? I also do not use TeaTimer in Spybot S&D. Yes, I have another "real" user on my good machine, and will check that I can access it. That other "user" hasn't actually been used in any real way since 2008. (But on my old GX280 test machine, which also has the Event Viewer error messages, there is only one real "user".) How would I check whether I am "able to use the UpdateCatalog on any/all of the user accounts on [my] machine?" Not sure what that means. (And I would not want to trigger a re-download of the last 5,432 XP updates.) Thanks. Edited May 4, 2015 by glnz Link to comment Share on other sites More sharing options...
w2k4eva Posted May 4, 2015 Share Posted May 4, 2015 How would I check whether I am "able to use the UpdateCatalog on any/all of the user accounts on [my] machine?" Not sure what that means. (And I would not want to trigger a re-download of the last 5,432 XP updates.) Easy, just use IE (any version or OS from W2K IE6 upward, maybe even W98 IE6? haven't tried that one but have used W2k and it works there) to visit http://catalog.update.microsoft.com/v7/site/Search.aspx It has to be in IE, other browsers won't work. It may ask you to install an activex control if you don't already have it. Once that is done, the site should normally let you search for updates by KB number, OS version, or some other keyword(s), so you can download them for offline use. Or for WEPOS2009 fans, find stuff not available in the regular MS Download site. Unlike using WindowsUpdate in Express mode, you won't get force fed anything here. Or you may get an error message like:To use this website, you browser must have the user data persistence setting enabled.To enable this, follow these steps:In Internet Explorer, click Tools , then click Internet Options.Click the Security tab, then click Custom Level.In the Settings dialog box, under the Miscellaneous section, find Userdata persistence and click Enable.Click OK twice to save and exit. but for some people this does not work, or they already have that setting enabled but still get the message anyway. This is the problem that I started the other thread about. Link to comment Share on other sites More sharing options...
Jody Thornton Posted May 4, 2015 Share Posted May 4, 2015 That sounds good to me. So I'll proceed with updating my mom's machine and see what happens. Thanks for the report in a nutshell. I needed that. My pleasure! But do keep us posted: this thread is serving as a meeting point where we exchange info on what's happening, all the time. Whenever an issue occurs, it's posted here, and so are solutions and workarounds. That a big 10-4! Link to comment Share on other sites More sharing options...
glnz Posted May 5, 2015 Author Share Posted May 5, 2015 w2k4eva - cool - thanks. But what about Avast? Who here has Avast Free on his XP machine? Do you have the six Event Viewer errors? Link to comment Share on other sites More sharing options...
dencorso Posted May 5, 2015 Share Posted May 5, 2015 I use paid AVG: 2011 on 3 machines and 9.0 on one machine (an Asus EeePC 900). I've no experience whatsoever with Avast. BTW, you forgot to answer w2k4eva's question below: Just for giggles, are you able to use the UpdateCatalog on any/all of the user accounts on your machine? Do you even have more than one "real" user account? Link to comment Share on other sites More sharing options...
glnz Posted May 5, 2015 Author Share Posted May 5, 2015 Dencorso and w2k4eva - I was able to go to the UpdateCatalog per w2k4eva's instruction, but I'm up to date so don't want to download anything. Just now, I "switched users" to the other user on my good XP machine. Started an app - no problem. Just logged out. Is that the test? Link to comment Share on other sites More sharing options...
Bersaglio Posted May 12, 2015 Share Posted May 12, 2015 (edited) NEW Updates for .NET Frameworks released this month: .NET Framework 1.1 SP1 (MS15-048):http://download.microsoft.com/download/3/E/3/3E311496-3A6D-4156-941A-F8BE49D617C2/WindowsServer2003-KB3023211-x86-ENU.exeThis update can't be installed on XP without modification. And sadly we still don't have modified update KB3037572 (MS15-041) released in April. The rest of the six updates (.NET Framework 2.0 SP2/.NET Framework 3.0 SP2/.NET Framework 4.0 Client/Extended) are fully XP compatible and can be installed without registry tweaks or modifications:http://download.microsoft.com/download/5/2/C/52CDC545-676A-4BC8-BA7E-F7634A06205E/NDP20SP2-KB3023220-x86.exehttp://download.microsoft.com/download/2/9/B/29B473CB-63B7-4ED0-8A54-5F512AC2475F/NDP20SP2-KB3035488-x86.exehttp://download.microsoft.com/download/F/8/5/F859846E-37D4-422F-AA06-DA7F44EB3246/NDP30SP2-KB3048073-v2-x86.exehttp://download.microsoft.com/download/2/0/8/208D1422-5B68-4BEB-BFD2-6B860DA4F978/NDP40-KB3023221-x86.exehttp://download.microsoft.com/download/A/A/3/AA3F6C4D-0DC2-4074-9DAC-88FA3A8AFDD4/NDP40-KB3032662-x86.exehttp://download.microsoft.com/download/9/2/1/921E5232-83F4-43CA-8B28-6B4F2A4484F7/NDP40-KB3048074-x86.exe Edited May 13, 2015 by Bersaglio 1 Link to comment Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now