POSReady 2009 updates ported to Windows XP SP3 ENU

[glnz]

Dencorso and Jaclaz - what about chkdsk /f ?  (Might it be dangerous?)

[dencorso]

If chkdsk /f finds something, I'd really start to get worried... but even if it finds anything, it cannot recreate a good profile from a damaged one. However, that's another thing you should do only after you have a good backup. Your plan to put in another disk and restore the backup on it, then work on the new disk is sound and safe. Don't try to get a shortcut... usually that's something one regrets afterwards. This is the sort of situation where Murphy's Law applies: so, one has to make sure nothing relevant may go wrong, and then nothing at all will.

 

BTW, is your XP installed on NTFS or on FT-32? I have assumed it's on NTFS, but the only way to be sure is by asking you, of course.

[jaclaz]

@glnz

Yes, for the record if chkdsk finds an issue with file/folder permissions it attempts to fix it, but not necessarily it fixes it "right", so running it is (on the new, redeployed backup) is a very good idea , but unlikely it will be able by it's own to fix the issue.

 

An example (not necessarily what happened or happens to you):

• a bit or a set of bits are corrupted on the filesystem
• you cannot manually (because it throws an error) change the owner or permissions of a file
• you then run chkdsk (which will hopefully repair the $MFT or *whatever* holding the permissions data)
• chkdsk very likely will reset those data to a "default" that may (or may not be the desired setting)
• then you reattempt changing the owner/permissions of that file to the desired ones and this time it works because the underlying structure is "fixed" 

In theory verifying the filesystem structures is a "common enough" and "safe enough" activity, but in practice - particularly when there is a suspect of a filesystem level corruption - it is much safer to make a full backup before.

 

The three golden rules of backup:

1. Backup
2. Backup another time to another media.
3. While pondering on the duality and redundance in the essence of the previous two rules, do backup AGAIN on a third media.

 

jaclaz

[w2k4eva]

Hey, is anyone still running WIndows 3.1?

 

. . . .

 

ALSO: Way back when, I stopped a whole bunch of unneeded services from running on XP.  Never saw a problem, over many years.  But might these Event Viewer error messages result from a particular service not running (either always or when I installed the Jan. updates)?

Not as a daily surfer, and it's been an age since I booted it, but yes, I *DO* still have a Win3.1 system (it dualboots an old slackware install too). I think I even have those old install floppies that came with it.

 

As for the services, lots of people tweak those.  I think you would have started seeing any potential issues years ago, like at the next reboot after you adjusted them. If they didn't give trouble back then I doubt they are relevant now. In any case there is always the reference stuff compiled at http://www.blackviper.com/service-configurations/black-vipers-windows-xp-x86-32-bit-service-pack-3-service-configurations/ if you can't remember what the default values are or want to look up more details.

[Tripredacus]

Reading about potentially corrupt OSes... I got to wonder. Has anyone had to do a repair install on an XP OS that was franken-POSReady-2009 yet?

[glnz]

PLEASE ALSO SEE EDIT AT END OF THIS POST:

 

Dencorso and Jaclaz - Much appreciate your tips and attention.  Shall not do anything on my important XP machine without first doing twelve or so backups and hiding a few of them around the apartment just in case.

 

But to assuage my evil twin, I ran chkdsk /f on my GX280 test machine.  It did not fix the issue, as after each subsequent reboot I get the same six "Application" error lines in Event Viewer.  But the machine still seems to run (or in this case walk).

 

The chkdsk results are the following:

 

Event Type:    Information
Event Source:    Winlogon
Event Category:    None
Event ID:    1001
Date:        5/4/2015
Time:        12:32:20 AM
User:        N/A
Computer:    [GX280 test machine name]
Description:
Checking file system on C:
The type of the file system is NTFS.

A disk check has been scheduled.
Windows will now check the disk.                         
Cleaning up minor inconsistencies on the drive.
Cleaning up 869 unused index entries from index $SII of file 0x9.
Cleaning up 869 unused index entries from index $SDH of file 0x9.
Cleaning up 869 unused security descriptors.
CHKDSK is verifying Usn Journal...
Usn Journal verification completed.

  39021246 KB total disk space.
  22691132 KB in 64146 files.
     21816 KB in 6991 indexes.
         0 KB in bad sectors.
    180418 KB in use by the system.
     65536 KB occupied by the log file.
  16127880 KB available on disk.

      4096 bytes in each allocation unit.
   9755311 total allocation units on disk.
   4031970 allocation units available on disk.

Internal Info:
20 1a 01 00 ec 15 01 00 54 8a 01 00 00 00 00 00   .......T.......
53 01 00 00 04 00 00 00 2b 0a 00 00 00 00 00 00  S.......+.......
8e cb c6 07 00 00 00 00 6c 3a c1 38 00 00 00 00  ........l:.8....
3e 1f 5f 1b 00 00 00 00 00 00 00 00 00 00 00 00  >._.............
00 00 00 00 00 00 00 00 2c 9d c1 65 00 00 00 00  ........,..e....
00 a1 7b a6 00 00 00 00 b0 3a 07 00 92 fa 00 00  ..{......:......
00 00 00 00 00 f0 f4 68 05 00 00 00 4f 1b 00 00  .......h....O...

Windows has finished checking your disk.
Please wait while your computer restarts.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
 

______________

 

EDIT:  The above chkdsk symptoms led me to this MS KB article:

https://support.microsoft.com/en-us/kb/831374

 

Does the stuff in that article have anything to do with the six error lines in my XP Event Viewer?

 

Thanks.

Edited May 4, 2015 by glnz

[jaclaz]

EDIT:  The above chkdsk symptoms led me to this MS KB article:

https://support.microsoft.com/en-us/kb/831374

 

Does the stuff in that article have anything to do with the six error lines in my XP Event Viewer?

 

Thanks.

 

Maybe though if you read that article you need to have either of:

1. a $MFT larger than 4 Gb (which I would tag as "uncommon" )
2. more than 4,194,303 files on the volume (which I would tag as "very, very uncommon" )

AND the problem (considering that that article has been written around the end of 2003 should be pertaining to XP Gold and SP1, probably fixed in SP1a but surely fixed in SP2.

 

jaclaz

[w2k4eva]

I have just discovered that, in my XP Pro SP3, I have Event Viewer error messages starting Jan 15 of this year and repeating frequently (probably with each reboot) that MAYBE are related to three POS updates I did that day -- KB3021674,  KB3020393  and  KB3019215.

. . . .

 

I see that these error messages involve either  NT AUTHORITY\NETWORK SERVICE  or  NT AUTHORITY\LOCAL SERVICE, not my User name (my logon name).

 

If I open an explore window and and go to C:\Documents and Settings, I can see that the NTUSER.DAT file in each of LocalService and NetworkService has a last modified date of 1/15/2015.  (The NTUSER.DAT in my own user folder is modified today.)

 

[NOW, MAYBE THE FOLLOWING ADDITIONAL DETAIL IS NOT RELEVANT, BUT JUST IN CASE:  If I go to System Properties - Advanced - User Profiles - Settings button, my own User Profile (my User Name) is updated today (because I just rebooted), but there are five "Account Unknown"s of approx. 20MB each with "Last Modified" dates of either 12/5/2014 or 3/17/2015.

If I open an Explore window and go to C:\Documents and Settings, I see a bunch of Users I recognize from the past and also :

TEMP

TEMP.NT AUTHORITY

and

TEMP.NT AUTHORITY.000

but their file modification dates are not stopped at 1/15/2015.]

 

So, experts, what do you think?  Is my XP machine in trouble?

 

Thanks.

 

FWIW, reading your post made me go check my event logs (I hadn't otherwise had any reason to look since nothing seems to have gone wrong here) and I have those same 6 event log entries at each reboot starting from the day I installed those 3 updates. I also have 2 of the extra entries for TEMP and TEMP.NT AUTHORITY (but not the 3rd .000 one) under Documents and Settings, timestamped at last boot. However I do not have the extra "Account Unknown"s. The date of updating my profile matches the date I installed the updates, despite having rebooted several times since then. And the timestamp under Documents and Settings for my profile folder is some six months old, and does not match last boot time nor the date under the User profile display.

 

Not so sure it is anything serious as there are no symptoms here other than the eventlog entries, or at least nothing that changed on that date - I have had the weird permissions thing described in my other thread for as long as I've had this machine, prior to installing those updates. I did also install other updates that day as well.

 

The version of userenv.dll I have in both

      C:\Windows\system32

      and

      C:\Windows\system32\dllcache

is 5.1.2600.6689, last modified 12/6/2014 at 3:28am.  (Was installed by KB3021674 ? )

 

Likewise here. I also have the proper version mrxdav.sys 5.1.2600.6708 from KB3019215.

 

The only version of tlntsess.exe I have is buried under windows\$hf_mig$\kb960859\sp3qfe - in hindsight I probably shouldn't have bothered with KB3020393 since I am running XP Home which does not have the telnet server.

 

I'm trying to think why my two XP machines might be vulnerable to these errors when yours aren't.  Both of mine have Avast Home Free with "Enable Hardware Virtualization" on, although only my more important machine has the CPU capacity for HAV.  I instaled CryptoPrevent only AFTER these errors started, and these errors repeated on a reboot of my better machine today with CryptoPrevent set to "None".  Firefox with lots of security?  SpywareBlaster?  Spybot S&D?  Malwarebytes Anti-Exploit Free?  Seems unlikely that these have anything to do with it.

 

I also run Avast Free but am using version 6, with the sandboxing features turned off; this is an older system that does not have the hardware to support virtualization. I do not have CryptoPrevent nor MBAE. I do have FF w/Noscript, SpywareBlaster 4.6, Spybot 1.6.2 and MBAM 1.75.0.1 but do not use TeaTimer so none of these should affect booting, Avast would be the only one in that category.

 

EDIT:  On both XP machines, I am also running Cubby, which is LogMeIn's competitor to SugarSync.  It syncs designated folders across computers.  Any chance this is caused by Cubby?

 

I do not have Cubby (or any other sync app) either so that can be ruled out..

 

Just for giggles, are you able to use the UpdateCatalog on any/all of the user accounts on your machine? Do you even have more than one "real" user account?

[glnz]

w2k4eva - Happy to read I'm not the only one and that your machine is also running nicely.   Interesting that we both have Avast.  Does anyone else have Avast and NOT have the error messages?

 

I also do not use TeaTimer in Spybot S&D.

 

Yes, I have another "real" user on my good machine, and will check that I can access it.  That other "user" hasn't actually been used in any real way since 2008.  (But on my old GX280 test machine, which also has the Event Viewer error messages, there is only one real "user".)

 

How would I check whether I am "able to use the UpdateCatalog on any/all of the user accounts on [my] machine?"  Not sure what that means.  (And I would not want to trigger a re-download of the last 5,432 XP updates.)

 

Thanks.

Edited May 4, 2015 by glnz

[w2k4eva]

How would I check whether I am "able to use the UpdateCatalog on any/all of the user accounts on [my] machine?"  Not sure what that means.  (And I would not want to trigger a re-download of the last 5,432 XP updates.)

 

Easy, just use IE (any version or OS from W2K IE6 upward, maybe even W98 IE6? haven't tried that one but have used W2k and it works there) to visit http://catalog.update.microsoft.com/v7/site/Search.aspx

 

It has to be in IE, other browsers won't work. It may ask you to install an activex control if you don't already have it.

 

Once that is done, the site should normally let you search for updates by KB number, OS version, or some other keyword(s), so you can download them for offline use. Or for WEPOS2009 fans, find stuff not available in the regular MS Download site. Unlike using WindowsUpdate in Express mode, you won't get force fed anything here.

 

Or you may get an error message like:

To use this website, you browser must have the user data persistence setting enabled.

To enable this, follow these steps:

In Internet Explorer, click Tools , then click Internet Options.

Click the Security tab, then click Custom Level.

In the Settings dialog box, under the Miscellaneous section, find Userdata persistence and click Enable.

Click OK twice to save and exit.

 

but for some people this does not work, or they already have that setting enabled but still get the message anyway. This is the problem that I started the other thread about.

[Jody Thornton]

 

That sounds good to me.  So I'll proceed with updating my mom's machine and see what happens.  Thanks for the report in a nutshell.  I needed that.

My pleasure! But do keep us posted: this thread is serving as a meeting point where we exchange info on what's happening, all the time. Whenever an issue occurs, it's posted here, and so are solutions and workarounds.

 

That a big 10-4! 

[glnz]

w2k4eva - cool - thanks.

 

But what about Avast?  Who here has Avast Free on his XP machine?  Do you have the six Event Viewer errors?

[dencorso]

I use paid AVG: 2011 on 3 machines and 9.0 on one machine (an Asus EeePC 900). I've no experience whatsoever with Avast.

 

BTW, you forgot to answer w2k4eva's question below:

 

Just for giggles, are you able to use the UpdateCatalog on any/all of the user accounts on your machine? Do you even have more than one "real" user account?

[glnz]

Dencorso and w2k4eva - I was able to go to the UpdateCatalog per w2k4eva's instruction, but I'm up to date so don't want to download anything.

 

Just now, I "switched users" to the other user on my good XP machine.  Started an app - no problem.  Just logged out.

 

Is that the test?

[Bersaglio]

NEW Updates for .NET Frameworks released this month:

 

.NET Framework 1.1 SP1 (MS15-048):

http://download.microsoft.com/download/3/E/3/3E311496-3A6D-4156-941A-F8BE49D617C2/WindowsServer2003-KB3023211-x86-ENU.exe

This update can't be installed on XP without modification. And sadly we still don't have modified update KB3037572 (MS15-041) released in April.

 

The rest of the six updates (.NET Framework 2.0 SP2/.NET Framework 3.0 SP2/.NET Framework 4.0 Client/Extended) are fully XP compatible and can be installed without registry tweaks or modifications:

http://download.microsoft.com/download/5/2/C/52CDC545-676A-4BC8-BA7E-F7634A06205E/NDP20SP2-KB3023220-x86.exehttp://download.microsoft.com/download/2/9/B/29B473CB-63B7-4ED0-8A54-5F512AC2475F/NDP20SP2-KB3035488-x86.exehttp://download.microsoft.com/download/F/8/5/F859846E-37D4-422F-AA06-DA7F44EB3246/NDP30SP2-KB3048073-v2-x86.exehttp://download.microsoft.com/download/2/0/8/208D1422-5B68-4BEB-BFD2-6B860DA4F978/NDP40-KB3023221-x86.exehttp://download.microsoft.com/download/A/A/3/AA3F6C4D-0DC2-4074-9DAC-88FA3A8AFDD4/NDP40-KB3032662-x86.exehttp://download.microsoft.com/download/9/2/1/921E5232-83F4-43CA-8B28-6B4F2A4484F7/NDP40-KB3048074-x86.exe

Edited May 13, 2015 by Bersaglio