Re: IE 8 Install Caused Registry Damage

Short recap: You were dissatisfied with IE8's performance in WinXP SP2.
After uninstalling IE8, you found that Automatic Updates wasn't working and
that you couldn't reinstall McAfee Total Protection.

[Please note that failing to disable your real-time protections and failing
to make certain that your computer was 100% free of any/all hijackware,
etc., infections prior to installing SP3 wasn't a wise idea either.]

1. Can you reach http://windowsupdate.microsoft.com, select CUSTOM and scan
for updates? If so, are any critical security updates offered and can you
install them? (Do NOT reinstall IE8!)

2a. Start | Run | (type) SERVICES.MSN | OK => Is Automatic Updates service
enabled/running? If not, can you enable/start it?

=> Is Background Intelligent Transfer Service (BITS) enabled/running? If
not, can you enable/start it?

2b. Assuming you could enable/start both services, reboot & tell me if both
of them are still enabled/started?

3. Why do you need to reinstall McAfee Total Protection? Have you (or has
your employer) purchased it & is the subscription current?

4a. Open a new IE window to this page: http://aumha.org/mydetail.htm

4b. In the topmost box, highlight & Copy the first two (2) sections to your
clipboard then Paste the contents of your clipboard into a reply to this
post.

Example:

Browser Name: Microsoft Internet Explorer ver. 7.0

Browser & OS: (Major & Minor Version Information) 4.0 (compatible; MSIE
7.0; Windows NT 5.1; .NET CLR 1.1.4322; InfoPath.1; MS-RTC LM 8)

Comment: I suspect that formatting & then doing a clean install may be the
fastest way to resolve all of your problems, Eric.
--
~PA Bear

Eric G. wrote:
> Thanks for your response PA Bear.
>
> I agree that it is likely that, "failure to disable all real-time system
> protections (i.e.,
> anti-virus; anti-spyware; third-party firewall) prior to installing and/or
> uninstalling IE8 may have caused the problem".
>
> I did try to restore system from an earlier point first before installing
> SP3. It didn't resolve the problem.
>
> As asked in the other thread, how does the Windows Update determine what
> operating system I have on my machine? Is is from the registry
> (User-Agent
> or Curent Version items) or through an Active X control code some where on
> my hard drive?
>
> My machine performs OK with the exception of two things; 1. I cannot use
> Windows Update; 2. I canot re-install McAffey Total Conrol for Small
> Business malware protection.
>
> Without doing a clean install of XP, how can I fix the problem?
>
> "PA Bear [MS MVP]" wrote:
>> Yes, I frequently post that canned reply. 9 times out of 10, the OP to
>> whom I'm replying discovers that his problem was due to hijackware
>> infections, too.
>>
>> Unlikely, perhaps, but you cannot rule out the possibility of a
>> hijackware
>> infection causing the behaviors, Eric, despite your "layers of malware
>> protection." There isn't a security software combination on earth that
>> will stop or detect & remove all such infections.
>>
>> Then again, failure to disable all real-time system protections (i.e.,
>> anti-virus; anti-spyware; third-party firewall) prior to installing
>> and/or
>> uninstalling IE8 may have caused the problem, in which case I'd usually
>> recommend using System Restore but that's not an option now since you
>> later
>> installed SP3.
>>
>> But you don't certainly don't have to take my advice, since you can
>> always...
>>
>>>> Start a free Windows Update support incident request:
>>>> https://support.microsoft.com/oas/de...spx?gprid=6527
>>
>> Good luck.
>>
>> Eric G. wrote:
>>> I see that you have given this answer before to others. My system is
>>> continuously protected by several layers of malware protection both
>>> enterprise level and local. It is very unlikely that what you said
>>> occured.
>>>
>>> Per my initial question, what registry data is sent to Microsoft when
>>> connected to the Windows Update services. Where are the registry items
>>> located? What values should they be set at for Win XP vs. Vista?
>>>
>>> Thanks.
>>>
>>> "PA Bear [MS MVP]" wrote:
>>>> Thanks for clarifying.
>>>>
>>>> There is a very good chance that you are seeing the effects of a
>>>> hijackware
>>>> infection!
>>>>
>>>> NB: If you had no anti-virus application installed or the subscription
>>>> had
>>>> expired *when the machine first got infected* and/or your subscription
>>>> has
>>>> since expired and/or the machine's not been kept fully-patched at
>>>> Windows
>>>> Update, don't waste your time with any of the below: Format & reinstall
>>>> Windows. A Repair Install will NOT help!
>>>>
>>>> 1. See if you can download/run the MSRT manually:
>>>> http://www.microsoft.com/security/ma...e/default.mspx
>>>>
>>>> NB: Run the FULL scan, not the QUICK scan! You may need to download
>>>> the
>>>> MSRT on a non-infected machine, then transfer MRT.EXE to the infected
>>>> machine and rename it to SCAN.EXE before running it.
>>>>
>>>> 2. [WinXP ONLY!! =>] Run the Windows Live Safety Center's 'Protection'
>>>> scan
>>>> (only!) in Safe Mode with Networking, if need be:
>>>> http://onecare.live.com/site/en-us/center/howsafe.htm
>>>>
>>>> 3. Run a /thorough/ check for hijackware, including posting the
>>>> requested
>>>> logs in an appropriate forum, not here.
>>>>
>>>> Checking for/Help with Hijackware
>>>> http://aumha.net/viewtopic.php?f=30&t=4075
>>>> http://mvps.org/winhelp2002/unwanted.htm
>>>> http://inetexplorer.mvps.org/data/prevention.htm
>>>> http://inetexplorer.mvps.org/tshoot.html
>>>> http://www.mvps.org/sramesh2k/Malware_Defence.htm
>>>> http://www.elephantboycomputers.com/...moving_Malware
>>>>
>>>> **Chances are you will need to seek expert assistance in
>>>> http://spywarehammer.com/simplemachi...php?board=10.0,
>>>> http://www.spywarewarrior.com/viewforum.php?f=5,
>>>> http://www.dslreports.com/forum/cleanup,
>>>> http://www.bluetack.co.uk/forums/index.php,
>>>> http://aumha.net/viewforum.php?f=30 or other appropriate forums as
>>>> well.**
>>>>
>>>> If these procedures look too complex - and there is no shame in
>>>> admitting
>>>> this isn't your cup of tea - take the machine to a local, reputable and
>>>> independent (i.e., not BigBoxStoreUSA) computer repair shop.
>>>>
>>>> =====================
>>>> Start a free Windows Update support incident request:
>>>> https://support.microsoft.com/oas/de...spx?gprid=6527
>>>>
>>>> Support for Windows Update:
>>>> http://support.microsoft.com/gp/wusupport
>>>>
>>>> For home users, no-charge support is available by calling
>>>> 1-866-PCSAFETY
>>>> in
>>>> the United States and in Canada or by contacting your local Microsoft
>>>> subsidiary. There is no-charge for support calls that are associated
>>>> with
>>>> security updates.
>>>> --
>>>> ~Robear Dyer (PA Bear)
>>>> MS MVP-IE, Mail, Security, Windows Desktop Experience - since 2002
>>>>
>>>>
>>>> Eric G. wrote:
>>>>> Thanks for your response.
>>>>> To clairify = I installed IE8 while I was on SP2. I uninstalled IE8
>>>>> due
>>>>> to
>>>>> perceived slower performance than IE7. After the uninstall, I had the
>>>>> Windows Update problem.
>>>>> I installed SP3 in the hope that the problem would resolve itself.
>>>>> It didn't.
>>>>>
>>>>> "PA Bear [MS MVP]" wrote:
>>>>>> What does "I rolled back to IE7" mean and how did you do it?
>>>>>>
>>>>>> I'd very much doubt that installing the proper version of IE8 for
>>>>>> WinXP
>>>>>> SP3
>>>>>> and then *uninstalling* via Add/Remove Programs would have the effect
>>>>>> you
>>>>>> describe, Eric.
>>>>>>
>>>>>> If everything else is OK...
>>>>>>
>>>>>> Start a free Windows Update support incident request:
>>>>>> https://support.microsoft.com/oas/de...spx?gprid=6527
>>>>>>
>>>>>> For home users, no-charge support is available by calling
>>>>>> 1-866-PCSAFETY
>>>>>> in
>>>>>> the United States and in Canada or by contacting your local Microsoft
>>>>>> subsidiary. There is no-charge for support calls that are associated
>>>>>> with
>>>>>> Windos Update and/or installing security updates.
>>>>>> --
>>>>>> ~Robear Dyer (PA Bear)
>>>>>> MS MVP-Windows (IE, OE, Security, Shell/User)
>>>>>> AumHa VSOP & Admin; DTS-L.net
>>>>>>
>>>>>>
>>>>>> Eric G. wrote:
>>>>>>> Operating System - WIN XP SP3 - After install, IE8 performance was
>>>>>>> slower
>>>>>>> than IE7. So, I rolled back to IE7. Now I can't update WIN XP
>>>>>>> automatically. WIN Update detects operating-system version as Vista
>>>>>>> (Windows NT 6.0) NOT XP (Windows NT 5.1). System Information on my
>>>>>>> local
>>>>>>> machine says that I have Windows XP SP3 installed. Registry Entry
>>>>>>> for
>>>>>>> Windows XP has correct values. All other WIN XP functions work OK.
>>>>>>> Hwree
>>>>>>> does WIndows Update get the operating-system version info from?
>>>>>>>
>>>>>>> How do I fix registry (where?) so Windows Update detects correct
>>>>>>> operating
>>>>>>> system version and goes to correct page (not vistadefault.aspx but
>>>>>>> rather
>>>>>>> default.aspx)?

Thanks PA Bear.

I will work on this tomorrow.

Just to clairify, I cannot get to the WIN XP page on Windows Update site, I
just get to:
http://update.microsoft.com/windowsu....aspx?ln=en-us NOT
http://update.microsoft.com/windowsu....aspx?ln=en-us, as I
should.

This is the symptom I am trying to fix.

"PA Bear [MS MVP]" wrote:

> Short recap: You were dissatisfied with IE8's performance in WinXP SP2.
> After uninstalling IE8, you found that Automatic Updates wasn't working and
> that you couldn't reinstall McAfee Total Protection.
>
> [Please note that failing to disable your real-time protections and failing
> to make certain that your computer was 100% free of any/all hijackware,
> etc., infections prior to installing SP3 wasn't a wise idea either.]
>
> 1. Can you reach http://windowsupdate.microsoft.com, select CUSTOM and scan
> for updates? If so, are any critical security updates offered and can you
> install them? (Do NOT reinstall IE8!)
>
> 2a. Start | Run | (type) SERVICES.MSN | OK => Is Automatic Updates service
> enabled/running? If not, can you enable/start it?
>
> => Is Background Intelligent Transfer Service (BITS) enabled/running? If
> not, can you enable/start it?
>
> 2b. Assuming you could enable/start both services, reboot & tell me if both
> of them are still enabled/started?
>
> 3. Why do you need to reinstall McAfee Total Protection? Have you (or has
> your employer) purchased it & is the subscription current?
>
> 4a. Open a new IE window to this page: http://aumha.org/mydetail.htm
>
> 4b. In the topmost box, highlight & Copy the first two (2) sections to your
> clipboard then Paste the contents of your clipboard into a reply to this
> post.
>
> Example:
>
> Browser Name: Microsoft Internet Explorer ver. 7.0
>
> Browser & OS: (Major & Minor Version Information) 4.0 (compatible; MSIE
> 7.0; Windows NT 5.1; .NET CLR 1.1.4322; InfoPath.1; MS-RTC LM 8)
>
> Comment: I suspect that formatting & then doing a clean install may be the
> fastest way to resolve all of your problems, Eric.
> --
> ~PA Bear
>
> Eric G. wrote:
> > Thanks for your response PA Bear.
> >
> > I agree that it is likely that, "failure to disable all real-time system
> > protections (i.e.,
> > anti-virus; anti-spyware; third-party firewall) prior to installing and/or
> > uninstalling IE8 may have caused the problem".
> >
> > I did try to restore system from an earlier point first before installing
> > SP3. It didn't resolve the problem.
> >
> > As asked in the other thread, how does the Windows Update determine what
> > operating system I have on my machine? Is is from the registry
> > (User-Agent
> > or Curent Version items) or through an Active X control code some where on
> > my hard drive?
> >
> > My machine performs OK with the exception of two things; 1. I cannot use
> > Windows Update; 2. I canot re-install McAffey Total Conrol for Small
> > Business malware protection.
> >
> > Without doing a clean install of XP, how can I fix the problem?
> >
> > "PA Bear [MS MVP]" wrote:
> >> Yes, I frequently post that canned reply. 9 times out of 10, the OP to
> >> whom I'm replying discovers that his problem was due to hijackware
> >> infections, too.
> >>
> >> Unlikely, perhaps, but you cannot rule out the possibility of a
> >> hijackware
> >> infection causing the behaviors, Eric, despite your "layers of malware
> >> protection." There isn't a security software combination on earth that
> >> will stop or detect & remove all such infections.
> >>
> >> Then again, failure to disable all real-time system protections (i.e.,
> >> anti-virus; anti-spyware; third-party firewall) prior to installing
> >> and/or
> >> uninstalling IE8 may have caused the problem, in which case I'd usually
> >> recommend using System Restore but that's not an option now since you
> >> later
> >> installed SP3.
> >>
> >> But you don't certainly don't have to take my advice, since you can
> >> always...
> >>
> >>>> Start a free Windows Update support incident request:
> >>>> https://support.microsoft.com/oas/de...spx?gprid=6527
> >>
> >> Good luck.
> >>
> >> Eric G. wrote:
> >>> I see that you have given this answer before to others. My system is
> >>> continuously protected by several layers of malware protection both
> >>> enterprise level and local. It is very unlikely that what you said
> >>> occured.
> >>>
> >>> Per my initial question, what registry data is sent to Microsoft when
> >>> connected to the Windows Update services. Where are the registry items
> >>> located? What values should they be set at for Win XP vs. Vista?
> >>>
> >>> Thanks.
> >>>
> >>> "PA Bear [MS MVP]" wrote:
> >>>> Thanks for clarifying.
> >>>>
> >>>> There is a very good chance that you are seeing the effects of a
> >>>> hijackware
> >>>> infection!
> >>>>
> >>>> NB: If you had no anti-virus application installed or the subscription
> >>>> had
> >>>> expired *when the machine first got infected* and/or your subscription
> >>>> has
> >>>> since expired and/or the machine's not been kept fully-patched at
> >>>> Windows
> >>>> Update, don't waste your time with any of the below: Format & reinstall
> >>>> Windows. A Repair Install will NOT help!
> >>>>
> >>>> 1. See if you can download/run the MSRT manually:
> >>>> http://www.microsoft.com/security/ma...e/default.mspx
> >>>>
> >>>> NB: Run the FULL scan, not the QUICK scan! You may need to download
> >>>> the
> >>>> MSRT on a non-infected machine, then transfer MRT.EXE to the infected
> >>>> machine and rename it to SCAN.EXE before running it.
> >>>>
> >>>> 2. [WinXP ONLY!! =>] Run the Windows Live Safety Center's 'Protection'
> >>>> scan
> >>>> (only!) in Safe Mode with Networking, if need be:
> >>>> http://onecare.live.com/site/en-us/center/howsafe.htm
> >>>>
> >>>> 3. Run a /thorough/ check for hijackware, including posting the
> >>>> requested
> >>>> logs in an appropriate forum, not here.
> >>>>
> >>>> Checking for/Help with Hijackware
> >>>> http://aumha.net/viewtopic.php?f=30&t=4075
> >>>> http://mvps.org/winhelp2002/unwanted.htm
> >>>> http://inetexplorer.mvps.org/data/prevention.htm
> >>>> http://inetexplorer.mvps.org/tshoot.html
> >>>> http://www.mvps.org/sramesh2k/Malware_Defence.htm
> >>>> http://www.elephantboycomputers.com/...moving_Malware
> >>>>
> >>>> **Chances are you will need to seek expert assistance in
> >>>> http://spywarehammer.com/simplemachi...php?board=10.0,
> >>>> http://www.spywarewarrior.com/viewforum.php?f=5,
> >>>> http://www.dslreports.com/forum/cleanup,
> >>>> http://www.bluetack.co.uk/forums/index.php,
> >>>> http://aumha.net/viewforum.php?f=30 or other appropriate forums as
> >>>> well.**
> >>>>
> >>>> If these procedures look too complex - and there is no shame in
> >>>> admitting
> >>>> this isn't your cup of tea - take the machine to a local, reputable and
> >>>> independent (i.e., not BigBoxStoreUSA) computer repair shop.
> >>>>
> >>>> =====================
> >>>> Start a free Windows Update support incident request:
> >>>> https://support.microsoft.com/oas/de...spx?gprid=6527
> >>>>
> >>>> Support for Windows Update:
> >>>> http://support.microsoft.com/gp/wusupport
> >>>>
> >>>> For home users, no-charge support is available by calling
> >>>> 1-866-PCSAFETY
> >>>> in
> >>>> the United States and in Canada or by contacting your local Microsoft
> >>>> subsidiary. There is no-charge for support calls that are associated
> >>>> with
> >>>> security updates.
> >>>> --
> >>>> ~Robear Dyer (PA Bear)
> >>>> MS MVP-IE, Mail, Security, Windows Desktop Experience - since 2002
> >>>>
> >>>>
> >>>> Eric G. wrote:
> >>>>> Thanks for your response.
> >>>>> To clairify = I installed IE8 while I was on SP2. I uninstalled IE8
> >>>>> due
> >>>>> to
> >>>>> perceived slower performance than IE7. After the uninstall, I had the
> >>>>> Windows Update problem.
> >>>>> I installed SP3 in the hope that the problem would resolve itself.
> >>>>> It didn't.
> >>>>>
> >>>>> "PA Bear [MS MVP]" wrote:
> >>>>>> What does "I rolled back to IE7" mean and how did you do it?
> >>>>>>
> >>>>>> I'd very much doubt that installing the proper version of IE8 for
> >>>>>> WinXP
> >>>>>> SP3
> >>>>>> and then *uninstalling* via Add/Remove Programs would have the effect
> >>>>>> you
> >>>>>> describe, Eric.
> >>>>>>
> >>>>>> If everything else is OK...
> >>>>>>
> >>>>>> Start a free Windows Update support incident request:
> >>>>>> https://support.microsoft.com/oas/de...spx?gprid=6527
> >>>>>>
> >>>>>> For home users, no-charge support is available by calling
> >>>>>> 1-866-PCSAFETY
> >>>>>> in
> >>>>>> the United States and in Canada or by contacting your local Microsoft
> >>>>>> subsidiary. There is no-charge for support calls that are associated
> >>>>>> with
> >>>>>> Windos Update and/or installing security updates.
> >>>>>> --
> >>>>>> ~Robear Dyer (PA Bear)
> >>>>>> MS MVP-Windows (IE, OE, Security, Shell/User)
> >>>>>> AumHa VSOP & Admin; DTS-L.net
> >>>>>>
> >>>>>>
> >>>>>> Eric G. wrote:
> >>>>>>> Operating System - WIN XP SP3 - After install, IE8 performance was
> >>>>>>> slower
> >>>>>>> than IE7. So, I rolled back to IE7. Now I can't update WIN XP
> >>>>>>> automatically. WIN Update detects operating-system version as Vista
> >>>>>>> (Windows NT 6.0) NOT XP (Windows NT 5.1). System Information on my
> >>>>>>> local
> >>>>>>> machine says that I have Windows XP SP3 installed. Registry Entry
> >>>>>>> for
> >>>>>>> Windows XP has correct values. All other WIN XP functions work OK.
> >>>>>>> Hwree
> >>>>>>> does WIndows Update get the operating-system version info from?
> >>>>>>>
> >>>>>>> How do I fix registry (where?) so Windows Update detects correct
> >>>>>>> operating
> >>>>>>> system version and goes to correct page (not vistadefault.aspx but
> >>>>>>> rather
> >>>>>>> default.aspx)?
>
>

Yes, I understand.

NB: There's a typo in #2a in my previous reply!

> Start | Run | (type) SERVICES.MSN | OK

should read

Start | Run | (type) SERVICES.MSC | OK

Please answer my questions by number when you reply, don't try to post them
inline.

Eric G. wrote:
> Thanks PA Bear.
>
> I will work on this tomorrow.
>
> Just to clairify, I cannot get to the WIN XP page on Windows Update site,
> I
> just get to:
> http://update.microsoft.com/windowsu....aspx?ln=en-us
> NOT
> http://update.microsoft.com/windowsu....aspx?ln=en-us, as I
> should.
>
> This is the symptom I am trying to fix.
>
> "PA Bear [MS MVP]" wrote:
>
>> Short recap: You were dissatisfied with IE8's performance in WinXP SP2.
>> After uninstalling IE8, you found that Automatic Updates wasn't working
>> and
>> that you couldn't reinstall McAfee Total Protection.
>>
>> [Please note that failing to disable your real-time protections and
>> failing
>> to make certain that your computer was 100% free of any/all hijackware,
>> etc., infections prior to installing SP3 wasn't a wise idea either.]
>>
>> 1. Can you reach http://windowsupdate.microsoft.com, select CUSTOM and
>> scan
>> for updates? If so, are any critical security updates offered and can
>> you
>> install them? (Do NOT reinstall IE8!)
>>
>> 2a. Start | Run | (type) SERVICES.MSN | OK => Is Automatic Updates
>> service
>> enabled/running? If not, can you enable/start it?
>>
>> => Is Background Intelligent Transfer Service (BITS) enabled/running? If
>> not, can you enable/start it?
>>
>> 2b. Assuming you could enable/start both services, reboot & tell me if
>> both
>> of them are still enabled/started?
>>
>> 3. Why do you need to reinstall McAfee Total Protection? Have you (or
>> has
>> your employer) purchased it & is the subscription current?
>>
>> 4a. Open a new IE window to this page: http://aumha.org/mydetail.htm
>>
>> 4b. In the topmost box, highlight & Copy the first two (2) sections to
>> your
>> clipboard then Paste the contents of your clipboard into a reply to this
>> post.
>>
>> Example:
>>
>> Browser Name: Microsoft Internet Explorer ver. 7.0
>>
>> Browser & OS: (Major & Minor Version Information) 4.0 (compatible;
>> MSIE
>> 7.0; Windows NT 5.1; .NET CLR 1.1.4322; InfoPath.1; MS-RTC LM 8)
>>
>> Comment: I suspect that formatting & then doing a clean install may be
>> the
>> fastest way to resolve all of your problems, Eric.
>> --
>> ~PA Bear
>>
>> Eric G. wrote:
>>> Thanks for your response PA Bear.
>>>
>>> I agree that it is likely that, "failure to disable all real-time system
>>> protections (i.e.,
>>> anti-virus; anti-spyware; third-party firewall) prior to installing
>>> and/or
>>> uninstalling IE8 may have caused the problem".
>>>
>>> I did try to restore system from an earlier point first before
>>> installing
>>> SP3. It didn't resolve the problem.
>>>
>>> As asked in the other thread, how does the Windows Update determine what
>>> operating system I have on my machine? Is is from the registry
>>> (User-Agent
>>> or Curent Version items) or through an Active X control code some where
>>> on
>>> my hard drive?
>>>
>>> My machine performs OK with the exception of two things; 1. I cannot use
>>> Windows Update; 2. I canot re-install McAffey Total Conrol for Small
>>> Business malware protection.
>>>
>>> Without doing a clean install of XP, how can I fix the problem?
>>>
>>> "PA Bear [MS MVP]" wrote:
>>>> Yes, I frequently post that canned reply. 9 times out of 10, the OP to
>>>> whom I'm replying discovers that his problem was due to hijackware
>>>> infections, too.
>>>>
>>>> Unlikely, perhaps, but you cannot rule out the possibility of a
>>>> hijackware
>>>> infection causing the behaviors, Eric, despite your "layers of malware
>>>> protection." There isn't a security software combination on earth that
>>>> will stop or detect & remove all such infections.
>>>>
>>>> Then again, failure to disable all real-time system protections (i.e.,
>>>> anti-virus; anti-spyware; third-party firewall) prior to installing
>>>> and/or
>>>> uninstalling IE8 may have caused the problem, in which case I'd usually
>>>> recommend using System Restore but that's not an option now since you
>>>> later
>>>> installed SP3.
>>>>
>>>> But you don't certainly don't have to take my advice, since you can
>>>> always...
>>>>
>>>>>> Start a free Windows Update support incident request:
>>>>>> https://support.microsoft.com/oas/de...spx?gprid=6527
>>>>
>>>> Good luck.
>>>>
>>>> Eric G. wrote:
>>>>> I see that you have given this answer before to others. My system is
>>>>> continuously protected by several layers of malware protection both
>>>>> enterprise level and local. It is very unlikely that what you said
>>>>> occured.
>>>>>
>>>>> Per my initial question, what registry data is sent to Microsoft when
>>>>> connected to the Windows Update services. Where are the registry
>>>>> items
>>>>> located? What values should they be set at for Win XP vs. Vista?
>>>>>
>>>>> Thanks.
>>>>>
>>>>> "PA Bear [MS MVP]" wrote:
>>>>>> Thanks for clarifying.
>>>>>>
>>>>>> There is a very good chance that you are seeing the effects of a
>>>>>> hijackware
>>>>>> infection!
>>>>>>
>>>>>> NB: If you had no anti-virus application installed or the
>>>>>> subscription
>>>>>> had
>>>>>> expired *when the machine first got infected* and/or your
>>>>>> subscription
>>>>>> has
>>>>>> since expired and/or the machine's not been kept fully-patched at
>>>>>> Windows
>>>>>> Update, don't waste your time with any of the below: Format &
>>>>>> reinstall
>>>>>> Windows. A Repair Install will NOT help!
>>>>>>
>>>>>> 1. See if you can download/run the MSRT manually:
>>>>>> http://www.microsoft.com/security/ma...e/default.mspx
>>>>>>
>>>>>> NB: Run the FULL scan, not the QUICK scan! You may need to download
>>>>>> the
>>>>>> MSRT on a non-infected machine, then transfer MRT.EXE to the infected
>>>>>> machine and rename it to SCAN.EXE before running it.
>>>>>>
>>>>>> 2. [WinXP ONLY!! =>] Run the Windows Live Safety Center's
>>>>>> 'Protection'
>>>>>> scan
>>>>>> (only!) in Safe Mode with Networking, if need be:
>>>>>> http://onecare.live.com/site/en-us/center/howsafe.htm
>>>>>>
>>>>>> 3. Run a /thorough/ check for hijackware, including posting the
>>>>>> requested
>>>>>> logs in an appropriate forum, not here.
>>>>>>
>>>>>> Checking for/Help with Hijackware
>>>>>> http://aumha.net/viewtopic.php?f=30&t=4075
>>>>>> http://mvps.org/winhelp2002/unwanted.htm
>>>>>> http://inetexplorer.mvps.org/data/prevention.htm
>>>>>> http://inetexplorer.mvps.org/tshoot.html
>>>>>> http://www.mvps.org/sramesh2k/Malware_Defence.htm
>>>>>> http://www.elephantboycomputers.com/...moving_Malware
>>>>>>
>>>>>> **Chances are you will need to seek expert assistance in
>>>>>> http://spywarehammer.com/simplemachi...php?board=10.0,
>>>>>> http://www.spywarewarrior.com/viewforum.php?f=5,
>>>>>> http://www.dslreports.com/forum/cleanup,
>>>>>> http://www.bluetack.co.uk/forums/index.php,
>>>>>> http://aumha.net/viewforum.php?f=30 or other appropriate forums as
>>>>>> well.**
>>>>>>
>>>>>> If these procedures look too complex - and there is no shame in
>>>>>> admitting
>>>>>> this isn't your cup of tea - take the machine to a local, reputable
>>>>>> and
>>>>>> independent (i.e., not BigBoxStoreUSA) computer repair shop.
>>>>>>
>>>>>> =====================
>>>>>> Start a free Windows Update support incident request:
>>>>>> https://support.microsoft.com/oas/de...spx?gprid=6527
>>>>>>
>>>>>> Support for Windows Update:
>>>>>> http://support.microsoft.com/gp/wusupport
>>>>>>
>>>>>> For home users, no-charge support is available by calling
>>>>>> 1-866-PCSAFETY
>>>>>> in
>>>>>> the United States and in Canada or by contacting your local Microsoft
>>>>>> subsidiary. There is no-charge for support calls that are associated
>>>>>> with
>>>>>> security updates.
>>>>>> --
>>>>>> ~Robear Dyer (PA Bear)
>>>>>> MS MVP-IE, Mail, Security, Windows Desktop Experience - since 2002
>>>>>>
>>>>>>
>>>>>> Eric G. wrote:
>>>>>>> Thanks for your response.
>>>>>>> To clairify = I installed IE8 while I was on SP2. I uninstalled
>>>>>>> IE8
>>>>>>> due
>>>>>>> to
>>>>>>> perceived slower performance than IE7. After the uninstall, I had
>>>>>>> the
>>>>>>> Windows Update problem.
>>>>>>> I installed SP3 in the hope that the problem would resolve itself.
>>>>>>> It didn't.
>>>>>>>
>>>>>>> "PA Bear [MS MVP]" wrote:
>>>>>>>> What does "I rolled back to IE7" mean and how did you do it?
>>>>>>>>
>>>>>>>> I'd very much doubt that installing the proper version of IE8 for
>>>>>>>> WinXP
>>>>>>>> SP3
>>>>>>>> and then *uninstalling* via Add/Remove Programs would have the
>>>>>>>> effect
>>>>>>>> you
>>>>>>>> describe, Eric.
>>>>>>>>
>>>>>>>> If everything else is OK...
>>>>>>>>
>>>>>>>> Start a free Windows Update support incident request:
>>>>>>>> https://support.microsoft.com/oas/de...spx?gprid=6527
>>>>>>>>
>>>>>>>> For home users, no-charge support is available by calling
>>>>>>>> 1-866-PCSAFETY
>>>>>>>> in
>>>>>>>> the United States and in Canada or by contacting your local
>>>>>>>> Microsoft
>>>>>>>> subsidiary. There is no-charge for support calls that are
>>>>>>>> associated
>>>>>>>> with
>>>>>>>> Windos Update and/or installing security updates.
>>>>>>>> --
>>>>>>>> ~Robear Dyer (PA Bear)
>>>>>>>> MS MVP-Windows (IE, OE, Security, Shell/User)
>>>>>>>> AumHa VSOP & Admin; DTS-L.net
>>>>>>>>
>>>>>>>>
>>>>>>>> Eric G. wrote:
>>>>>>>>> Operating System - WIN XP SP3 - After install, IE8 performance was
>>>>>>>>> slower
>>>>>>>>> than IE7. So, I rolled back to IE7. Now I can't update WIN XP
>>>>>>>>> automatically. WIN Update detects operating-system version as
>>>>>>>>> Vista
>>>>>>>>> (Windows NT 6.0) NOT XP (Windows NT 5.1). System Information on
>>>>>>>>> my
>>>>>>>>> local
>>>>>>>>> machine says that I have Windows XP SP3 installed. Registry Entry
>>>>>>>>> for
>>>>>>>>> Windows XP has correct values. All other WIN XP functions work OK.
>>>>>>>>> Hwree
>>>>>>>>> does WIndows Update get the operating-system version info from?
>>>>>>>>>
>>>>>>>>> How do I fix registry (where?) so Windows Update detects correct
>>>>>>>>> operating
>>>>>>>>> system version and goes to correct page (not vistadefault.aspx but
>>>>>>>>> rather
>>>>>>>>> default.aspx)?

If you'd answered my questions, especially #4a and #4b, I probably would
have been able to assist you with this, Eric.

Note, too, that you failed to disable all real-time system protections when
you installed IE8. And I suspect you also have the Office Live add-in
installed which is the primary suspect here.

Good luck.


Eric G. wrote:
> HI PA Bear,
>
> I finally resolved the problem.
>
> A change was made to the registry at the time of installation or
> uninstallation of IE8. I DID NOT MANUALLY MAKE THIS CHANGE.
>
> Vales were added to the item:
> "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Cur rentVersion\Internet
> Settings\5.0\User Agent"
>
> was written to the registry. From checks made to three other WIN XP
> installations on different machines, these values were not in this
> registry
> item. So it must have been created during the install or unintall of IE8.
>
> My troubleshooting process:
> - Research revealed that a USER-AGENT header is sent to a website with
> Operating system version, etc. data.
> - I asked you and others a question that was never answered and would have
> saved me quite a bit of time, where does the header get the data from? I
> guess I should have also asked, what registry setting would overide the
> correct data?
> - I found an web article titled "Masquerading Your Browser" by Eric
> Giguere
> written in 2003
> (http://www.ericgiguere.com/articles/...r-browser.html).
> Thsi
> described the User-Agent header and where the info. could be overode.
> - I went to:
> "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Cur rentVersion\Internet
> Settings\5.0\User Agent", and found the Platform key was Windows NT 6.0.
> I
> changed it to 5.1.
>
> Windows Update has worked properly thereafter. I am choosing to leave the
> values in the registry, as my company has WIN XP as the corporate OS
> standard. I do not know when and if we will go to WIN 7. If the OS does
> get
> changed, I can look at theis registry setting and edit it if necessary.
>
> So, my conclusion is that the uninstall of IE somehow changed the registry
> key.
>
> There must be a bug in the install or uninstall process with IE. There
> should be a warning to users about this.
>
>
> "PA Bear [MS MVP]" wrote:
>
>> Yes, I understand.
>>
>> NB: There's a typo in #2a in my previous reply!
>>
>>> Start | Run | (type) SERVICES.MSN | OK
>>
>> should read
>>
>> Start | Run | (type) SERVICES.MSC | OK
>>
>> Please answer my questions by number when you reply, don't try to post
>> them
>> inline.
>>
>> Eric G. wrote:
>>> Thanks PA Bear.
>>>
>>> I will work on this tomorrow.
>>>
>>> Just to clairify, I cannot get to the WIN XP page on Windows Update
>>> site,
>>> I
>>> just get to:
>>> http://update.microsoft.com/windowsu....aspx?ln=en-us
>>> NOT
>>> http://update.microsoft.com/windowsu....aspx?ln=en-us, as I
>>> should.
>>>
>>> This is the symptom I am trying to fix.
>>>
>>> "PA Bear [MS MVP]" wrote:
>>>
>>>> Short recap: You were dissatisfied with IE8's performance in WinXP SP2.
>>>> After uninstalling IE8, you found that Automatic Updates wasn't working
>>>> and
>>>> that you couldn't reinstall McAfee Total Protection.
>>>>
>>>> [Please note that failing to disable your real-time protections and
>>>> failing
>>>> to make certain that your computer was 100% free of any/all hijackware,
>>>> etc., infections prior to installing SP3 wasn't a wise idea either.]
>>>>
>>>> 1. Can you reach http://windowsupdate.microsoft.com, select CUSTOM and
>>>> scan
>>>> for updates? If so, are any critical security updates offered and can
>>>> you
>>>> install them? (Do NOT reinstall IE8!)
>>>>
>>>> 2a. Start | Run | (type) SERVICES.MSN | OK => Is Automatic Updates
>>>> service
>>>> enabled/running? If not, can you enable/start it?
>>>>
>>>> => Is Background Intelligent Transfer Service (BITS) enabled/running?
>>>> If
>>>> not, can you enable/start it?
>>>>
>>>> 2b. Assuming you could enable/start both services, reboot & tell me if
>>>> both
>>>> of them are still enabled/started?
>>>>
>>>> 3. Why do you need to reinstall McAfee Total Protection? Have you (or
>>>> has
>>>> your employer) purchased it & is the subscription current?
>>>>
>>>> 4a. Open a new IE window to this page: http://aumha.org/mydetail.htm
>>>>
>>>> 4b. In the topmost box, highlight & Copy the first two (2) sections to
>>>> your
>>>> clipboard then Paste the contents of your clipboard into a reply to
>>>> this
>>>> post.
>>>>
>>>> Example:
>>>>
>>>> Browser Name: Microsoft Internet Explorer ver. 7.0
>>>>
>>>> Browser & OS: (Major & Minor Version Information) 4.0 (compatible;
>>>> MSIE
>>>> 7.0; Windows NT 5.1; .NET CLR 1.1.4322; InfoPath.1; MS-RTC LM 8)
>>>>
>>>> Comment: I suspect that formatting & then doing a clean install may be
>>>> the
>>>> fastest way to resolve all of your problems, Eric.
>>>> --
>>>> ~PA Bear
>>>>
>>>> Eric G. wrote:
>>>>> Thanks for your response PA Bear.
>>>>>
>>>>> I agree that it is likely that, "failure to disable all real-time
>>>>> system
>>>>> protections (i.e.,
>>>>> anti-virus; anti-spyware; third-party firewall) prior to installing
>>>>> and/or
>>>>> uninstalling IE8 may have caused the problem".
>>>>>
>>>>> I did try to restore system from an earlier point first before
>>>>> installing
>>>>> SP3. It didn't resolve the problem.
>>>>>
>>>>> As asked in the other thread, how does the Windows Update determine
>>>>> what
>>>>> operating system I have on my machine? Is is from the registry
>>>>> (User-Agent
>>>>> or Curent Version items) or through an Active X control code some
>>>>> where
>>>>> on
>>>>> my hard drive?
>>>>>
>>>>> My machine performs OK with the exception of two things; 1. I cannot
>>>>> use
>>>>> Windows Update; 2. I canot re-install McAffey Total Conrol for Small
>>>>> Business malware protection.
>>>>>
>>>>> Without doing a clean install of XP, how can I fix the problem?
>>>>>
>>>>> "PA Bear [MS MVP]" wrote:
>>>>>> Yes, I frequently post that canned reply. 9 times out of 10, the OP
>>>>>> to
>>>>>> whom I'm replying discovers that his problem was due to hijackware
>>>>>> infections, too.
>>>>>>
>>>>>> Unlikely, perhaps, but you cannot rule out the possibility of a
>>>>>> hijackware
>>>>>> infection causing the behaviors, Eric, despite your "layers of
>>>>>> malware
>>>>>> protection." There isn't a security software combination on earth
>>>>>> that
>>>>>> will stop or detect & remove all such infections.
>>>>>>
>>>>>> Then again, failure to disable all real-time system protections
>>>>>> (i.e.,
>>>>>> anti-virus; anti-spyware; third-party firewall) prior to installing
>>>>>> and/or
>>>>>> uninstalling IE8 may have caused the problem, in which case I'd
>>>>>> usually
>>>>>> recommend using System Restore but that's not an option now since you
>>>>>> later
>>>>>> installed SP3.
>>>>>>
>>>>>> But you don't certainly don't have to take my advice, since you can
>>>>>> always...
>>>>>>
>>>>>>>> Start a free Windows Update support incident request:
>>>>>>>> https://support.microsoft.com/oas/de...spx?gprid=6527
>>>>>>
>>>>>> Good luck.
>>>>>>
>>>>>> Eric G. wrote:
>>>>>>> I see that you have given this answer before to others. My system
>>>>>>> is
>>>>>>> continuously protected by several layers of malware protection both
>>>>>>> enterprise level and local. It is very unlikely that what you said
>>>>>>> occured.
>>>>>>>
>>>>>>> Per my initial question, what registry data is sent to Microsoft
>>>>>>> when
>>>>>>> connected to the Windows Update services. Where are the registry
>>>>>>> items
>>>>>>> located? What values should they be set at for Win XP vs. Vista?
>>>>>>>
>>>>>>> Thanks.
>>>>>>>
>>>>>>> "PA Bear [MS MVP]" wrote:
>>>>>>>> Thanks for clarifying.
>>>>>>>>
>>>>>>>> There is a very good chance that you are seeing the effects of a
>>>>>>>> hijackware
>>>>>>>> infection!
>>>>>>>>
>>>>>>>> NB: If you had no anti-virus application installed or the
>>>>>>>> subscription
>>>>>>>> had
>>>>>>>> expired *when the machine first got infected* and/or your
>>>>>>>> subscription
>>>>>>>> has
>>>>>>>> since expired and/or the machine's not been kept fully-patched at
>>>>>>>> Windows
>>>>>>>> Update, don't waste your time with any of the below: Format &
>>>>>>>> reinstall
>>>>>>>> Windows. A Repair Install will NOT help!
>>>>>>>>
>>>>>>>> 1. See if you can download/run the MSRT manually:
>>>>>>>> http://www.microsoft.com/security/ma...e/default.mspx
>>>>>>>>
>>>>>>>> NB: Run the FULL scan, not the QUICK scan! You may need to
>>>>>>>> download
>>>>>>>> the
>>>>>>>> MSRT on a non-infected machine, then transfer MRT.EXE to the
>>>>>>>> infected
>>>>>>>> machine and rename it to SCAN.EXE before running it.
>>>>>>>>
>>>>>>>> 2. [WinXP ONLY!! =>] Run the Windows Live Safety Center's
>>>>>>>> 'Protection'
>>>>>>>> scan
>>>>>>>> (only!) in Safe Mode with Networking, if need be:
>>>>>>>> http://onecare.live.com/site/en-us/center/howsafe.htm
>>>>>>>>
>>>>>>>> 3. Run a /thorough/ check for hijackware, including posting the
>>>>>>>> requested
>>>>>>>> logs in an appropriate forum, not here.
>>>>>>>>
>>>>>>>> Checking for/Help with Hijackware
>>>>>>>> http://aumha.net/viewtopic.php?f=30&t=4075
>>>>>>>> http://mvps.org/winhelp2002/unwanted.htm
>>>>>>>> http://inetexplorer.mvps.org/data/prevention.htm
>>>>>>>> http://inetexplorer.mvps.org/tshoot.html
>>>>>>>> http://www.mvps.org/sramesh2k/Malware_Defence.htm
>>>>>>>> http://www.elephantboycomputers.com/...moving_Malware
>>>>>>>>
>>>>>>>> **Chances are you will need to seek expert assistance in
>>>>>>>> http://spywarehammer.com/simplemachi...php?board=10.0,
>>>>>>>> http://www.spywarewarrior.com/viewforum.php?f=5,
>>>>>>>> http://www.dslreports.com/forum/cleanup,
>>>>>>>> http://www.bluetack.co.uk/forums/index.php,
>>>>>>>> http://aumha.net/viewforum.php?f=30 or other appropriate forums as
>>>>>>>> well.**
>>>>>>>>
>>>>>>>> If these procedures look too complex - and there is no shame in
>>>>>>>> admitting
>>>>>>>> this isn't your cup of tea - take the machine to a local, reputable
>>>>>>>> and
>>>>>>>> independent (i.e., not BigBoxStoreUSA) computer repair shop.
>>>>>>>>
>>>>>>>> =====================
>>>>>>>> Start a free Windows Update support incident request:
>>>>>>>> https://support.microsoft.com/oas/de...spx?gprid=6527
>>>>>>>>
>>>>>>>> Support for Windows Update:
>>>>>>>> http://support.microsoft.com/gp/wusupport
>>>>>>>>
>>>>>>>> For home users, no-charge support is available by calling
>>>>>>>> 1-866-PCSAFETY
>>>>>>>> in
>>>>>>>> the United States and in Canada or by contacting your local
>>>>>>>> Microsoft
>>>>>>>> subsidiary. There is no-charge for support calls that are
>>>>>>>> associated
>>>>>>>> with
>>>>>>>> security updates.
>>>>>>>> --
>>>>>>>> ~Robear Dyer (PA Bear)
>>>>>>>> MS MVP-IE, Mail, Security, Windows Desktop Experience - since 2002
>>>>>>>>
>>>>>>>>
>>>>>>>> Eric G. wrote:
>>>>>>>>> Thanks for your response.
>>>>>>>>> To clairify = I installed IE8 while I was on SP2. I uninstalled
>>>>>>>>> IE8
>>>>>>>>> due
>>>>>>>>> to
>>>>>>>>> perceived slower performance than IE7. After the uninstall, I had
>>>>>>>>> the
>>>>>>>>> Windows Update problem.
>>>>>>>>> I installed SP3 in the hope that the problem would resolve itself.
>>>>>>>>> It didn't.
>>>>>>>>>
>>>>>>>>> "PA Bear [MS MVP]" wrote:
>>>>>>>>>> What does "I rolled back to IE7" mean and how did you do it?
>>>>>>>>>>
>>>>>>>>>> I'd very much doubt that installing the proper version of IE8 for
>>>>>>>>>> WinXP
>>>>>>>>>> SP3
>>>>>>>>>> and then *uninstalling* via Add/Remove Programs would have the
>>>>>>>>>> effect
>>>>>>>>>> you
>>>>>>>>>> describe, Eric.
>>>>>>>>>>
>>>>>>>>>> If everything else is OK...
>>>>>>>>>>
>>>>>>>>>> Start a free Windows Update support incident request:
>>>>>>>>>> https://support.microsoft.com/oas/de...spx?gprid=6527
>>>>>>>>>>
>>>>>>>>>> For home users, no-charge support is available by calling
>>>>>>>>>> 1-866-PCSAFETY
>>>>>>>>>> in
>>>>>>>>>> the United States and in Canada or by contacting your local
>>>>>>>>>> Microsoft
>>>>>>>>>> subsidiary. There is no-charge for support calls that are
>>>>>>>>>> associated
>>>>>>>>>> with
>>>>>>>>>> Windos Update and/or installing security updates.
>>>>>>>>>> --
>>>>>>>>>> ~Robear Dyer (PA Bear)
>>>>>>>>>> MS MVP-Windows (IE, OE, Security, Shell/User)
>>>>>>>>>> AumHa VSOP & Admin; DTS-L.net
>>>>>>>>>>
>>>>>>>>>>
>>>>>>>>>> Eric G. wrote:
>>>>>>>>>>> Operating System - WIN XP SP3 - After install, IE8 performance
>>>>>>>>>>> was
>>>>>>>>>>> slower
>>>>>>>>>>> than IE7. So, I rolled back to IE7. Now I can't update WIN XP
>>>>>>>>>>> automatically. WIN Update detects operating-system version as
>>>>>>>>>>> Vista
>>>>>>>>>>> (Windows NT 6.0) NOT XP (Windows NT 5.1). System Information on
>>>>>>>>>>> my
>>>>>>>>>>> local
>>>>>>>>>>> machine says that I have Windows XP SP3 installed. Registry
>>>>>>>>>>> Entry
>>>>>>>>>>> for
>>>>>>>>>>> Windows XP has correct values. All other WIN XP functions work
>>>>>>>>>>> OK.
>>>>>>>>>>> Hwree
>>>>>>>>>>> does WIndows Update get the operating-system version info from?
>>>>>>>>>>>
>>>>>>>>>>> How do I fix registry (where?) so Windows Update detects correct
>>>>>>>>>>> operating
>>>>>>>>>>> system version and goes to correct page (not vistadefault.aspx
>>>>>>>>>>> but
>>>>>>>>>>> rather
>>>>>>>>>>> default.aspx)?