Symptom:
XP Users complaining of an error popup message on the Desktop which
indicates that a problem was found with the registry and that it has
been recovered. This messages seems to only appear when a users logs
onto their computer but not when a user unlocks the system to resume
their work.
Event Log message recorded:
Event ID 26: Source: Application popup: Windows - Registry Recovery :
One of the files containing the system's Registry data had to be
recovered by use of a log or alternate copy. The recovery was
successful.
It has been observed the neither performance of the OS or the
functionality of mainstream applications are compromised by this
occurrence.
Cause:
An XP operating system executes a Windows Update (either manually via
the web or automated through the SUS server) When the security update
KB840987 is installed and subsequently the computer is rebooted this
causes the error message to appear once the user logs in to their
system.
Mitigations:
Uninstall Windows Security Update KB840987
(
http://www.microsoft.com/technet/sec.../MS04-032.mspx)
However, this leaves the system exposed to the vulnerabilities (4
listed in the bulletin). In addition, uninstalling this patch will
cause Windows Security Update KB841533
(
http://www.microsoft.com/technet/sec.../MS04-031.mspx) to
be uninstalled as well. However, a workaround would be to disable the
NetDDE service. This service allows two applications to communicate
via the network. It's an older OS mechanism probably for applications
that cannot leverage the DCOM service which is the new method that is
used for this purpose.
Or
Install XP SP2
Or
Live w/ this error and remain protected against these vulnerabilities.