Storing Cookies (See : http://ec.europa.eu/ipg/basics/legal/cookies/index_en.htm ) help us to bring you our services at overunity.com . If you use this website and our services you declare yourself okay with using cookies .More Infos here:
https://overunity.com/5553/privacy-policy/
If you do not agree with storing cookies, please LEAVE this website now. From the 25th of May 2018, every existing user has to accept the GDPR agreement at first login. If a user is unwilling to accept the GDPR, he should email us and request to erase his account. Many thanks for your understanding

User Menu

Custom Search

Author Topic: Recovering from 10 hours Windows XP activation horror  (Read 29193 times)

hartiberlin

  • Administrator
  • Hero Member
  • *****
  • Posts: 8154
    • free energy research OverUnity.com
Recovering from 10 hours Windows XP activation horror
« on: September 15, 2007, 12:21:07 PM »
Hi,
I just had to work a 10 hours to fix some horrible Windows XP
activation loop on my laptop PC.

It was started by trendmicro.de online scanner trying to delete
the winlogon.exe file and then there was always a bluecreen
on bootup and not coming out of this loop.

So I am really sick now of the Windows XP crap with all
its activation hurdles and annoying big installation files...

More than 50.000 Files on drive C:
what a f..ck this is...

I am going now to switch to Linux for sure.
I have enough of it now...


Paul-R

  • Hero Member
  • *****
  • Posts: 2086
Re: Recovering from 10 hours Windows XP activation horror
« Reply #1 on: September 15, 2007, 04:12:14 PM »
Turning your back on the "Beast of Redmond" will be the best thing you will
have done in computing for many a long day.

Ubuntu is well spoken of, and so is Debian, although the latter is said to
be less easy to deal with.
Paul.

stanis

  • Newbie
  • *
  • Posts: 11
Re: Recovering from 10 hours Windows XP activation horror
« Reply #2 on: September 15, 2007, 05:07:10 PM »
Check whether you multiple copies of  winlogon.exe  If yes then your Pc is infected.

Troj/Madr-B is a backdoor Trojan which allows a remote intruder to access and control the computer via IRC channels.

When first run the Trojan copies itself as winlogon.exe to the folders <WINDOWS>\system\ and <WINDOWS>\system32\wins\ with the read-only and hidden attributes set and creates the following registry entries, so that winlogon.exe is run automatically each time Windows is started: [/b]
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
Winlogon = <WINDOWS>\system\winlogon.exe

HKCU\Software\Microsoft\Windows\CurrentVersion\Run\
Winlogon = <WINDOWS>\system32\wins\winlogon.exe

Each time the Trojan is run it tries to connect to a remote IRC server and join a specific channel using a random nickname. The Trojan then runs continuously in the background, listening on the channel for commands to execute.

Recovery
 Summary  Description  Recovery   
This section tells you how to remove the threat.
Please follow the instructions for removing Trojans.


Windows NT/2000/XP/2003

In Windows NT/2000/XP/2003 you will also need to edit the following registry entries. The removal of these entries is optional in Windows 95/98/Me. Please read the warning about editing the registry.

At the taskbar, click Start|Run. Type 'Regedit' and press Return. The registry editor opens.

Before you edit the registry, you should make a backup. On the 'Registry' menu, click 'Export Registry File'. In the 'Export range' panel, click 'All', then save your registry as Backup.

Locate the HKEY_LOCAL_MACHINE entry:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
Winlogon = <WINDOWS>\system\winlogon.exe

and delete it if it exists.

Each user has a registry area named HKEY_USERS\[code number indicating user]\. For each user locate the entry:

HKU\[code number]\Software\Microsoft\Windows\
CurrentVersion\Run\Winlogon = <WINDOWS>\system32\wins\winlogon.exe

and delete it if it exists.

Close the registry editor and reboot your computer.


Earl

  • TPU-Elite
  • Sr. Member
  • *******
  • Posts: 435
Recovering from 10 hours Windows XP activation horror
« Reply #3 on: September 15, 2007, 08:56:26 PM »
Hi Harti,

here are some Linux user groups in Berlin:

Titel:          Berliner Linux User Group

Beschreibung: Zweiwoechentliches Treffen von Linux-Begeisterten (und
              solchen die es werden wollen). Die Dauer ist auf ca. 2h
              festgesetzt. In den ersten 60-90 min ist ein Vortrag zu
              einem vorher vereinbarten Thema geplant, die restliche
              Zeit dient zur Information und zum Erfahrungsaustausch.

Treffen:      Jeden 2. und 4. Mittwoch im Monat um 18:00 Uhr.
              Humboldt-Universitaet zu Berlin, Institut fuer Informatik,
              Berlin-Mitte, Lindenstrasse 54a, Raum 326.
              Zu erreichen: U-Bahn Linie 2, Station Spittelmarkt,
              hinter Ebbinghaus.

Infos:        WWW: http://www.informatik.hu-berlin.de/Themen/Linux/BeLUG/
              Email: linux@informatik.hu-berlin.de
                     fr@hoshi.in-berlin.de
==========================================
Berlin - Charlottenburg
BWDG - Berlin Web & Design Group
Mit dem speziellen Interesse an WebDesign und Multimediaanwendungen unter Linux
Treffen:     Wird auf der Webseite bekanntgegeben !
WWW:    www.bwdg.de
Email:    info@bwdg.de
Telefon:    0172-3801606
Fax:    03032531084
=============================
Die Linux Usergroup Berlin
http://www.pro-linux.de/lugs/de/LUG-Berlin.html

Parallel finden jeden 2. Mittwoch die Einsteigertreffen seit 1999 statt, wo sich Neueinsteiger gegenseitig bei ihren Problemen helfen k?nnen.

Unsere Webseiten sind unter http://www.belug.org, http://www.belug.de und http://www.belug.net erreichbar.
==============================

I suggest you go for Ubuntu.

In the German magazine "easy LINUX" Ausgabe 03/2007, Juli-September, there is a DVD with Ubuntu 7.04.
It is a live DVD so you can take a look before deciding to install.  Your computer must be set in the BIOS to boot from CD before hard disk, then the live DVD will load and you can try out Ubuntu without installing it on your computer.  Of course, your drive must be one that can read DVD.

Regards, Earl

Iosh

  • Jr. Member
  • **
  • Posts: 55
Re: Recovering from 10 hours Windows XP activation horror
« Reply #4 on: September 16, 2007, 02:20:48 AM »
Good for you Stefan.
I'd encourage you to try an user-friendly distribution first, like Ubuntu/Kubuntu, PCLinuxOS, Mandriva... and although some "hardcore" distributions may be harder to understand or configurate at first, some are doing efforts to ease things for the newcomers, like Debian, which now allows to start the installation process from within Windows itself.

hartiberlin

  • Administrator
  • Hero Member
  • *****
  • Posts: 8154
    • free energy research OverUnity.com
Re: Recovering from 10 hours Windows XP activation horror
« Reply #5 on: September 16, 2007, 03:24:29 AM »
Many thanks for all your help and tips.
Please open up a new topic over here in this board and post about your favourite backup-process and
software to prevent failure of a Windows XP installation.
Surely there are programs, that still dont exist under Linux, so me and probably many other people too would still need for the first time a dual boot setup
or using 2 PCs.
I am really looking forward to use a very slim linux disti like Damn Small Linux DSL with Firefox, Thunderbird for my daily online work, that is very fast and boots up in 10 seconds from the HD or USB stick  and easy to maintain and backup and for all the other work being done offline use a bigger disti with lots of programs.
What do you think about this ?

zero

  • Full Member
  • ***
  • Posts: 149
Re: Recovering from 10 hours Windows XP activation horror
« Reply #6 on: September 16, 2007, 04:38:01 AM »

 I run 4 hard drives.

 1) OS
 2) Data Drive

 3) Backup OS
 4) Backup Data

 I partition the OS drive so that its a bit safer as well,
so that the OS could if needed, be erased and all the
major data would be fine.

 I do not backup the drives using Raid.   Because if you do that, and you
get a virus.. it would clone the virus to the backup drives.

 I manually backup entire HDs every month or so.   Anything that new and very
important, I will also manually backup to the backup drives.


 I do not use Dvds or other physical media, because its more costly,
very slow.. and they can get scratched etc.   

 HDs do fail however.   You must keep them ultra cool for them to last
a long time.  1" space between each drive and a fan blowing air
between them.   

 I lost like 3 drives before because I didnt have good cooling.  The bottom
drives heat would rise and cook the upper drives to early deaths.   With new
cooling via a custom case mod..  Ive not lost a drive yet - and its been years.

 Good luck

Iosh

  • Jr. Member
  • **
  • Posts: 55
Re: Recovering from 10 hours Windows XP activation horror
« Reply #7 on: September 16, 2007, 06:23:26 PM »
Good. Damn Small Linux is a Debian-derived light distribution, so it's a great choice to start with.

rensseak

  • Sr. Member
  • ****
  • Posts: 330
Re: Recovering from 10 hours Windows XP activation horror
« Reply #8 on: September 16, 2007, 07:36:54 PM »
Hi,
I just had to work a 10 hours to fix some horrible Windows XP
activation loop on my laptop PC.

It was started by trendmicro.de online scanner trying to delete
the winlogon.exe file and then there was always a bluecreen
on bootup and not coming out of this loop.

So I am really sick now of the Windows XP crap with all
its activation hurdles and annoying big installation files...

More than 50.000 Files on drive C:
what a f..ck this is...

I am going now to switch to Linux for sure.
I have enough of it now...




Herzlichen Gl?ckwunsch und willkommen in der Linux-Welt!  Wurde allerh?chste Zeit. ;D

Gru?
Norbert


hartiberlin

  • Administrator
  • Hero Member
  • *****
  • Posts: 8154
    • free energy research OverUnity.com
Re: Recovering from 10 hours Windows XP activation horror
« Reply #9 on: September 17, 2007, 01:11:11 AM »
Check whether you multiple copies of  winlogon.exe  If yes then your Pc is infected.

Troj/Madr-B is a backdoor Trojan which allows a remote intruder to access and control the computer via IRC channels.

When first run the Trojan copies itself as winlogon.exe to the folders <WINDOWS>\system\ and <WINDOWS>\system32\wins\ with the read-only and hidden attributes set and creates the following registry entries, so that winlogon.exe is run automatically each time Windows is started: [/b]
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
Winlogon = <WINDOWS>\system\winlogon.exe

HKCU\Software\Microsoft\Windows\CurrentVersion\Run\
Winlogon = <WINDOWS>\system32\wins\winlogon.exe

Each time the Trojan is run it tries to connect to a remote IRC server and join a specific channel using a random nickname. The Trojan then runs continuously in the background, listening on the channel for commands to execute.

Recovery
 Summary  Description  Recovery   
This section tells you how to remove the threat.
Please follow the instructions for removing Trojans.


Windows NT/2000/XP/2003

In Windows NT/2000/XP/2003 you will also need to edit the following registry entries. The removal of these entries is optional in Windows 95/98/Me. Please read the warning about editing the registry.

At the taskbar, click Start|Run. Type 'Regedit' and press Return. The registry editor opens.

Before you edit the registry, you should make a backup. On the 'Registry' menu, click 'Export Registry File'. In the 'Export range' panel, click 'All', then save your registry as Backup.

Locate the HKEY_LOCAL_MACHINE entry:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
Winlogon = <WINDOWS>\system\winlogon.exe

and delete it if it exists.

Each user has a registry area named HKEY_USERS\[code number indicating user]\. For each user locate the entry:

HKU\[code number]\Software\Microsoft\Windows\
CurrentVersion\Run\Winlogon = <WINDOWS>\system32\wins\winlogon.exe

and delete it if it exists.

Close the registry editor and reboot your computer.



Hi,
many thanks for this info.
I just scanned my PC again and I have just:

winlogon.bak
in addition to
winlogon.exe both in the windows/system32 folder.

If I use STRG ALT DEL to see the running tasks,
it also displays winlogon.exe
but I can not shut this down.

Is WinXP needing this task for normal use or how
can I disable it ?
Under services ?

Does anyone have a good list of the lowest possible services
that a single user WinXP machine only needs to run ,
when using just DSL for Internet and using a Fritzbox  router
and in another place only a DSL Modem via PPPOE ?

I want to disable all the services I really don?t need to run
in the background.

I already tried this some time ago and if you don?t
have save a registry backup, I had disabled too many
services and the PC did not run anymore...
so one has to be really cautious about this..

Also what is the best software firewall under WinXP ?

Is the free version of Zonealarm still preferred ?
Or is Sygate better ?
It must a Firewall, which is very easy to configure,
not like Zonealarm Pro, which has 1000 options...

hartiberlin

  • Administrator
  • Hero Member
  • *****
  • Posts: 8154
    • free energy research OverUnity.com
Re: Recovering from 10 hours Windows XP activation horror
« Reply #10 on: September 17, 2007, 01:30:05 AM »
Which service  controls the Winlogon.exe
file in the WinXP running services control menu ?

Is it needed for normal Internet surfing ?

shruggedatlas

  • Hero Member
  • *****
  • Posts: 549
Re: Recovering from 10 hours Windows XP activation horror
« Reply #11 on: September 17, 2007, 01:48:58 AM »
Which service  controls the Winlogon.exe
file in the WinXP running services control menu ?

Is it needed for normal Internet surfing ?

Winlogon.exe is a necessary process - it relates to logging in to Windows XP.  It has nothing to do with Internet surfing.

shruggedatlas

  • Hero Member
  • *****
  • Posts: 549
Re: Recovering from 10 hours Windows XP activation horror
« Reply #12 on: September 17, 2007, 01:50:14 AM »
Also what is the best software firewall under WinXP ?

I find that the best firewall is just the one that comes with Windows XP.

wattsup

  • Hero Member
  • *****
  • Posts: 2606
    • Spin Conveyance Theory - For a New Perspective...
Re: Recovering from 10 hours Windows XP activation horror
« Reply #13 on: September 17, 2007, 02:53:29 AM »
Hi Stefan;

To check all the system files in WinXP go to Start/Run and type in...

sfc /scannow     (keep this command handy)

Quote
When you run System File Checker it looks to see if any protected files have been overwritten. If so, it grabs the correct version of the file from the Dllcache or the Windows installation source files, and then replaces the incorrect file. SFC also checks and repopulates the cache folder.
Unquote

Here are some other goodies
********************************
The best firewall is no firewall in the computer. Just use the one that's in the high speed modem or router. This stops them before they get to your computer. Just type in the address of the modem or router and you will get into the interface for setting it up. See your modem manual.

********************************

For controlling what is installed in WinXP I use XPlite located at http://www.litepc.com/

You can install all or remove any portion of Windows XP using XPlite, and therefore leave out all the Windows programs that cause all the back door crap in the first place, plus much more. Then you install the third party programs you really use.

Also some powerful tools I use;

********************************

REGSUPREME PRO at http://jv16.org
Best 17$ you'll ever spend.
This program I've used since many many years under W98 and now under WinXP.
Best registry cleaner, fixer and for remiving long time vestiges of long ago removed software, plus let's you quicly remove strat-up programs tha have been installed by programs.

In my start-up list, all I have is one entry for my super dupper sound card and that's it. I run over 60 programs on my computer and none are hoggy my CPU at start up.

********************************

TASKINFO at http://www.iarsn.com/
Very powerful program to spot what's active, what's idle n case you feel there is any program running in the background that should not be running at all.

********************************

AD-AWARE SE at http://lavasoft.com/
If you keep this updated, it will save you much hassles with spyware.

********************************

ZTREEWIN at http://ztree.com/
The is the best file managing program ever. It is powerfull because it enable you to see files without open them, link them to an editor and you can edit even binaries. Very powerful when working at low level.

********************************

ULTRAEDIT at http://ultraedit.com
This is the best editor you can have (not for word processing or desktop publishing) to edit text, work in programming like Perl or CGI or others and will keep the programming language conventions, editing binaries. Small prgram but huge usefullnes, simple and slim.

********************************

EUDORA at http://eudora.com
This is the best email client you can have. Use this and junk the rest. You can import your current setup, make many personalities, client lists, the hole works.

********************************

Hope this helps.

hartiberlin

  • Administrator
  • Hero Member
  • *****
  • Posts: 8154
    • free energy research OverUnity.com
Re: Recovering from 10 hours Windows XP activation horror
« Reply #14 on: September 17, 2007, 08:14:59 AM »
Hi Wattsup,
many thanks.

What about Microsoft security updates for the WinXP
operating system, if you have removed
Internet Explorer with XPLite.

Then you can not go to update.microsoft.com
and can not update your operating system with
fixes,
so how do you keep your OS running with the newest fixes ?

I only still use IE for updating WinXP, not anything more...
I use
http://www.xp-antispy.org/

for switching back and forth the system rights to be able to deactive for
instance Active X allowance, etc...