SP3 Registry change warnings

TheMSsForum.com: The Microsoft Software Forum

The MSS Forum ‹ Security
- Archive
  - Biz
  - MCSE
  - CRM
  - Drivers
  - Framework
  - ADO
  - ASP
  - Compact
  - Forms
  - Dotnet
  - C#
  - VB
  - FontpageGen
  - Excel
  - WorkSheet
  - Exchange
  - Setup
  - Fox
  - Fontpage
  - ASP
  - IIS
  - Entourage
  - Money
  - Messanger
  - PocketPC
  - Powerpoint
  - Project
  - Publisher
  - Excel
  - VB
  - Security
  - Portal
  - Services
  - SQLServerDev
  - SVCS
  - SQLServer
  - VB
  - VC
  - MFC
  - ExcelGen

- Previous
 - 1
 - Windows Defender detection of Vundo trojan Apologies if this is the wrong board for this - if so, happy to re-post in a more appropriate place, just tell me where ! Windows Defender keeps reporting an infection with Vundo.gen!E. The advice on the MS site says remove it using an AV program. I use McAfee, but when I run a scan it can't find it - checking the update status of McAfee, I have the right updates that should detect this version of Vundo. So I can't actually follow the "how to remove" advice. So is Defender giving a false positive, or should I be really worried because I seem to have an infection that McAfee can't find ? Any advice on how to proceed gratefully received. Not sure whether this is relevant or not, but since getting the first Vundo detections, in the same account that apparently hosts Vundo, the user gets a message on logon to the effect that the system can't find a file opnkjghf.dll. Could this be related to the Vundo problem ? System: XPSP2 IE7 Windows Live Mail Windows auto-update checked ON AV & Firewall: McAfee, latest engines & updates installed. Thanks in advance Tag: SP3 Registry change warnings Tag: 98990
 - 2
 - how to secedit export everything How can I export everything out from the local security policies as a backup? I had tried to use secedit /export /cfg c:\temp\local.inf /areas However it keep prompting parameter is incorrect. I tried to use secedit /export /cfg c:\temp\local.inf However settings such as services, regkeys are not being saved out. Thanks Tag: SP3 Registry change warnings Tag: 98987
 - 3
 - TROJAN INFO Hey, I was just running a AV scan thru my ESET's NOD32. I just got a new update from online with more signatures and stuff. So I wanted to do the scan see if something pops up. I do this scans about every 2 or 3 days. I did have Vundo trojan before like a 3 to 4 weeks ago. Thanks to Microsoft MVPS, Fourms like this & Aumha Fourms that problem was taken care of. Here is the Error popped just few min. ago. Threat :- Win32/Agent.OBH Trojan. Anyone know what that means or what type of trojan are we talking about here. Thanks for your input. Tag: SP3 Registry change warnings Tag: 98985
 - 4
 - Blocked newspaper reader comments My local newspaper allows readers to comment to news articles. I must have set some security setting in ie that blocks my ability to read those comments. If I log on to the same computer as a different user, I have no problem. Does anyone have any ideas how I can fix this? Tag: SP3 Registry change warnings Tag: 98981
 - 5
 - Security and Sharing I have a folder that I've created a share on. How come there are more security permissions than share permissions? I don't understand this stuff. I want a group to be able to write files to the directory but if I give them Write rights in Security it doesn't work. When I go to share permissions, there are very limited rights available, Full Control, Read, and Change. Where are the write rights?? Tag: SP3 Registry change warnings Tag: 98972
 - 6
 - Scanning of encrypted content Looking for active antivirus program that supports the scanning of encrypted content as supported by the Microsoft Antivirus API. I have an Excel Wookbook that is password protected. When I Save changes to this workbook I get the following Information Message: This document is both encrypted and password protected. The Office Open XML Formats available in the 2007 release provide stronger encryption. Do you want to increase the security of this document by converting to an Office Open XML Format? I said YES once but there's a problem as noted below: I've researched and found out the following information. Problem: A macro contained in an encrypted Office Open XML file does not run in 2007 Office programs. CAUSE This behavior occurs if the computer is not running an active antivirus program that supports the scanning of encrypted content as supported by the Microsoft Antivirus API. In this case, macros are disabled in encrypted Office Open XML files. RESOLUTION To resolve this behavior, upgrade the antivirus program to a program that supports the scanning of encrypted content as supported by the Microsoft Antivirus API. I have both McAfee Security Center & Norton Anti Virus 2007. They do not provide support for this... Tag: SP3 Registry change warnings Tag: 98970
 - 7
 - Zone Alarm Via Command Prompt ? I know there is a way to control the Windows XP firewall via the command prompt. Is there some documentation on how to do the same with Zone Alarm ? Thanks Tag: SP3 Registry change warnings Tag: 98968
 - 8
 - Connection issues between windows server and samba! We have a Windows Server 2003 cluster which accesses data held on a samba share hosted on a Solaris 9.0 machine in a trusted domain. However we regularly lose connectivity to the samba share from one of the application servers. The share is up but the server is unable to access it. If I RDP on to the server and try and browse the share I receive the following error. \\serveralias\share is not accessible. You might not have permission to use this network resource. Contact the administrator of this server to find out if you have access permissions. No network provider accepted the given network path. If I use a FQDN (unix machine is in a different domain) or IP address to access the share it works correctly. If i reboot the server access to the share is restored. This one has me beat - any advice would be appreciated - kerberos issue?? Thanks in advance Tag: SP3 Registry change warnings Tag: 98951
 - 9
 - Hacking into Hotmail Acct. I believe that my soon to be Ex has hacked into my email hotmail account a couple of times. I have since changed my pass and secret question to something he would never get but....my question is, I know that this is a felony in my state but I need evidence other than him saying he has my emails. Is there a way to get the IP addresses that have accessed my account? This would show his address at home or work, right? How do I obtain that information? Also, I received an "annonymous" email last night - are these truly untracable? It contained my emails that I know he has hacked into. But is there a way to find out who really sent it? Tag: SP3 Registry change warnings Tag: 98944
 - 10
 - Virus and/or hacking problem with Windows Messenger I'm running Windows XP Pro SP2 and Windows Messenger v5.1.0701 About 10 days ago, I received 2 IM's, several hours apart, from one of my contacts. Both of them asked me to go to unknown websites, a different site in each message. I was very suspicious and cautious, because I had never received this kind of IM before. The website from the first message asked me to login with my MSN account and password. I refused to do so. I never visited the website from the second message. I sent an email to my contact and asked him if he had originated these 2 IM's. His answer was that he had not, and that many of his other contacts had reported the same thing happening to them. He suspects either he has a virus which is exploiting his Messenger account, or someone has hacked into his account and is using it. I shut down Messenger on my end and left it off until today. When I re-started Messenger I had a notice that someone I have never heard of has added me as a contact. I blocked that person from contacting me. His ID is Brooke, his email and Sign-in name are brookesised@hotmail.com, and his service is .NET Messenger Service. I see how to remove him from *my* contact list. Is there any way for me to remove myself from *his* contact list? Is this something new, or is this a known and documented exploit? Is there a fix for my contact, who apparently is the victim? Thanks! John -- Please reply in this newsgroup. I never post my true email address to prevent spam. Thank you. Tag: SP3 Registry change warnings Tag: 98941
 - 11
 - User permissions for remote event watcher Hi all, I posted this in the WMI newsgroup, but there's not much action there! Perhaps I can find some help here... I have a simple little Windows service that retrieves events from a remote computer through WMI and a ManagementEventWatcher. It all works just fine... as long as the user I specify in my ConnectionOptions (see below) is an administrator of the remote computer. My problem is that (for security reasons) I cannot use an administrator account. I have created a clean account, currently with no permissions on the remote computer. Now I want to add just the permissions needed for my service to work, but I can't find anywhere what permissions that is! Please enlighten me! / Mikael This is the essentials of the service: ConnectionOptions connection = new ConnectionOptions(); connection.Impersonation = ImpersonationLevel.Impersonate; connection.Username = "NotAnAdminUser"; connection.Password = "LetMeIn"; ManagementScope scope = new ManagementScope(@"\\remotecomputer\root \cimv2", connection); scope.Connect(); string query = "SELECT TargetInstance FROM __InstanceCreationEvent WHERE TargetInstance ISA 'Win32_NTLogEvent'"; ManagementEventWatcher watcher = new ManagementEventWatcher(scope, new EventQuery(query)); watcher.EventArrived += new EventArrivedEventHandler(watcher_EventArrived); watcher.Start(); (currently I get to scope.Connect() where I run into an UnauthorizedAccessException) Tag: SP3 Registry change warnings Tag: 98940
 - 12
 - object access failure audits Although only an annoyance, when users print on my network I get an error event ID 560 in the Security log. I audit for print success/Failure and failure to delete print jobs using the 'everyone' group. Can someone shed some light on this and what I can do to get rid of these events. The users all are allowed to print to these printers, and I get the usual print event in the system log. Tag: SP3 Registry change warnings Tag: 98935
 - 13
 - Is this the right group for C&A remediation questions? Gurus, Is this the right group for C&A remediation questions? OR is there an NG dedicated to questions on the C&A process (which covers a range of OSes beyond just Microsoft). -- Spin Tag: SP3 Registry change warnings Tag: 98932
 - 14
 - Wanted: More Advanced Administration Tool(s) Hello, Can anyone please recommend any software tool(s) that could help an administrator (Windows 2003, Windows XP, and eventually Windows Vista) to quickly find answers on questions like these: (1) For a given computer, show all the resources (files, folders, registry entries, etc.) that have any permissions/restrictions specified for a given account (local or domain-level account, user or group)? (2) For a given resource and account, show all the effective permissions AND WHY EXACTLY EACH OF THESE PERMISSIONS IS WHAT IT IS? Ideally, the tool should be aware of implied permissions too (like a resource owner's implicit permission to change permissions for the resource). BTW, it would also be nice if the tool provided some additional help in managing group memberships. For example, it would be nice if it allowed to document memberships (i.e. for each group member, document why exactly does this member has to be in this group). Thank you, Yarik. Tag: SP3 Registry change warnings Tag: 98927
 - 15
 - wireless driver security: don't work as non-admin Hi I have a small security problem. I got it on win2ksp4 with netgear wg111t and now encounters the same problem on winxpsp3 with an asus notebook (intel pro/wireless 3945abg chipset). The box is installed correctly, wifi drivers too and they work as an admin user. But when using a non-admin account, it seems the driver can't load or initialize network, so i'm without network when using non-privileged account and forced to make some users to use admin whereas they don't need it. I think it's a dev problem from the constructor but want to check that's not microsoft's and this problem is solved in Vista. Is it the case ? thanks Tag: SP3 Registry change warnings Tag: 98922
 - 16
 - Evebntcombmt Tool Hi We're looking to give our service desk acess to the Eventcomb tool to be able to determine where an account is being locked out but currently when they execute to look for locked accounts it comes up with an GetLastError was 5 Error text was Access Denied, the assumption here is there accounts do not have enough permissions to be able to run the tool. What modifications might be made to enable them to have the ability to run the tool. Thanks -- John Tag: SP3 Registry change warnings Tag: 98921
 - 17
 - Can somebody please explain rights in security and sharing? I have a 2003 Server. I have a D: drive. I can right click this drive and click security and set file permissions here. Full Control, Modify, Read Execute, List, Read, and Write. I have also created a share on this D: drive. The share is for the whole d: drive. In the share's permissions, there is only Full Control, Change, and Read. I have remote user who needed to create directorys and what not, so I gave him full control in the security permissions for the D: drive. He said it didn't work and he wasn't able to do anything. I then went to the share's permissions and gave him full control and he's fine now. I am so confused now about the two sets of permission levels. Can somebody please explain how this all works? Tag: SP3 Registry change warnings Tag: 98912
 - 18
 - Can somebody please explain security vs sharing? Tag: SP3 Registry change warnings Tag: 98911
 - 19
 - Wireless Hackers? I'm running XP Home SP3, with a Linksys wireless router using WPA/WPA2. How can I monitor usage of my wireless connection, to determine whether someone else is tapping into my wireless connection without my knowledge? -- John Tag: SP3 Registry change warnings Tag: 98910
 - 20
 - EventCombMT problem.. I'm attempting to ru eventcombmt from the command line and have the following script. eventcombmt.exe /s:server.domain.com /evt:"529 530" /et:all /log:sec /t:30 /after:08042008010101 /Before:08042008020202/outdir:C:\Parser\Tests\ /start (i've tested this with 24hr time format as well) I get the same error no matter what position I put the "/after:" command "EventCombMT Command Parsing Error" "Arguement: /after:08042008010101 at position 7 was not recognized." Any ideas? maybe I should put this under scripting.. Tag: SP3 Registry change warnings Tag: 98909
 - 21
 - Tapping into My Wireless I'm running XP Home SP3 with a Linksys wireless router. How can I monitor the wireless connection, to know whether someone else may be trying to access it without my knowledge? -- John Tag: SP3 Registry change warnings Tag: 98907
 - 22
 - event id 577 All of a sudden all the administrator accounts are getting security event error 577 priveledge use failures. All the administrators log in successfully and dont seem to be effected by this. Do you know what is the cause of this and how to correct it? TIA dwojt Tag: SP3 Registry change warnings Tag: 98905
 - 23
 - Event ID 560 We are required to audit success and failures on all printers. Now we receive failure event id 560 errors everytime someone prints to the printers. We do not receive any success events and all the prints get printed. We are running Server 2003 sp2. Is there a reason why we are getting failure events even though the prints are coming out successfully? TIA dwojt Tag: SP3 Registry change warnings Tag: 98904
 - 24
 - Virtual Private Networking in Windows XP Pro. and in Windows 98 SE <long post and you were warned -- grin and bear it if you will> I wanted to add this post because when the APS network was hacked in 2007 and then my home computer was hacked it was really disturbing but now in reflecting back on the experience it was profoundly interesting as well. The hacker(s)? stole all my personnel information and my identity and it was my own stupidity that thought that I was so clever and I have now realized that pride goes before the fall. Anyway, Windows 98 Second Edition got hit with an error but apparently because of the internal safety of the operating system via the lack of services resulting in a smaller surface area as well as the machine not having the potential vulnerabilities of RPC (please see http://en.wikipedia.org/wiki/Remote_procedure_call for further information) and the NT source codes lack of a maintenance operating system like DOS (please see http://cquirke.spaces.live.com/blog/cns!C7DAB1E724AB8C23!336.entry ) for further details about what Windows Vista is lacking and also see a book I read about Windows History where early Microsoft Systems Engineers joked about NT being the Not There operating system because it lacked the internal safety structure of the underlying maintenance operating system compared to 9x operating system which was grounded on the strength of DOS. It could be also a lack of skill on the hacker(s)? part as well but please see the secunia website and search Windows 98 Second Edition and also search Windows XP Professional and you will be surprised to find which operating system has more current vulnerabilities. I am not including extras in my argument like Internet Explorer which I feel was sadly tied to the operating system back in 1998 and causes many of the problems users face today. I currently mainly use Mozilla Firefox because of the 256 bit cipher strength it uses even in Windows 98 Second Edition if the site has that high a cipher strength which apparently is sadly only available today with Microsoft Operating System "Windows Vista" and perhaps other Microsoft operating systems that are later than Windows XP Professional. This example is sadly being copied by Apple with its tying of Itunes with Quicktime and Itunes breaking if you remove Quicktime because of vulnerabilities. Apple is currently guilty of other bad software practices like pushing its weak Safari browser on users of Windows Computers as well as having software stealthily installed without a user consent. I noticed this on my computer with Bonjour being installed and I thought "okay what is this" and discovered with the help of Google that it is part of Apple software. This operating system is currently Windows XP Professional which I use as well as Windows 98 Second Edition in a dual boot on one machine as well as an oem copy of Windows Vista Home Premium in 32 bit on a Toshiba laptop/notebook computer. You can all laugh if you like but I have used computers since about 1984 when I first played King's Quest 1 by Sierra On Line on a 5.25 inch floppy drive on the IBM PCjr which my dad, Ivan still owns and it still works and is currently in storage and used every few years when I long for the good and easy workings of a computer that had BASIC which you loaded via a BASIC cartridge and from there I enjoyed simply programming and made my screen flash different colors and play different sounds with the help of my dad and a large book about BASIC. Anyway, I now realize it was my own fault and stupidity for connecting to a network that was as weak as the APS Network and the person or people broke through the network in the summer while I was away working at another job. The thing is that I brought that school's network from being crap to being fully functional within one school year and then within 3 months while I was away, some hacker(s)? took all the trouble that I had gone through with the help of the network administrator and flushed all that work done the tubes because of weak protocols set by the school as well as letting too many computers have administrative accounts as well as not listening to me about saving some Windows 98 Second Edition computers as well as my own which the school provided me but then stupidly decided we need to phase out all the older Windows 98 computers and I warned them but why would they want to listen to a single user when they thought they knew it all. Anyway, thanks for letting me explain and discuss and also to warn users to fully read up on material before using VPN with your home pc and if you are not required then it is just better to be safe and not accept that risk into your home pc. I was not required but too naive and too stupid because I did not realize that I was putting my computer at risk by asking for this permission from Ken the Director of Technology. I did get the permission but it was my thoughtlessness, excitement of learning new things that made me blaze a trail ahead without fully stopping, thinking and counting the consequences. Anyway, the Windows XP Professional Service Pack 2 which was fully patched was hacked and information was stolen and deleted and copied before I was fully aware of the attack. This shows us how since the external security of Windows XP Professional failed, then the internal safety of Windows 98 Second Edition prevailed and it only suffered from Rundll errors instead of the PC being fully compromised. I still have the data from the Windows 98 Second Edition PC if anyone in the newsgroup cares to analyze the data. The XP Professional side has been fully formatted and a clean install performed so all data there is just plain gone. Thanks for listening and I welcome all the positive and constructive comments that I know will be forthcoming. If you just want to be negative then don't be surprised, if I just ignore your post and/or post back some smart alec response. Please see for securing your older Windows 98 and NT computers from Microsoft: http://support.microsoft.com/gp/msim_win98 Tag: SP3 Registry change warnings Tag: 98865
 - 25
 - Security padlock on internet explorer page. Why? I'm trying to log into aol.com and am receiving an error message and the address bar has a padlock. I don't think I changed anything on my computer and I just want to know how to unblock the webpage. I can access everything else but aol. Help please. Thanks, Elisa Tag: SP3 Registry change warnings Tag: 98850
- Next
 - 1
 - Bandwidth consumption I have a small network 2xXP machines, 1xVista and 1xSmall Business Server 2003. It may be conicidence but recently (in the last 3 weeks) two things occuried on my network. My old DDNS service DirectUpdate stop working after a security fix was applied, so I replaced it with another. Two I upgraded one computer to Vista And about a week after noticed I was chewing bandwidth around 1GB of bandwidth a day. I have run TCPView on the one PC and on the Small Busines server. Which is acting as a router to the external world (connected using a IBurst router on an extrernal LAN, not running ISA, just the default Firewall in SBS2003) I have tried checking for spyware, and run all the updates but I cannot find where I am bleeding bandwidth (and I only get 3GB a month). Any ideas how to trouble shoot? -- Warren - All limits are man made Tag: SP3 Registry change warnings Tag: 98848
 - 2
 - NAP and Virtual Machines I had a student ask a question I can't answer.... If you deploy NAP can't it be circumvented by bring up a Virtual Machine? IE If a user fired up a virtual machine and and uses NAT from the host PC to gain access to the network...wouldn't the NAP environment think that the file is being requested by host OS?....Yet actually it's the virtual machine getting the file? -SuperDale Tag: SP3 Registry change warnings Tag: 98843
 - 3
 - Looking for feedback on Internet Security Presentations Hello folks, Finding myself often in the position to explain security concepts to friends and family, I tried to find a way to create easy to understand presentations on the topic. So I made online security presentations with Google Docs showing everything from how to secure a home system, to multi-factor authentication, encryption, social engineering, and advanced topics like XSS, IDS and SSL Certificate Hijacking. URL is: http://elfguy.net/security.html Check it out, any feedback is appreciated! Tag: SP3 Registry change warnings Tag: 98840
 - 4
 - Survey Software - Can Help You To Manage and Conducting Your Research is critical to civilization. It is the quest for truth, understanding and developing new ideas. Several research methods exist, of which surveys play an integral part. Surveys are required to gather data on an array of fields such as market research, politics, healthcare, education, employee satisfaction, tourism and so on. Just a few years back, this was the toughest part of the whole process. One needed to carefully draft a questionnaire, search people, contact them personally through post, telephone or in person, and collect data. All that vast amount of data collected would then be coded and analyzed, costing time, money and effort. Survey Software is the one-stop solution for all research woes. It comes as one of the biggest boons for all research purposes. It is a timesaving, economical, efficient, effortless, accurate and far- reaching means of data collection. The ease of creating a survey with survey software lies in the step-by-step automated process, with many options available. The basic features of survey software include designing surveys, having a question library to choose questions from, entering data, analyzing responses using statistical methods, creating graphs and tables, and other general features like spell check and editing. Once prepared, the survey can be conducted through emails or the phone, published in print or online, and sent to an unlimited number of people, all with just a click of a mouse. A large number of vendors supply survey software online. Many of them provide free trials for a month, and a money back guarantee. Technical support and training is also provided in most cases. Most of these packs can be supported by home PCs. To purchase this software, one needs to understand and compare all features in detail according to the intended usage. Tag: SP3 Registry change warnings Tag: 98839
 - 5
 - Win2k3 Certificates not accepted as Trusted Authority Hello, I'm running Win2K3 R2 and Exchange 2003 and installed Certification Authority to process certs for OWA. When a user clicks to trust/install the certificate during an OWA session the cert is never saved to the Trusted Root Certificate Authority section of their browser and they are prompted the next time they log on to trust /install the cert. Manually copying the .cer file and adding it to the local computer (even directly to the Trusted Root Certificate Authority container) has no affect. Please help, any assistance is greatly appreciated. Tag: SP3 Registry change warnings Tag: 98838
 - 6
 - Does this Logon banner look kindof weak to you (i.e. too "non-threatening")? Gurus, Does this Logon banner look kind of weak to you (i.e. too "non-threatening")? I mean, if we were to catch AND prosecute hackers, the I fear someone could argue that the below didn't explicitly restrict non-authorized users. THIS <COMPANY NAME> EQUIPMENT IS PROVIDED FOR OFFICIAL USE ONLY. BY LOGGING ON THE NETWORK, YOU AGREE TO <COMPANY NAME> INFORMATION SYSTEM POLICIES. IF YOU HAVE ANY QUESTION REGARDING PROPER USE OF <COMPANY NAME> I.S RESOURCES, PLEASE CONTACT THE HELPDESK. THANK YOU. -- Spin Tag: SP3 Registry change warnings Tag: 98832
 - 7
 - Antivirus XP 2008 Has anyone heard of this program ? Is it real or is it a virus. It installed itself on my computer and I cannot uninstall it. Jerry. Tag: SP3 Registry change warnings Tag: 98830
 - 8
 - Network Service security question Hi, If I create a web service to run on a Windows 2003 server under the Network Service account, will it have access to other server services elsewhere on my domain? The scenario is that I have created a web service to query a specified database. Different departments need the same functionality the service supplies but need to query different databases. the solution employed was to copy the service to their own local server and put data access information in the associated config file. That way they get the data they want to see and I don't have to duplicate code. The issue that has now been raised is that as the departments are all on the same domain and all the services are running as Network Service then they could possibly connect to a different server and access the resources (other services) there. I think i've read somewhere that the Network Service account is a local account, so does this mean that it can only access resources locally even though it has network permissions? Any thoughts? <M> Tag: SP3 Registry change warnings Tag: 98823
 - 9
 - list NTFS permissions Is their a command or utility that will listthe NTFS permissions for a foldr and all subfolders. Output to a text file would be great. Thanks, Rich Wethington Tag: SP3 Registry change warnings Tag: 98818
 - 10
 - hit counters & safety Hi, can anyone recommend a couple of sites that I can go to to get FREE hit counters that will not have spyware or malware? Although I havent heard of counters having spyware, I just wanna be safe and keep people safe that will go to my ad to view. I Have windows xp home edition. thanks in advance Tag: SP3 Registry change warnings Tag: 98816
 - 11
 - Zuten Trojan and Minidump File. Windows XP Media Center Edition 2005 SP3 CA Anti-Virus Plus CA Anti-Spyware 2008 ---------------------------------------------------------- A scan with CA Anti-Spyware 2008 found a Zuten Trojan. CA Anti-Spyware was set to delete spyware and cookies automatically once quarantined. Log shows: Quarantined Zuten Trojan was in Folder: C:\windows\minidump and 3 cookies were also found Quarantine is empty, I can only assume that the 3 cookies and the Zuten Trojan were deleted. .The c:\windows\minidump file can not be found. I can only assume that the file was deleted by the CA Anti-Spyware with the Zuten Trojan. At that point I ran Ad-Aware 2008, Super Antispyware and Windows Defender. I also ran a complete Windows Live One Care and nothing was found. My computer appears to be running normally. Should I be taking any further action? If I am in the wrong place, please point me in the right direction. Serge Tag: SP3 Registry change warnings Tag: 98814
 - 12
 - Hackers attack businesses, blogs and Web 2.0 sites IT security and control firm Sophos has published new research into the first six months of cybercrime in 2008. The Sophos Security Threat Report examines existing and emerging security trends and has identified that criminals are increasingly using creative new techniques in their attempt to make money out of internet users. a.. Website infection rate three times faster than 2007 b.. Business websites attacked, office workers at risk, Web 2.0 introduces new threats c.. Nicole and Angelina bring danger via email Full email article here: http://www.sophos.com/pressoffice/news/articles/2008/07/security-report.html Tag: SP3 Registry change warnings Tag: 98812
 - 13
 - administrator user not seen on log-in screen From the "computer management" utility I can see there are 2 users from the administrators group (the default administrator account and "mike"). The only accounts that appear on the log-in screen are "mike" and "guest". If I want to delete "mike" I need to do it from the "administrator" account but I can't access it. How do I make this account visible? Tag: SP3 Registry change warnings Tag: 98806
 - 14
 - Featured Proxy for 28 July 2008! Featured Proxy Today is: http://www.is-fun.info http://www.hulkproxy.info Others is: http://www.getbypass.info http://www.bypass2u.info http://www.runfromschool.info http://www.gotbanana.info http://www.girlofficial.info http://www.colorproxy.info http://www.gotred.info http://www.gotblue.info http://www.gotdark.info http://www.gotorange.info http://www.gotstripes.info http://www.gotgrey.info http://www.girlhome.info http://www.squeezeassist.com -- Free ebook Make Money With Rapidshare: - http://www.onlinemoneycoaching.com Free Roboform : http://www.roboform.com/php/land.php?affid=sub07&frm=frame2 Fix your slow PC : http://www.clickaudit.com/goto/?71493 Tag: SP3 Registry change warnings Tag: 98791
 - 15
 - Cisco Ip Communicator Not working Through ISA 2004 We are using ISA 2004 as both Firewall & Proxy. Also we configured VPN on this server. Currently we are facing issue with Cisco IP communicator while connecting through VPN, we can hear the ring in the other end, but unable to hear the voice on both ends after picking up the call. In ISA we enabled all outbound traffic from VPN to Internal network. Please suggest how can we resolve this issue. Tag: SP3 Registry change warnings Tag: 98777
 - 16
 - W97M/Marker.T Virus found by Forefront on file server I'm posting this here because I'm not getting any response in the Forefront forums. (What happened over there? They used to be so responsive? Maybe the new look) The Forefront client has discovered W97M/Marker.T on one of my file servers. I've chosen to have it removed by FCS and it's now in a state of "Taking Actions....". This has been going on for a hour now and the System Event log is filling up with FCSAM Information events every 15 or so seconds saying FCS is taking action. How long should I wait for this to finish? -- Sandy Wood Orange County District Attorney Tag: SP3 Registry change warnings Tag: 98736
 - 17
 - makecert.ext tool required Hello I am using MS VS 9, for C++ development. I need to create X.509 certificates, but when i run 'makecert' command on the MS VS command prompt, it give some error that 'makecert can't be recognized as internal or external command...' I think its because makecert.exe tool has not been installed. Can anybody tell me from where to download it? Its not available from MSDN site. regards, Wilayat Tag: SP3 Registry change warnings Tag: 98735
 - 18
 - Does Microsoft Need a New Source Code for the Future? I want to start a new topic on this because the Biometrics debate has gotten too long. I will now post Chris Quirke, MVPs reply to me about my thinking the 9x (98 Second Edition) should be part of the internal Defense Network of this source code. Chris Quirke, MVP says: I think we have the same ideas, but weigh things differently and reach different conclusions - you see the 9x code base itself as being something to be preserved at all costs, where I see the factors that make the 9x code base safer in certain respects as something that should inform other code base development. An interesting point from the article I linked for you, was the difference between deeply re-architecting an existing code base, and starting a new code base from scratch. I'd have though such deep design change to be as disruptive as re-coding from scratch, but apparently this is not the case. If that's so, then it may be practical to re-architect the NT code base as a true stand-alone OS, which keeps networking out of the center as an discardable subsystem should unexpected risks demand that response. I put it this way; exposed code surfaces are like points of wear in a car. You don't merge piston rings into pistons (or brake shoes into axles) so that when these parts get worn, they are easy to replace. Same thing with code surfaces; you may have to suddenly amputate or replace them, so don't embed them in the core of how the OS works. For example, an OS should be able to wipe its own butt without RPC, and/or not expose RPC to network surfaces (especially the Internet). It shouldn't rely on RPC to do internal things, weld this into Internet exposure, and then rely on a firewall as a band aid over this clickless, remotable risk surface. Tag: SP3 Registry change warnings Tag: 98729
 - 19
 - Local password not applying to Server Hi everyone, my team and I are having a strange problem, we administer a password change every 90 days. The group policy gets applied and the password is changed on the local machine, the employees get in do thier work for that day then they logout and go home. The following day the employee comes in and they are now locked out. I now have to manually type in the password on the server for it to be applied. Then they are fine for the next 90 days, please HELP! I know that something is being missed. Tag: SP3 Registry change warnings Tag: 98708
 - 20
 - CLM on x64 host hello, Is possible deploy CLM on a Windows 2003 x64 versiÃ³n? Thanks -- Unai Castro MCSA Windows 2003 Tag: SP3 Registry change warnings Tag: 98703
 - 21
 - Certificate Services The format of the speicified domain is invali I am receiving a faile request when trying to generate a user certificate from our web server. I am able to get certificates without of a problem from our domain controller. However I just recently setup and outside certificate request on our windows 2000 server in the dmz. I pointed the site when installing the certificate web services at our or 2003 DC and everything seemed to go fine. However when I go through and request a certificate it is failing with the error "The format of the specified domain is invalid" Tag: SP3 Registry change warnings Tag: 98702
 - 22
 - Microsoft Folder with large number (486,692) of files While looking into system perfomance, i found a folder with 400,000+ 384 byte files, each with a guid as filename. there is one other file alongside folder s-1-5-19 called CREDHIST the folder is c:\documents and settings\localservice\application data\microsoft\protect\s-1-5-19\ it shows as size 163MB, on disk 1.77GB creation date april 2008 it causes problems with search and virus scan although a dos scan reports it and its contents to be clean. (mcafee) i alkso have windows defender installed and it does not report any problems. the folder i found originally was c:\documents and settings\localservice\application data\microsoft\media centre\protect\s-1-5-19\ but i deleted that to see what would happen and the first named folder appeared in its place. i am concerned that this is a trojan of some sort. however, it is possible that it is a genuine microsoft system folder since s-1-5-19 is a localservice id. can anyone shed some light please? Tag: SP3 Registry change warnings Tag: 98700
 - 23
 - JS file content found on my PC Hi - I'm still experimenting with this machine. I found a temp file which contains the information listed below. Has anyone any idea what effect such a file will have on this PC? (XP Home, SP3 and all updates). Thank you in advance for any insight you may be able to provide. Dave /* * ====================== dir.js ======================== * ====== Javascript include for director.hta =========== * ====================================================== */ // initialize global variables var debug = new Boolean; // loaded from persist. var hintsOpen = new Boolean; // loaded from persist. var hintsWidth = 175; var totalWidth = 0; var currentDevice; var windowHeight = 190; // set for current container app. HTA: 190, HTM/IE: 300 var minWindowWidth = 220; // w/o width of <select> and 'settings' var widthAdjust = -27; /// set for current container app. HTA: 190, HTM/IE: -3 var updateInProgress = new Boolean; //Added by Brent var doubleClicked = false; var currentButton; window.onload=initialize function initialize() { updateInProgress = false; debug = false; initializeDevices(); loadPersist(); setCurrentDevice(); updateLayout(); } function setCurrentDevice() { // was app started with a context id var ctxID = window.external.ContextID; if (ctxID == "") return; for (var i = 0; i < oDevice.length; i++) { if (oDevice[i].devID == ctxID) { currentDevice = i; break; } } } function changeDevice(device) { currentDevice=device; updateLayout(); savePersist(); } function expandHints() { if (updateInProgress) return; updateInProgress = true; hintsOpen = !hintsOpen; updateLayout(); savePersist(); } function toggleDebug() { // debug = !debug // updateLayout() } function initializeDevices() { // populate oDevice data structure from Devices.xml oDevice = new Array; var xml = new ActiveXObject("msxml"); //Get file path for devices.xml in User's App Data directory //Start with 'file:///' var devFilePath = new String("file:\/\/\/"); //Get the path for the file from call to COM code devFilePath += window.external.GetAppDataPath(); //Replace all '\\' occurrences with '/' devFilePath = devFilePath.replace(/\\/g,"\/"); //Replace spaces with '%20' devFilePath = devFilePath.replace(/\s/g,"%20"); //Add the name of the file devFilePath += "devices.xml" xml.URL = devFilePath; devicesXML = xml.root.children; for ( var i=0; i<devicesXML.length; i++ ) { // could eliminate this intermediate data structure oDevice[i] = new Object; oDevice[i].devID = devicesXML.item(i).children.item(0).text; oDevice[i].id = devicesXML.item(i).children.item(1).text; oDevice[i].service = new Array; services = devicesXML.item(i).children.item(2).children for ( var j=0; j<services.length; j++ ) { oDevice[i].service[j] = new Object; oDevice[i].service[j].serviceID = services.item(j).children.item(0).text; oDevice[i].service[j].action = services.item(j).children.item(1).text oDevice[i].service[j].status = services.item(j).children.item(2).text } if ((devicesXML.item(i).children.length > 3) && (devicesXML.item(i).children.item(3).tagname == "STATUS")) oDevice[i].statusmon = devicesXML.item(i).children.item(3).children.item(0).text; else oDevice[i].statusmon = null; } if ( debug ) { alert( "found "+ devicesXML.length +" devices")} } function externalGetData(name) { return window.external.GetPersistentData(name); } function loadPersist() { // replace with Persistence code hintsOpen = true; debug = false; currentDevice = 0; //var persistHints = window.external.GetPersistentData("hintsOpen"); var persistHints = externalGetData("hintsOpen"); if (persistHints != "") { hintsOpen = eval(unescape(persistHints)); } //var persistDevice = window.external.GetPersistentData("currentDevice"); var persistDevice = externalGetData("currentDevice"); if (persistDevice != "") { var devID = unescape(persistDevice); for (var j = 0; j < oDevice.length; j++) { if (oDevice[j].devID == devID) { currentDevice = j; break; } } } window.resizeTo(663,windowHeight) // } function externalSaveData(name, value) { window.external.SavePersistentData(name, value); } function savePersist() { externalSaveData("hintsOpen", escape(hintsOpen)); externalSaveData("currentDevice", escape(oDevice[currentDevice].devID)); } function updateLayout() { // debug stuff =================================== if ( debug ) { oAllButtons.style.border = "1px solid black" oIconBackground.style.border = "1px solid cyan" oHintsTitle.style.border = "1px dashed black" oHintsText.style.border = "1px dotted black" oIconBackground.style.backgroundColor = "yellow" oHintBackground.style.backgroundColor = "red" oAllButtons.style.visibility = "visible" // debug stuff =================================== } else { oAllButtons.style.visibility = "hidden" } // update Select oSelect.options.length = 0; for ( var i=0; i< devicesXML.length; i++ ) { var oOption = document.createElement("OPTION"); oOption.text=oDevice[i].id; oSelect.options.add(oOption); } // select the current device in the drop down combo box oSelect.selectedIndex = currentDevice // assign the access key to 'Select Device' var selectText = tdcStrings.recordset("dir-label-select").value; var selectAccKeyIndex = selectText.toLowerCase().indexOf(""); if (selectAccKeyIndex >= 0) { oSelect.accessKey = selectText.substr(selectAccKeyIndex + 3, 1); } // assign the access key to 'Settings' menu item var settingsText = tdcStrings.recordset("settings-title").value; var settingsAccKeyIndex = settingsText.toLowerCase().indexOf(""); if (settingsAccKeyIndex >= 0) { settingstitle.accessKey = settingsText.substr(settingsAccKeyIndex + 3, 1); } // assign the access key to 'Status' menu item var statusText = tdcStrings.recordset("status-title").value; var statusAccKeyIndex = statusText.toLowerCase().indexOf(""); if (statusAccKeyIndex >= 0) { statustitle.accessKey = statusText.substr(statusAccKeyIndex + 3, 1); } // empty old buttons oAllButtons.innerHTML=""; // add new button - hidden for ( var j=0; j<oDevice[currentDevice].service.length; j++ ) { button = oDevice[currentDevice].service[j].serviceID var buttonText = tdcStrings.recordset("dir-btn-"+button).value; var accKey = null; var accKeyIndex = buttonText.toLowerCase().indexOf(""); if (accKeyIndex >= 0) { accKey = buttonText.substr(accKeyIndex + 3, 1); } html="" html+="<span id='oBtn" + button + "' " html+="class = 'service-button' onMouseOver='showHint(this.id)' "; //Updated by Brent html+="onClick = 'fnSingleClick(\" " +button+ " \");' " html+="onDblClick = 'fnDoubleClick(\" " +button+ " \");'> " html+="<img id='oImg" + button + "' " html+="style = 'margin-right:0' " if ( oDevice[currentDevice].service[j].status=="ready" ) { html+="class = 'rollover' src='img/" + button + ".bmp'>" } else { html+="src='img/" + button + "_f4.bmp'>" } html+="<a class='service-button' href=\"#\" accesskey=" + accKey + " style='text-decoration:none'> "; html+="<label for=\"oImg"+button+"\" datasrc = '#tdcStrings' datafld = 'dir-btn-" + button + "' " html+="dataFormatAs = 'HTML'></label></a>" oAllButtons.insertAdjacentHTML("beforeEnd", html) } window.setTimeout("finishLayout()" , 500); } //Single and Double click handlers added by Brent function fnSingleClick(button) { //Take a little time first currentButton = button; timer = setTimeout("if (doubleClicked == false){runApp(currentButton);}doubleClicked = false;",500); } function fnDoubleClick(button) { doubleClicked = true; currentButton = button; runApp(currentButton); } function finishLayout() { // evaluate button kerning pairs var kernWidth=0 var maxWidth=0; var widths = " widths: " for ( var i=0; i<oDevice[currentDevice].service.length - 1; i++ ) { button = oDevice[currentDevice].service[i].serviceID nextButton = oDevice[currentDevice].service[i+1].serviceID kernWidth = Math.max(kernWidth, 0.5 * (eval("oBtn" + button + ".offsetWidth") + eval("oBtn" + nextButton + ".offsetWidth"))) widths += " " + eval("oBtn" + button + ".offsetWidth") } if (debug) status = "kern:" + kernWidth + widths; // kern each button (except last) & calculate total space needed to avoid wrap totalWidth = 0; for ( var i=0; i<oDevice[currentDevice].service.length - 1; i++ ) { button = oDevice[currentDevice].service[i].serviceID thisWidth = eval("oBtn" + button + ".offsetWidth") nextButton = oDevice[currentDevice].service[i+1].serviceID nextWidth = eval("oBtn" + nextButton + ".offsetWidth") current = 0.5 * (thisWidth + nextWidth) thisButton = eval("oBtn" + button) thisKern = kernWidth - current thisButton.style.marginRight = thisKern totalWidth += thisWidth + thisKern + nextWidth * (i==oDevice[currentDevice].service.length -2) } settingstitle.style.width = settingstitle.offsetWidth; statustitle.style.width = statustitle.offsetWidth; // prepare to resize window widthBySettings = minWindowWidth + settingstitle.offsetWidth + oSelect.offsetWidth + statustitle.offsetWidth; widthByButtons = totalWidth + 95; widthBump = Math.max(0, widthBySettings - widthByButtons); windowWidth = Math.max(widthBySettings, widthByButtons); windowWidth = hintsOpen ? windowWidth + hintsWidth : windowWidth; // resize window.resizeTo(windowWidth + widthAdjust, windowHeight); // position elements rightSideButtons = oBtnhelp.offsetLeft + oBtnhelp.offsetWidth + 20; oIconBackground.style.width = rightSideButtons + widthBump + 10; oMenuMask.style.left = oSelect.offsetWidth + 60; // position drop-down menu if (document.all.menu1) document.all.menu1.style.left = oMenuMask.style.left; else oMenuMask.style.visibility = "hidden"; if (oDevice[currentDevice].statusmon) { oMenuStatusMask.style.left = oSelect.offsetWidth + settingstitle.offsetWidth + 80; oMenuStatusMask.style.visibility = "visible"; } else oMenuStatusMask.style.visibility = "hidden"; rightSideAnchor = rightSideButtons + widthBump + 10 // hints-specific if ( hintsOpen ) { oFilletTR.className="fillet-small-xlight-tr" oFilletBR.className="fillet-small-xlight-br" rightSideAnchor += hintsWidth; oHintBackground.style.width = rightSideButtons + widthBump + hintsWidth + 10 oBtnHints.style.visibility = "hidden" oBtnHintsOut.style.visibility = "visible" oHintsTitle.style.left = rightSideButtons + widthBump + 25; oHintsText.style.left = rightSideButtons + widthBump + 25; oHintBackground.style.display = "" oHintsTitle.style.display = "" oHintsText.style.display = "" } else { oFilletTR.className="fillet-small-gray-tr" oFilletBR.className="fillet-small-gray-br" oBtnHintsOut.style.visibility = "hidden" oBtnHints.style.visibility = "visible" oHintBackground.style.display = "none" oHintsTitle.style.display = "none" oHintsText.style.display = "none" oBtnHints.style.left = rightSideAnchor + 15; } // oBtnHints.style.left = rightSideAnchor + 15; oBtnHintsOut.style.left = rightSideAnchor + 15; oFilletTR.style.left = rightSideAnchor; oFilletBR.style.left = rightSideAnchor; oHPLogo.style.left = rightSideAnchor - 40; // spread out buttons if ( widthBump>0 ) { for ( var i=0; i<oDevice[currentDevice].service.length ; i++ ) { button = oDevice[currentDevice].service[i].serviceID thisButton = eval("oBtn" + button) thisButton.style.marginLeft = 0.5 * widthBump/oDevice[currentDevice].service.length thisButton.style.marginRight = 0.5 * widthBump/oDevice[currentDevice].service.length } } oAll.style.visibility = "visible"; oAllButtons.style.visibility = "visible"; // hide the drop-down list box and menu if no devices are installed if ((oDevice.length == 1) && (oDevice[0].devID == "unknown")) { oSelectLabel.style.visibility = "hidden"; oSelect.style.visibility = "hidden"; oMenuMask.style.visibility = "hidden"; } updateMenus(); updateInProgress = false; } function showHint(buttonID) { service = buttonID.substring(4); oHintsTitleLabel.dataFld="dir-hint-" + service.toLowerCase() + "-title"; oHintsLabel.dataFld="dir-hint-" + service.toLowerCase(); } function runApp(buttonID){ //alert("run: "+buttonID + " for device:" + currentDevice) //var shell = new ActiveXObject("WScript.Shell"); //shell.run(app,1,false); btnID = buttonID.substring(1, buttonID.length - 1); for (var i = 0; i < oDevice[currentDevice].service.length; i++) { if (btnID== oDevice[currentDevice].service[i].serviceID) { window.external.RunApp(btnID, oDevice[currentDevice].service[i].action, oDevice[currentDevice].devID); break; } } } // Present Settings menu based on currentDevice function processMenu() { var menuStr = "show-menu=dev"+currentDevice+"-settings"; ShM=1; popi(menuStr, 'menu1', 0); window.event.cancelBubble = true; } function processStatusBtn() { window.external.RunApp("status", oDevice[currentDevice].statusmon, oDevice[currentDevice].devID); } function processKeyDown() { //if ((window.event.altKey) && (window.event.keyCode >= 48)) //{ // alert("got key down: code="+window.event.keyCode); //} //else if (window.event.keyCode == 13) //{ // alert("got key down: code=<ENTER>"); //} //else // alert("processKeydown"); } function updateMenus() { var maxMenuWidth = 0; var menuNum = 1; while(eval("window.menu"+menuNum)) { maxMenuWidth = 0; var dirMenu=eval("menu"+menuNum); var menuName = dirMenu[0]; var menuStructIdx = getMenuStructIndex(dirMenu[0]); if (menuStructIdx >= 0) { for (var i = 0; i < menuStruct[menuStructIdx].entry.length; i++) { var entryName = menuStruct[menuStructIdx].entry[i].name; var elem = eval("document.all('"+entryName+"')"); maxMenuWidth = Math.max(maxMenuWidth, elem.offsetWidth); } if (maxMenuWidth > 0) { var ancestorElem = eval("document.all('menu"+menuNum+"')"); // add extra pixels for the border and submenu image (arrow bitmap) maxMenuWidth += (dirMenu[4] * 2) + 8; //if (maxMenuWidth > document.all('menu1').offsetLeft) // maxMenuWidth = document.all('menu1').offsetLeft; ancestorElem.style.width = maxMenuWidth+"px"; for (var j = 0; j < ancestorElem.children.length; j++) { var childElem = ancestorElem.children[j]; if ((childElem.children.length > 0) && (childElem.children[0].style.width)) childElem.children[0].style.width = maxMenuWidth+"px"; } } } menuNum++; } sis(); } Tag: SP3 Registry change warnings Tag: 98690
 - 24
 - Windows 2000 subordinate CA ---> 2003 I have a Windows 2000 subordinate CA in my domain that I want to upgrade to 2003. I would like to create a VMware virtual Windows 2003 virtual server and make it my CA because the physical hardware is old. Is this possible without upgrading the 2000 server to 2003? If it's not possible and I have to upgrade the exisiting server to 2003 along with certificate services, what steps do I take to make sure I have proper backups of my CA that are required if the upgrade does not go well for some reason? Any help would greatly be appreciated. Tag: SP3 Registry change warnings Tag: 98674
 - 25
 - CertStoreOpen Function Hello to all friends! I am using an example program in MS Visual C++ taken from MSDN at http://msdn.microsoft.com/en-us/library/aa382372(VS.85).aspx. I created a certificate using makecert -n "CN=Test" -sk Test -ss my Test.cer This created a store 'my' and a Test.cer file. i see 'Test.cer' there in ...\vc\bin folder. I could not find any store with the name 'my'. now when i executed the code below (complete program is at the above link), [CODE] ...... #define SIGNER_NAME L"Test" ...... #define CERT_STORE_NAME L"my" ...... if ( !( hCertStore = CertOpenStore( CERT_STORE_PROV_SYSTEM, 0, NULL, CERT_SYSTEM_STORE_CURRENT_USER, CERT_STORE_NAME))) { MyHandleError(TEXT("The MY store could not be opened.")); goto exit_SignMessage; } // Get a pointer to the signer's certificate. // This certificate must have access to the signer's private key. if(pSignerCert = CertFindCertificateInStore( hCertStore, MY_ENCODING_TYPE, 0, CERT_FIND_SUBJECT_STR, SIGNER_NAME, NULL)) { _tprintf(TEXT("The signer's certificate was found.\n")); } else { MyHandleError( TEXT("Signer certificate not found.")); goto exit_SignMessage; } [/CODE] it give error "Singer Certificate not found". Can any body help me how to solve this problem? The 'my' certificate store, is not visible. can I open the store in some editor etc to see the certificate? Or how to create a store then? regards, wilayat Tag: SP3 Registry change warnings Tag: 98672

I downloaded SP3 from another computer and installed it from a CD. I have
Spybot, which raised about 25 registry key warnings as I installed, which I
allowed. and now as I am rebooting, I am getting another 25 or so registry
key warnings. They are things such as:
System Startup Global Entry
Value Deleted
Entry: OE_WMPWMFSDK_INSTALL_24
Old data: C\WINDOWS\SYSTEM32\regscr32 /s "C:\WINDOWS\SYSTEM32\WMSdmod.dll"

and

Old Data: C:\WINDOWS\INF\unregmp2.exe/ Migrate Library

My instinct is to deny these changes that are made after reboot. Can anyone
offer suggestions?

Thanks so much to those who offer time and talent here.

Top

Re: SP3 Registry change warnings by Malke

Malke
Mon Aug 11 10:34:13 CDT 2008

ElizaDoolittle wrote:

> I downloaded SP3 from another computer and installed it from a CD. I have
> Spybot, which raised about 25 registry key warnings as I installed, which
> I allowed. and now as I am rebooting, I am getting another 25 or so
> registry
> key warnings. They are things such as:
> System Startup Global Entry
> Value Deleted
> Entry: OE_WMPWMFSDK_INSTALL_24
> Old data: C\WINDOWS\SYSTEM32\regscr32 /s "C:\WINDOWS\SYSTEM32\WMSdmod.dll"
>
> and
>
> Old Data: C:\WINDOWS\INF\unregmp2.exe/ Migrate Library
>
> My instinct is to deny these changes that are made after reboot. Can
> anyone offer suggestions?

If you want to successfully install SP3, you need to disable Spybot's
TeaTimer (which is what is causing the problem and yes, this is a problem
for installing SP3) and your antivirus. I would have *nothing* but what is
absolutely necessary running in the background. FWIW, I've installed SP3 on
a *lot* of machines and have had no problems, but I follow best practices,
i.e., making sure the system is squeaky-clean, running in tip-top shape,
and nothing extra is running resident.

Prerequisites for a successful installation - MVP Harry Waldron -
http://tinyurl.com/6nf4k4
Steps to take before you install WinXP SP3 -
http://support.microsoft.com/kb/950717
WinXP SP3 Installation -
http://technet.microsoft.com/en-us/windowsxp/cc164204.aspx

Malke
--
MS-MVP
Elephant Boy Computers - Don't Panic!
FAQ - http://www.elephantboycomputers.com/#FAQ

Top