locked
Windows 7 Build 7601 "This copoy of Windows is not genuine" problem RRS feed

  • Question

  • I've had a look at others on these forums with a similar problem, but it appears each one may be different. The laptop in question is a DELL Inspiron just over 14 months old that came direct with Windows 7 pre-installed. Suddenly its got the usual symptoms: black screen, that message in the bottom right hand corner and dialogue boxes popping up to warn that the version of Windows 7 might be counterfeit whenever someone logs on. 

    All suggestions gratefully and humbly received. Here's the diagnostic:

    Diagnostic Report (1.9.0027.0):
    -----------------------------------------
    Windows Validation Data-->

    Validation Code: 50
    Cached Online Validation Code: 0x0
    Windows Product Key: *****-*****-QCPVQ-KHRB8-RMV82
    Windows Product Key Hash: +Rj3N34NLM2JqoBO/OzgzTZXgbY=
    Windows Product ID: 00359-OEM-8992687-00095
    Windows Product ID Type: 2
    Windows License Type: OEM SLP
    Windows OS version: 6.1.7601.2.00010300.1.0.003
    ID: {B44036D2-00C0-4324-AB66-764F1C98E9CC}(1)
    Is Admin: Yes
    TestCab: 0x0
    LegitcheckControl ActiveX: N/A, hr = 0x80070002
    Signed By: N/A, hr = 0x80070002
    Product Name: Windows 7 Home Premium
    Architecture: 0x00000009
    Build lab: 7601.win7sp1_gdr.120330-1504
    TTS Error: 
    Validation Diagnostic: 
    Resolution Status: N/A

    Vista WgaER Data-->
    ThreatID(s): N/A, hr = 0x80070002
    Version: N/A, hr = 0x80070002

    Windows XP Notifications Data-->
    Cached Result: N/A, hr = 0x80070002
    File Exists: No
    Version: N/A, hr = 0x80070002
    WgaTray.exe Signed By: N/A, hr = 0x80070002
    WgaLogon.dll Signed By: N/A, hr = 0x80070002

    OGA Notifications Data-->
    Cached Result: N/A, hr = 0x80070002
    Version: N/A, hr = 0x80070002
    OGAExec.exe Signed By: N/A, hr = 0x80070002
    OGAAddin.dll Signed By: N/A, hr = 0x80070002

    OGA Data-->
    Office Status: 109 N/A
    OGA Version: N/A, 0x80070002
    Signed By: N/A, hr = 0x80070002
    Office Diagnostics: 025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3

    Browser Data-->
    Proxy settings: N/A
    User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
    Default Browser: C:\Users\Hunter\AppData\Local\Google\Chrome\Application\chrome.exe
    Download signed ActiveX controls: Prompt
    Download unsigned ActiveX controls: Disabled
    Run ActiveX controls and plug-ins: Allowed
    Initialize and script ActiveX controls not marked as safe: Disabled
    Allow scripting of Internet Explorer Webbrowser control: Disabled
    Active scripting: Allowed
    Script ActiveX controls marked as safe for scripting: Allowed

    File Scan Data-->

    Other data-->
    Office Details: <GenuineResults><MachineData><UGUID>{B44036D2-00C0-4324-AB66-764F1C98E9CC}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7601.2.00010300.1.0.003</OS><Architecture>x64</Architecture><PKey>*****-*****-*****-*****-RMV82</PKey><PID>00359-OEM-8992687-00095</PID><PIDType>2</PIDType><SID>S-1-5-21-4009144678-3518224497-2350218371</SID><SYSTEM><Manufacturer>Dell Inc.</Manufacturer><Model>Inspiron N5030                  </Model></SYSTEM><BIOS><Manufacturer>Dell Inc.</Manufacturer><Version>A02</Version><SMBIOSVersion major="2" minor="4"/><Date>20100913000000.000000+000</Date></BIOS><HWID>ADCD3F07018400F8</HWID><UserLCID>0409</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>GMT Standard Time(GMT+00:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM><OEMID>DELL  </OEMID><OEMTableID>WN09   </OEMTableID></OEM><GANotification/></MachineData><Software><Office><Result>109</Result><Products/><Applications/></Office></Software></GenuineResults>  

    Spsys.log Content: 0x80070002

    Licensing Data-->
    C:\Windows\system32\slmgr.vbs(1131, 5) Microsoft VBScript runtime error: Permission denied

    Windows Activation Technologies-->
    HrOffline: 0x00000000
    HrOnline: 0xC004C327
    HealthStatus: 0x0000000000000000
    Event Time Stamp: 5:4:2012 15:16
    ActiveX: Registered, Version: 7.1.7600.16395
    Admin Service: Registered, Version: 7.1.7600.16395
    HealthStatus Bitmask Output:


    HWID Data-->
    HWID Hash Current: MAAAAAEAAQABAAIAAAABAAAAAwABAAEA6GFYb9qFWJCeU9KG/j4OOC5nlqmo2EbK

    OEM Activation 1.0 Data-->
    N/A

    OEM Activation 2.0 Data-->
    BIOS valid for OA 2.0: yes
    Windows marker version: 0x20001
    OEMID and OEMTableID Consistent: yes
    BIOS Information: 
      ACPI Table Name OEMID Value OEMTableID Value
      APIC DELL   WN09   
      FACP DELL   WN09   
      HPET DELL   WN09   
      MCFG DELL   WN09   
      SLIC DELL   WN09   
      OSFR DELL   WN09   
      SSDT PmRef CpuPm

    Any help gratefully received. I don't like the look of the Permission Denied under the licencing data bit!

    Sunday, May 13, 2012 10:45 AM

Answers

  • (thanks, Darin for the prod - I had missed this response!)

    From what I can make out, there is noo good reason for you to have that number of files present unless there are other issues as well.

    the 'error accessing the registry' is most likely a permissions problem - and that means that there's a possibility that you have no real control over your own computer!

    Such problems tend to be caused by rootkit or even bootkit malware - and once a machine is so infected, the general recommendation has to be for a clean install.


    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth

    Thursday, May 17, 2012 7:37 PM
    Moderator

All replies

  • "San Alwigi" wrote in message news:23e2bb29-e5ad-4434-bafc-4f2edc694329...

    I've had a look at others on these forums with a similar problem, but it appears each one may be different. The laptop in question is a DELL Inspiron just over 14 months old that came direct with Windows 7 pre-installed. Suddenly its got the usual symptoms: black screen, that message in the bottom right hand corner and dialogue boxes popping up to warn that the version of Windows 7 might be counterfeit whenever someone logs on.

    All suggestions gratefully and humbly received. Here's the diagnostic:

    Diagnostic Report (1.9.0027.0):
    -----------------------------------------
    Windows Validation Data-->

    Validation Code: 50
    Cached Online Validation Code: 0x0
    Windows Product Key: *****-*****-QCPVQ-KHRB8-RMV82
    Windows Product Key Hash: +Rj3N34NLM2JqoBO/OzgzTZXgbY=
    Windows Product ID: 00359-OEM-8992687-00095
    Windows Product ID Type: 2
    Windows License Type: OEM SLP
    Windows OS version: 6.1.7601.2.00010300.1.0.003


    Other data-->
    SYSTEM><Manufacturer>Dell Inc.</Manufacturer><Model>Inspiron N5030                  </Model></SYSTEM><BIOS><Manufacturer>Dell Inc.</Manufacturer><Version>A02</Version><SMBIOSVersion major="2" minor="4"/><Date>20100913000000.000000+000</Date></BIOS


    Licensing Data-->
    C:\Windows\system32\slmgr.vbs(1131, 5) Microsoft VBScript runtime error: Permission denied

    Windows Activation Technologies-->
    HrOffline: 0x00000000
    HrOnline: 0xC004C327


    OEM Activation 2.0 Data-->
    BIOS valid for OA 2.0: yes
    Windows marker version: 0x20001


     

    Any help gratefully received. I don't like the look of the Permission Denied under the licencing data bit!

    I'm not too keen on it either - but it could be something fairly simple :) What security software are you running? (AV/Anti-malware/Firewall, etc.)
     
    First, try the following
     
    Recreate the Licensing Store
    1) Click Start button.
    2) Type: CMD.exe into the 'Search programs and files' field
    3) Right-Click on CMD.exe and select Run as Administrator
    4) Type: net stop sppsvc (It may ask you if you are sure, select yes)
    Note: the Software Protection service may not be running, this is ok.
    5) Type: cd %windir%\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform
    6) Type: rename tokens.dat tokens.bar
    7) Type: cd %windir%\system32
    8) Type: net start sppsvc
    9) Type: slui.exe
    10) After a couple of seconds Windows Activation dialog will appear. You may be asked to re-activate and/or re-enter your product key or Activation may occur automatically.

    Reboot and Post back with a new MGADiag report


    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth
    Sunday, May 13, 2012 11:02 AM
    Moderator
  • Hi Noel,

    Many thanks for the help. I followed your instructions and all went smoothly until I typed in the slui.exe command, then a dialogue box popped up saying:

    "An error has occurred

    You can also contact Dell by phone to help resolve this problem [this is a link that links to the generic Windows Help and Support pop up]

    Code: 0x80070005

    Description: Access is denied."

    I had previously tried to search for slui.exe on the laptop but nothing was found. Maybe it isn't installed?

    Sunday, May 13, 2012 1:58 PM
  • Also - the laptop had Norton, MacAfee and Lavasoft Adware running, but I've disabled them all for the time being (because the machine was running incredibly slow and I thought there might be some conflicts there. Happily, it's running at the right speed now) . Standard Windows firewall.
    Sunday, May 13, 2012 2:00 PM
  • I cannot think of a worse combination than Norton and McAfee - either by itself is bad enough.

    NEVER have two anti-virus programs running at the same time in realtime protection mode!.

    Uninstall both. Then run the removal tools from the manufacturer, and reinstall one or the other (or better still, something completely different).

    While they are both uninstalled, run another MGADiag report, and see what it has to say.


    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth

    Sunday, May 13, 2012 3:35 PM
    Moderator
  • Hi Noel,

    Actually both Norton and McAfee were uninstalled before I ran the diagnostics earlier.

    Have since downloaded AVG Free for now. However, when I now go to copy a new diagnostics report, I get the following dialogue box warning: "Failed to create output files, hr = 0x80070002. Please contact support." Have re-booted twice but still same thing....

    Sorry to bring more problems rather than solutions!

    Sunday, May 13, 2012 6:52 PM
  • ignore the error message. it will still copy and paste.
    Sunday, May 13, 2012 7:06 PM
    Answerer
  • "San Alwigi" wrote in message news:b161c0e5-c21d-4547-9a50-a05b493d3eab...

    Hi Noel,

    Actually both Norton and McAfee were uninstalled before I ran the diagnostics earlier.

    Have since downloaded AVG Free for now. However, when I now go to copy a new diagnostics report, I get the following dialogue box warning: "Failed to create output files, hr = 0x80070002. Please contact support." Have re-booted twice but still same thing....

    Sorry to bring more problems rather than solutions!

    Just ignore the output error - it simply means that the tool was unable to save the backup files to the hard drive.
    The report will still paste to the clipboard and beyond.
     
    You need to run the removal tools as well - bith products leave large amounts of driss behind unless the tools are run and WILL interfere.
     
     
     

    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth
    Sunday, May 13, 2012 7:07 PM
    Moderator
  • Hello again,

    OK - have removed McAfee and Norton in line with instructions as provided by the links you sent. And here's the report:

    Diagnostic Report (1.9.0027.0):
    -----------------------------------------
    Windows Validation Data-->

    Validation Code: 50
    Cached Online Validation Code: 0x0
    Windows Product Key: *****-*****-QCPVQ-KHRB8-RMV82
    Windows Product Key Hash: +Rj3N34NLM2JqoBO/OzgzTZXgbY=
    Windows Product ID: 00359-OEM-8992687-00095
    Windows Product ID Type: 2
    Windows License Type: OEM SLP
    Windows OS version: 6.1.7601.2.00010300.1.0.003
    ID: {B44036D2-00C0-4324-AB66-764F1C98E9CC}(3)
    Is Admin: Yes
    TestCab: 0x0
    LegitcheckControl ActiveX: N/A, hr = 0x80070002
    Signed By: N/A, hr = 0x80070002
    Product Name: Windows 7 Home Premium
    Architecture: 0x00000009
    Build lab: 7601.win7sp1_gdr.120330-1504
    TTS Error: 
    Validation Diagnostic: 
    Resolution Status: N/A

    Vista WgaER Data-->
    ThreatID(s): N/A, hr = 0x80070002
    Version: N/A, hr = 0x80070002

    Windows XP Notifications Data-->
    Cached Result: N/A, hr = 0x80070002
    File Exists: No
    Version: N/A, hr = 0x80070002
    WgaTray.exe Signed By: N/A, hr = 0x80070002
    WgaLogon.dll Signed By: N/A, hr = 0x80070002

    OGA Notifications Data-->
    Cached Result: N/A, hr = 0x80070002
    Version: N/A, hr = 0x80070002
    OGAExec.exe Signed By: N/A, hr = 0x80070002
    OGAAddin.dll Signed By: N/A, hr = 0x80070002

    OGA Data-->
    Office Status: 109 N/A
    OGA Version: N/A, 0x80070002
    Signed By: N/A, hr = 0x80070002
    Office Diagnostics: 025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3

    Browser Data-->
    Proxy settings: N/A
    User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
    Default Browser: C:\Users\Hunter\AppData\Local\Google\Chrome\Application\chrome.exe
    Download signed ActiveX controls: Prompt
    Download unsigned ActiveX controls: Disabled
    Run ActiveX controls and plug-ins: Allowed
    Initialize and script ActiveX controls not marked as safe: Disabled
    Allow scripting of Internet Explorer Webbrowser control: Disabled
    Active scripting: Allowed
    Script ActiveX controls marked as safe for scripting: Allowed

    File Scan Data-->

    Other data-->
    Office Details: <GenuineResults><MachineData><UGUID>{B44036D2-00C0-4324-AB66-764F1C98E9CC}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7601.2.00010300.1.0.003</OS><Architecture>x64</Architecture><PKey>*****-*****-*****-*****-RMV82</PKey><PID>00359-OEM-8992687-00095</PID><PIDType>2</PIDType><SID>S-1-5-21-4009144678-3518224497-2350218371</SID><SYSTEM><Manufacturer>Dell Inc.</Manufacturer><Model>Inspiron N5030                  </Model></SYSTEM><BIOS><Manufacturer>Dell Inc.</Manufacturer><Version>A02</Version><SMBIOSVersion major="2" minor="4"/><Date>20100913000000.000000+000</Date></BIOS><HWID>ADCD3F07018400F8</HWID><UserLCID>0409</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>GMT Standard Time(GMT+00:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM><OEMID>DELL  </OEMID><OEMTableID>WN09   </OEMTableID></OEM><GANotification/></MachineData><Software><Office><Result>109</Result><Products/><Applications/></Office></Software></GenuineResults>  

    Spsys.log Content: 0x80070002

    Licensing Data-->
    C:\Windows\system32\slmgr.vbs(1131, 5) Microsoft VBScript runtime error: Permission denied

    Windows Activation Technologies-->
    HrOffline: 0x00000000
    HrOnline: 0xC004C327
    HealthStatus: 0x0000000000000000
    Event Time Stamp: 5:13:2012 12:15
    ActiveX: Registered, Version: 7.1.7600.16395
    Admin Service: Registered, Version: 7.1.7600.16395
    HealthStatus Bitmask Output:


    HWID Data-->
    HWID Hash Current: MAAAAAEAAQABAAIAAAABAAAAAwABAAEA6GFYb9qFWJCeU9KG/j4OOC5nlqmo2EbK

    OEM Activation 1.0 Data-->
    N/A

    OEM Activation 2.0 Data-->
    BIOS valid for OA 2.0: yes
    Windows marker version: 0x20001
    OEMID and OEMTableID Consistent: yes
    BIOS Information: 
      ACPI Table Name OEMID Value OEMTableID Value
      APIC DELL   WN09   
      FACP DELL   WN09   
      HPET DELL   WN09   
      MCFG DELL   WN09   
      SLIC DELL   WN09   
      OSFR DELL   WN09   
      SSDT PmRef CpuPm

    Thanks again Noel,

    Sunday, May 13, 2012 7:23 PM
  • "San Alwigi" wrote in message news:8a1036d8-2d05-4621-a68c-2160d7ee09f6...

    Hello again,

    OK - have removed McAfee and Norton in line with instructions as provided by the links you sent. And here's the report:

    Diagnostic Report (1.9.0027.0):
    -----------------------------------------
    Windows Validation Data-->

    Validation Code: 50
    Cached Online Validation Code: 0x0
    Windows Product Key: *****-*****-QCPVQ-KHRB8-RMV82
    Windows Product Key Hash: +Rj3N34NLM2JqoBO/OzgzTZXgbY=
    Windows Product ID: 00359-OEM-8992687-00095
    Windows Product ID Type: 2
    Windows License Type: OEM SLP
    Windows OS version: 6.1.7601.2.00010300.1.0.003


    Licensing Data-->
    C:\Windows\system32\slmgr.vbs(1131, 5) Microsoft VBScript runtime error: Permission denied


    Thanks again Noel,

    may apply.
     

    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth
    Sunday, May 13, 2012 7:32 PM
    Moderator
  • Hello again Noel,

    Thanks for all your help to date. I've tried one or two of the suggestions behind that link but feel a little out of my depth - and the laptop doesn't seem to have certain .exe's installed so I get a lot of error messages.

    Anyhoo - I was trying to sort this out for a friend of mine (it's her laptop) over the weekend but I think I'll hand it back to her and ask her to take it to a PC repair shop somewhere and show them this thread - at least they'll know how far we've got in identifying the problem.

    So - thank you so much for your valuable support and guidance, you've been great.

    Cheerio!

    Monday, May 14, 2012 9:02 AM
  • "San Alwigi" wrote in message news:833ef0f5-be0a-4363-a5cc-e383ec7db96d...

    Hello again Noel,

    Thanks for all your help to date. I've tried one or two of the suggestions behind that link but feel a little out of my depth - and the laptop doesn't seem to have certain .exe's installed so I get a lot of error messages.

    Anyhoo - I was trying to sort this out for a friend of mine (it's her laptop) over the weekend but I think I'll hand it back to her and ask her to take it to a PC repair shop somewhere and show them this thread - at least they'll know how far we've got in identifying the problem.

    So - thank you so much for your valuable support and guidance, you've been great.

    Cheerio!

    You're welcome.
     
    We should be able to fix it here, if you're up for it :)
    Just in case....
     
    Please run the following commands - post the results
     
    REG QUERY HKU
    REG QUERY HKU\S-1-5-20
    REG QUERY HKU\S-1-5-20\Environment
    REG QUERY "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-20"
    ICACLS C:\Windows\ServiceProfiles\NetworkService
    ICACLS C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT
     
    Here are some instructions to maike life easier :)
    1) To open an Elevated Command Prompt Window (the CP window), click on Start, All Programs, Accessories – then right-click on Command Prompt, and select Run as Administrator. Accept the UAC prompt.
    2) To run the commands easier, highlight the block of commands, and right-click on the highlight – select Copy. In the CP Windows, click on the black/white icon at top left – select Paste. The commands will run but may not complete the last command, so hit the Enter Key once.
    3) To copy the results... click on the Black/White icon in the top left, and select Edit... 'Select All', and hit the Enter key - then use Ctrl+V or r-click+Paste to paste it into your response.
     

    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth
    Monday, May 14, 2012 9:52 AM
    Moderator
  • OK Noel - I'm game for a little while longer if you are! Here's what I get:

    Microsoft Windows [Version 6.1.7601]
    Copyright (c) 2009 Microsoft Corporation.  All rights reserved.

    C:\Windows\system32>REG QUERY HKU

    HKEY_USERS\.DEFAULT
    HKEY_USERS\S-1-5-19
    HKEY_USERS\S-1-5-20
    HKEY_USERS\S-1-5-21-4009144678-3518224497-2350218371-1001
    HKEY_USERS\S-1-5-21-4009144678-3518224497-2350218371-1001_Classes
    HKEY_USERS\S-1-5-18

    C:\Windows\system32>REG QUERY HKU\S-1-5-20

    HKEY_USERS\S-1-5-20\EUDC
    HKEY_USERS\S-1-5-20\Software

    C:\Windows\system32>REG QUERY HKU\S-1-5-20\Environment
    ERROR: The system was unable to find the specified registry key or value.

    C:\Windows\system32>REG QUERY "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion
    \ProfileList\S-1-5-20"

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-
    5-20
        ProfileImagePath    REG_EXPAND_SZ    C:\Windows\ServiceProfiles\NetworkServi
    ce
        Flags    REG_DWORD    0x0
        State    REG_DWORD    0x0


    C:\Windows\system32>ICACLS C:\Windows\ServiceProfiles\NetworkService
    C:\Windows\ServiceProfiles\NetworkService NT AUTHORITY\SYSTEM:(OI)(CI)(F)
                                              BUILTIN\Administrators:(OI)(CI)(F)
                                              NT AUTHORITY\NETWORK SERVICE:(OI)(CI)(
    F)

    Successfully processed 1 files; Failed processing 0 files

    C:\Windows\system32>ICACLS C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT
    C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT NT AUTHORITY\SYSTEM:(I)(F)
                                                         BUILTIN\Administrators:(I)(
    F)
                                                         NT AUTHORITY\NETWORK SERVIC
    E:(I)(F)

    Successfully processed 1 files; Failed processing 0 files

    C:\Windows\system32>

    Any good?

    Thanks

    Monday, May 14, 2012 3:10 PM
  • "San Alwigi" wrote in message news:f82d8d60-3397-487b-ab53-f01d29feb02b...

    OK Noel - I'm game for a little while longer if you are! Here's what I get:



    C:\Windows\system32>REG QUERY HKU\S-1-5-20

    HKEY_USERS\S-1-5-20\EUDC
    HKEY_USERS\S-1-5-20\Software

    C:\Windows\system32>REG QUERY HKU\S-1-5-20\Environment
    ERROR: The system was unable to find the specified registry key or value.

    Any good?

    Thanks

    the highlighted answers are interesting - they imply that there is a fairly large chunk of the registry missing.
    The obvious question then becomes 'where did it go?' - if anywhere.
    Many of the entries in the S-1-5-20 tree are missing.
    That said, removing the other entries doesn't appear to create the issues you're seeing, on its own.
     
    Let's get rid of the easy error first, and see what that does to your MGADiag response.
     
    Copy the following lines between the ===== to Notepad (including the blank line)
     
    ===============================================
    Windows Registry Editor Version 5.00
     
    [HKEY_USERS\S-1-5-20\Environment]
    "TEMP"=hex(2):25,00,55,00,53,00,45,00,52,00,50,00,52,00,4f,00,46,00,49,00,4c,\
      00,45,00,25,00,5c,00,41,00,70,00,70,00,44,00,61,00,74,00,61,00,5c,00,4c,00,\
      6f,00,63,00,61,00,6c,00,5c,00,54,00,65,00,6d,00,70,00,00,00
    "TMP"=hex(2):25,00,55,00,53,00,45,00,52,00,50,00,52,00,4f,00,46,00,49,00,4c,00,\
      45,00,25,00,5c,00,41,00,70,00,70,00,44,00,61,00,74,00,61,00,5c,00,4c,00,6f,\
      00,63,00,61,00,6c,00,5c,00,54,00,65,00,6d,00,70,00,00,00
     
    ================================================
     
    Save the resulting file as NWSenv.reg
    now right-click on the saved file, and select Merge - you should get a (or two!) warning (accept it/them) and then a success message.
    Reboot and run another MGADiag report - post the results.
     
    Also - please run the following commands from an elevated command prompt.
     
    DIR C:\Windows\ServiceProfiles\NetworkService
    DIR C:\Windows\ServiceProfiles\NetworkService  /ah
     
    post the results.
     
     

    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth
    Monday, May 14, 2012 7:58 PM
    Moderator
  • OK, firstly the laptop didn't like the NWSenv.reg merge. It says:

    "Cannot import C:\Users\Hunter\Desktop\NWSenv.reg: Error accessing the registry"

    Anyway, I then ran the Network Service commands and got this (deep breath!):

    03/23/2012  07:18 PM           524,288 NTUSER.DAT{7a43c964-7514-11e1-b899-806e6f
    6e6963}.TMContainer00000000000000000002.regtrans-ms
    05/03/2011  11:40 PM            65,536 NTUSER.DAT{7bbec6fe-7595-11e0-96c2-f04da2
    a9e6ef}.TM.blf
    05/03/2011  11:40 PM           524,288 NTUSER.DAT{7bbec6fe-7595-11e0-96c2-f04da2
    a9e6ef}.TMContainer00000000000000000001.regtrans-ms
    05/03/2011  11:40 PM           524,288 NTUSER.DAT{7bbec6fe-7595-11e0-96c2-f04da2
    a9e6ef}.TMContainer00000000000000000002.regtrans-ms
    01/25/2012  08:38 AM            65,536 NTUSER.DAT{7c152a5d-4727-11e1-846e-806e6f
    6e6963}.TM.blf
    01/25/2012  08:38 AM           524,288 NTUSER.DAT{7c152a5d-4727-11e1-846e-806e6f
    6e6963}.TMContainer00000000000000000001.regtrans-ms
    01/25/2012  08:38 AM           524,288 NTUSER.DAT{7c152a5d-4727-11e1-846e-806e6f
    6e6963}.TMContainer00000000000000000002.regtrans-ms
    01/15/2012  03:33 PM            65,536 NTUSER.DAT{7d0c8b88-3f7f-11e1-bd0f-f04da2
    a9e6ef}.TM.blf
    01/15/2012  03:33 PM           524,288 NTUSER.DAT{7d0c8b88-3f7f-11e1-bd0f-f04da2
    a9e6ef}.TMContainer00000000000000000001.regtrans-ms
    01/15/2012  03:33 PM           524,288 NTUSER.DAT{7d0c8b88-3f7f-11e1-bd0f-f04da2
    a9e6ef}.TMContainer00000000000000000002.regtrans-ms
    08/31/2011  12:58 PM            65,536 NTUSER.DAT{831b9001-d3ac-11e0-8c9c-f04da2
    a9e6ef}.TM.blf
    08/31/2011  12:58 PM           524,288 NTUSER.DAT{831b9001-d3ac-11e0-8c9c-f04da2
    a9e6ef}.TMContainer00000000000000000001.regtrans-ms
    08/31/2011  12:58 PM           524,288 NTUSER.DAT{831b9001-d3ac-11e0-8c9c-f04da2
    a9e6ef}.TMContainer00000000000000000002.regtrans-ms
    06/14/2011  11:03 AM            65,536 NTUSER.DAT{87adce33-9666-11e0-8b98-f04da2
    a9e6ef}.TM.blf
    06/14/2011  11:03 AM           524,288 NTUSER.DAT{87adce33-9666-11e0-8b98-f04da2
    a9e6ef}.TMContainer00000000000000000001.regtrans-ms
    06/14/2011  11:03 AM           524,288 NTUSER.DAT{87adce33-9666-11e0-8b98-f04da2
    a9e6ef}.TMContainer00000000000000000002.regtrans-ms
    10/22/2011  03:45 PM            65,536 NTUSER.DAT{89867989-fcad-11e0-85c5-f04da2
    a9e6ef}.TM.blf
    10/22/2011  03:45 PM           524,288 NTUSER.DAT{89867989-fcad-11e0-85c5-f04da2
    a9e6ef}.TMContainer00000000000000000001.regtrans-ms
    10/22/2011  03:45 PM           524,288 NTUSER.DAT{89867989-fcad-11e0-85c5-f04da2
    a9e6ef}.TMContainer00000000000000000002.regtrans-ms
    03/03/2012  12:01 AM            65,536 NTUSER.DAT{8ee1ccb1-6485-11e1-b4a9-f04da2
    a9e6ef}.TM.blf
    03/03/2012  12:01 AM           524,288 NTUSER.DAT{8ee1ccb1-6485-11e1-b4a9-f04da2
    a9e6ef}.TMContainer00000000000000000001.regtrans-ms
    03/03/2012  12:01 AM           524,288 NTUSER.DAT{8ee1ccb1-6485-11e1-b4a9-f04da2
    a9e6ef}.TMContainer00000000000000000002.regtrans-ms
    02/19/2012  12:40 PM            65,536 NTUSER.DAT{97c39574-5ae7-11e1-83cd-f04da2
    a9e6ef}.TM.blf
    02/19/2012  12:40 PM           524,288 NTUSER.DAT{97c39574-5ae7-11e1-83cd-f04da2
    a9e6ef}.TMContainer00000000000000000001.regtrans-ms
    02/19/2012  12:40 PM           524,288 NTUSER.DAT{97c39574-5ae7-11e1-83cd-f04da2
    a9e6ef}.TMContainer00000000000000000002.regtrans-ms
    01/14/2012  06:02 PM            65,536 NTUSER.DAT{9a36788c-3ec2-11e1-a249-f04da2
    a9e6ef}.TM.blf
    01/14/2012  06:02 PM           524,288 NTUSER.DAT{9a36788c-3ec2-11e1-a249-f04da2
    a9e6ef}.TMContainer00000000000000000001.regtrans-ms
    01/14/2012  06:02 PM           524,288 NTUSER.DAT{9a36788c-3ec2-11e1-a249-f04da2
    a9e6ef}.TMContainer00000000000000000002.regtrans-ms
    12/30/2011  05:59 PM            65,536 NTUSER.DAT{9bfb41f0-32f6-11e1-87a1-806e6f
    6e6963}.TM.blf
    12/30/2011  05:59 PM           524,288 NTUSER.DAT{9bfb41f0-32f6-11e1-87a1-806e6f
    6e6963}.TMContainer00000000000000000001.regtrans-ms
    12/30/2011  05:59 PM           524,288 NTUSER.DAT{9bfb41f0-32f6-11e1-87a1-806e6f
    6e6963}.TMContainer00000000000000000002.regtrans-ms
    12/31/2011  01:03 AM            65,536 NTUSER.DAT{9bfb4258-32f6-11e1-87a1-f04da2
    a9e6ef}.TM.blf
    12/31/2011  01:03 AM           524,288 NTUSER.DAT{9bfb4258-32f6-11e1-87a1-f04da2
    a9e6ef}.TMContainer00000000000000000001.regtrans-ms
    12/31/2011  01:03 AM           524,288 NTUSER.DAT{9bfb4258-32f6-11e1-87a1-f04da2
    a9e6ef}.TMContainer00000000000000000002.regtrans-ms
    07/30/2011  10:46 PM            65,536 NTUSER.DAT{a1c0fb22-ba7d-11e0-8d76-f04da2
    a9e6ef}.TM.blf
    07/30/2011  10:46 PM           524,288 NTUSER.DAT{a1c0fb22-ba7d-11e0-8d76-f04da2
    a9e6ef}.TMContainer00000000000000000001.regtrans-ms
    07/30/2011  10:46 PM           524,288 NTUSER.DAT{a1c0fb22-ba7d-11e0-8d76-f04da2
    a9e6ef}.TMContainer00000000000000000002.regtrans-ms
    01/04/2012  08:14 AM            65,536 NTUSER.DAT{a2447cb1-36a3-11e1-9134-806e6f
    6e6963}.TM.blf
    01/04/2012  08:14 AM           524,288 NTUSER.DAT{a2447cb1-36a3-11e1-9134-806e6f
    6e6963}.TMContainer00000000000000000001.regtrans-ms
    01/04/2012  08:14 AM           524,288 NTUSER.DAT{a2447cb1-36a3-11e1-9134-806e6f
    6e6963}.TMContainer00000000000000000002.regtrans-ms
    06/18/2011  10:43 PM            65,536 NTUSER.DAT{a2aaed25-998d-11e0-92b7-f04da2
    a9e6ef}.TM.blf
    06/18/2011  10:43 PM           524,288 NTUSER.DAT{a2aaed25-998d-11e0-92b7-f04da2
    a9e6ef}.TMContainer00000000000000000001.regtrans-ms
    06/18/2011  10:43 PM           524,288 NTUSER.DAT{a2aaed25-998d-11e0-92b7-f04da2
    a9e6ef}.TMContainer00000000000000000002.regtrans-ms
    10/20/2011  05:44 PM            65,536 NTUSER.DAT{a3a733e8-fb31-11e0-a811-f04da2
    a9e6ef}.TM.blf
    10/20/2011  05:44 PM           524,288 NTUSER.DAT{a3a733e8-fb31-11e0-a811-f04da2
    a9e6ef}.TMContainer00000000000000000001.regtrans-ms
    10/20/2011  05:44 PM           524,288 NTUSER.DAT{a3a733e8-fb31-11e0-a811-f04da2
    a9e6ef}.TMContainer00000000000000000002.regtrans-ms
    11/25/2011  11:31 PM            65,536 NTUSER.DAT{a83f67f4-179f-11e1-95b0-806e6f
    6e6963}.TM.blf
    11/25/2011  11:31 PM           524,288 NTUSER.DAT{a83f67f4-179f-11e1-95b0-806e6f
    6e6963}.TMContainer00000000000000000001.regtrans-ms
    11/25/2011  11:31 PM           524,288 NTUSER.DAT{a83f67f4-179f-11e1-95b0-806e6f
    6e6963}.TMContainer00000000000000000002.regtrans-ms
    09/14/2011  08:13 AM            65,536 NTUSER.DAT{a8b90c0e-dea0-11e0-a739-806e6f
    6e6963}.TM.blf
    09/14/2011  08:13 AM           524,288 NTUSER.DAT{a8b90c0e-dea0-11e0-a739-806e6f
    6e6963}.TMContainer00000000000000000001.regtrans-ms
    09/14/2011  08:13 AM           524,288 NTUSER.DAT{a8b90c0e-dea0-11e0-a739-806e6f
    6e6963}.TMContainer00000000000000000002.regtrans-ms
    08/21/2011  12:57 AM            65,536 NTUSER.DAT{a91d1404-cb0c-11e0-8256-f04da2
    a9e6ef}.TM.blf
    08/21/2011  12:57 AM           524,288 NTUSER.DAT{a91d1404-cb0c-11e0-8256-f04da2
    a9e6ef}.TMContainer00000000000000000001.regtrans-ms
    08/21/2011  12:57 AM           524,288 NTUSER.DAT{a91d1404-cb0c-11e0-8256-f04da2
    a9e6ef}.TMContainer00000000000000000002.regtrans-ms
    05/09/2011  08:11 AM            65,536 NTUSER.DAT{aaf3c967-7a0a-11e0-8fd0-806e6f
    6e6963}.TM.blf
    05/09/2011  08:11 AM           524,288 NTUSER.DAT{aaf3c967-7a0a-11e0-8fd0-806e6f
    6e6963}.TMContainer00000000000000000001.regtrans-ms
    05/09/2011  08:11 AM           524,288 NTUSER.DAT{aaf3c967-7a0a-11e0-8fd0-806e6f
    6e6963}.TMContainer00000000000000000002.regtrans-ms
    07/03/2011  10:50 PM            65,536 NTUSER.DAT{b5e5bb51-a574-11e0-a556-806e6f
    6e6963}.TM.blf
    07/03/2011  10:50 PM           524,288 NTUSER.DAT{b5e5bb51-a574-11e0-a556-806e6f
    6e6963}.TMContainer00000000000000000001.regtrans-ms
    07/03/2011  10:50 PM           524,288 NTUSER.DAT{b5e5bb51-a574-11e0-a556-806e6f
    6e6963}.TMContainer00000000000000000002.regtrans-ms
    07/08/2011  04:14 PM            65,536 NTUSER.DAT{b624dfb8-a970-11e0-9398-806e6f
    6e6963}.TM.blf
    07/08/2011  04:14 PM           524,288 NTUSER.DAT{b624dfb8-a970-11e0-9398-806e6f
    6e6963}.TMContainer00000000000000000001.regtrans-ms
    07/08/2011  04:14 PM           524,288 NTUSER.DAT{b624dfb8-a970-11e0-9398-806e6f
    6e6963}.TMContainer00000000000000000002.regtrans-ms
    02/07/2012  11:07 PM            65,536 NTUSER.DAT{bb6b0f1a-51ba-11e1-b348-806e6f
    6e6963}.TM.blf
    02/07/2012  11:07 PM           524,288 NTUSER.DAT{bb6b0f1a-51ba-11e1-b348-806e6f
    6e6963}.TMContainer00000000000000000001.regtrans-ms
    02/07/2012  11:07 PM           524,288 NTUSER.DAT{bb6b0f1a-51ba-11e1-b348-806e6f
    6e6963}.TMContainer00000000000000000002.regtrans-ms
    02/17/2012  08:57 PM            65,536 NTUSER.DAT{bfa74415-5999-11e1-8f4a-806e6f
    6e6963}.TM.blf
    02/17/2012  08:57 PM           524,288 NTUSER.DAT{bfa74415-5999-11e1-8f4a-806e6f
    6e6963}.TMContainer00000000000000000001.regtrans-ms
    02/17/2012  08:57 PM           524,288 NTUSER.DAT{bfa74415-5999-11e1-8f4a-806e6f
    6e6963}.TMContainer00000000000000000002.regtrans-ms
    05/01/2011  01:15 PM            65,536 NTUSER.DAT{c50e88b4-73ce-11e0-93b6-f04da2
    a9e6ef}.TM.blf
    05/01/2011  01:15 PM           524,288 NTUSER.DAT{c50e88b4-73ce-11e0-93b6-f04da2
    a9e6ef}.TMContainer00000000000000000001.regtrans-ms
    05/01/2011  01:15 PM           524,288 NTUSER.DAT{c50e88b4-73ce-11e0-93b6-f04da2
    a9e6ef}.TMContainer00000000000000000002.regtrans-ms
    09/16/2011  05:06 PM            65,536 NTUSER.DAT{cb6032f4-e07d-11e0-add6-806e6f
    6e6963}.TM.blf
    09/16/2011  05:06 PM           524,288 NTUSER.DAT{cb6032f4-e07d-11e0-add6-806e6f
    6e6963}.TMContainer00000000000000000001.regtrans-ms
    09/16/2011  05:06 PM           524,288 NTUSER.DAT{cb6032f4-e07d-11e0-add6-806e6f
    6e6963}.TMContainer00000000000000000002.regtrans-ms
    08/18/2011  11:33 PM            65,536 NTUSER.DAT{ccf55ef8-c975-11e0-8153-f04da2
    a9e6ef}.TM.blf
    08/18/2011  11:33 PM           524,288 NTUSER.DAT{ccf55ef8-c975-11e0-8153-f04da2
    a9e6ef}.TMContainer00000000000000000001.regtrans-ms
    08/18/2011  11:33 PM           524,288 NTUSER.DAT{ccf55ef8-c975-11e0-8153-f04da2
    a9e6ef}.TMContainer00000000000000000002.regtrans-ms
    12/10/2011  12:46 PM            65,536 NTUSER.DAT{cd059f09-2321-11e1-81f4-f04da2
    a9e6ef}.TM.blf
    12/10/2011  12:46 PM           524,288 NTUSER.DAT{cd059f09-2321-11e1-81f4-f04da2
    a9e6ef}.TMContainer00000000000000000001.regtrans-ms
    12/10/2011  12:46 PM           524,288 NTUSER.DAT{cd059f09-2321-11e1-81f4-f04da2
    a9e6ef}.TMContainer00000000000000000002.regtrans-ms
    07/24/2011  06:13 PM            65,536 NTUSER.DAT{cd063c34-b5d8-11e0-9922-f04da2
    a9e6ef}.TM.blf
    07/24/2011  06:13 PM           524,288 NTUSER.DAT{cd063c34-b5d8-11e0-9922-f04da2
    a9e6ef}.TMContainer00000000000000000001.regtrans-ms
    07/24/2011  06:13 PM           524,288 NTUSER.DAT{cd063c34-b5d8-11e0-9922-f04da2
    a9e6ef}.TMContainer00000000000000000002.regtrans-ms
    12/24/2011  03:37 PM            65,536 NTUSER.DAT{d37539b2-2e3c-11e1-96d8-806e6f
    6e6963}.TM.blf
    12/24/2011  03:37 PM           524,288 NTUSER.DAT{d37539b2-2e3c-11e1-96d8-806e6f
    6e6963}.TMContainer00000000000000000001.regtrans-ms
    12/24/2011  03:37 PM           524,288 NTUSER.DAT{d37539b2-2e3c-11e1-96d8-806e6f
    6e6963}.TMContainer00000000000000000002.regtrans-ms
    07/02/2011  10:51 AM            65,536 NTUSER.DAT{d9d49398-a490-11e0-bc3e-806e6f
    6e6963}.TM.blf
    07/02/2011  10:51 AM           524,288 NTUSER.DAT{d9d49398-a490-11e0-bc3e-806e6f
    6e6963}.TMContainer00000000000000000001.regtrans-ms
    07/02/2011  10:51 AM           524,288 NTUSER.DAT{d9d49398-a490-11e0-bc3e-806e6f
    6e6963}.TMContainer00000000000000000002.regtrans-ms
    06/07/2011  11:16 PM            65,536 NTUSER.DAT{e11cb1f9-911d-11e0-a0bd-f04da2
    a9e6ef}.TM.blf
    06/07/2011  11:16 PM           524,288 NTUSER.DAT{e11cb1f9-911d-11e0-a0bd-f04da2
    a9e6ef}.TMContainer00000000000000000001.regtrans-ms
    06/07/2011  11:16 PM           524,288 NTUSER.DAT{e11cb1f9-911d-11e0-a0bd-f04da2
    a9e6ef}.TMContainer00000000000000000002.regtrans-ms
    03/17/2012  12:19 PM            65,536 NTUSER.DAT{e1947f28-701f-11e1-9471-806e6f
    6e6963}.TM.blf
    03/17/2012  12:19 PM           524,288 NTUSER.DAT{e1947f28-701f-11e1-9471-806e6f
    6e6963}.TMContainer00000000000000000001.regtrans-ms
    03/17/2012  12:19 PM           524,288 NTUSER.DAT{e1947f28-701f-11e1-9471-806e6f
    6e6963}.TMContainer00000000000000000002.regtrans-ms
    11/04/2011  07:46 PM            65,536 NTUSER.DAT{e1e48631-0714-11e1-8e47-806e6f
    6e6963}.TM.blf
    11/04/2011  07:46 PM           524,288 NTUSER.DAT{e1e48631-0714-11e1-8e47-806e6f
    6e6963}.TMContainer00000000000000000001.regtrans-ms
    11/04/2011  07:46 PM           524,288 NTUSER.DAT{e1e48631-0714-11e1-8e47-806e6f
    6e6963}.TMContainer00000000000000000002.regtrans-ms
    09/19/2011  03:32 AM            65,536 NTUSER.DAT{e20eb67a-e1d7-11e0-a610-f04da2
    a9e6ef}.TM.blf
    09/19/2011  03:32 AM           524,288 NTUSER.DAT{e20eb67a-e1d7-11e0-a610-f04da2
    a9e6ef}.TMContainer00000000000000000001.regtrans-ms
    09/19/2011  03:32 AM           524,288 NTUSER.DAT{e20eb67a-e1d7-11e0-a610-f04da2
    a9e6ef}.TMContainer00000000000000000002.regtrans-ms
    08/03/2011  03:12 PM            65,536 NTUSER.DAT{e2ddd02f-bdb0-11e0-99dd-f04da2
    a9e6ef}.TM.blf
    08/03/2011  03:12 PM           524,288 NTUSER.DAT{e2ddd02f-bdb0-11e0-99dd-f04da2
    a9e6ef}.TMContainer00000000000000000001.regtrans-ms
    08/03/2011  03:12 PM           524,288 NTUSER.DAT{e2ddd02f-bdb0-11e0-99dd-f04da2
    a9e6ef}.TMContainer00000000000000000002.regtrans-ms
    07/28/2011  12:00 AM            65,536 NTUSER.DAT{e4e4a8c7-b828-11e0-8799-f04da2
    a9e6ef}.TM.blf
    07/28/2011  12:00 AM           524,288 NTUSER.DAT{e4e4a8c7-b828-11e0-8799-f04da2
    a9e6ef}.TMContainer00000000000000000001.regtrans-ms
    07/28/2011  12:00 AM           524,288 NTUSER.DAT{e4e4a8c7-b828-11e0-8799-f04da2
    a9e6ef}.TMContainer00000000000000000002.regtrans-ms
    10/06/2011  10:00 PM            65,536 NTUSER.DAT{ed1b35c2-f02e-11e0-ab28-f04da2
    a9e6ef}.TM.blf
    10/06/2011  10:00 PM           524,288 NTUSER.DAT{ed1b35c2-f02e-11e0-ab28-f04da2
    a9e6ef}.TMContainer00000000000000000001.regtrans-ms
    10/06/2011  10:00 PM           524,288 NTUSER.DAT{ed1b35c2-f02e-11e0-ab28-f04da2
    a9e6ef}.TMContainer00000000000000000002.regtrans-ms
    11/12/2011  12:44 AM            65,536 NTUSER.DAT{ed3449ca-0c85-11e1-a195-f04da2
    a9e6ef}.TM.blf
    11/12/2011  12:44 AM           524,288 NTUSER.DAT{ed3449ca-0c85-11e1-a195-f04da2
    a9e6ef}.TMContainer00000000000000000001.regtrans-ms
    11/12/2011  12:44 AM           524,288 NTUSER.DAT{ed3449ca-0c85-11e1-a195-f04da2
    a9e6ef}.TMContainer00000000000000000002.regtrans-ms
    02/19/2012  03:19 PM            65,536 NTUSER.DAT{ee438f52-5b03-11e1-b7d9-806e6f
    6e6963}.TM.blf
    02/19/2012  03:19 PM           524,288 NTUSER.DAT{ee438f52-5b03-11e1-b7d9-806e6f
    6e6963}.TMContainer00000000000000000001.regtrans-ms
    02/19/2012  03:19 PM           524,288 NTUSER.DAT{ee438f52-5b03-11e1-b7d9-806e6f
    6e6963}.TMContainer00000000000000000002.regtrans-ms
    06/02/2011  07:27 PM            65,536 NTUSER.DAT{ef4725b0-8d45-11e0-b5cd-806e6f
    6e6963}.TM.blf
    06/02/2011  07:27 PM           524,288 NTUSER.DAT{ef4725b0-8d45-11e0-b5cd-806e6f
    6e6963}.TMContainer00000000000000000001.regtrans-ms
    06/02/2011  07:27 PM           524,288 NTUSER.DAT{ef4725b0-8d45-11e0-b5cd-806e6f
    6e6963}.TMContainer00000000000000000002.regtrans-ms
    05/04/2012  08:32 PM            65,536 ntuser.dat{f13124e1-9608-11e1-84cb-806e6f
    6e6963}.TM.blf
    05/04/2012  08:32 PM           524,288 ntuser.dat{f13124e1-9608-11e1-84cb-806e6f
    6e6963}.TMContainer00000000000000000001.regtrans-ms
    05/04/2012  08:32 PM           524,288 ntuser.dat{f13124e1-9608-11e1-84cb-806e6f
    6e6963}.TMContainer00000000000000000002.regtrans-ms
    08/31/2011  10:11 PM            65,536 NTUSER.DAT{f253e7c6-d3d3-11e0-ad37-f04da2
    a9e6ef}.TM.blf
    08/31/2011  10:11 PM           524,288 NTUSER.DAT{f253e7c6-d3d3-11e0-ad37-f04da2
    a9e6ef}.TMContainer00000000000000000001.regtrans-ms
    08/31/2011  10:11 PM           524,288 NTUSER.DAT{f253e7c6-d3d3-11e0-ad37-f04da2
    a9e6ef}.TMContainer00000000000000000002.regtrans-ms
    08/05/2011  01:58 PM            65,536 NTUSER.DAT{f4a5be37-bf5f-11e0-89e2-806e6f
    6e6963}.TM.blf
    08/05/2011  01:58 PM           524,288 NTUSER.DAT{f4a5be37-bf5f-11e0-89e2-806e6f
    6e6963}.TMContainer00000000000000000001.regtrans-ms
    08/05/2011  01:58 PM           524,288 NTUSER.DAT{f4a5be37-bf5f-11e0-89e2-806e6f
    6e6963}.TMContainer00000000000000000002.regtrans-ms
    08/24/2011  02:40 PM            65,536 NTUSER.DAT{f8c313ec-ce26-11e0-b3d8-f04da2
    a9e6ef}.TM.blf
    08/24/2011  02:40 PM           524,288 NTUSER.DAT{f8c313ec-ce26-11e0-b3d8-f04da2
    a9e6ef}.TMContainer00000000000000000001.regtrans-ms
    08/24/2011  02:40 PM           524,288 NTUSER.DAT{f8c313ec-ce26-11e0-b3d8-f04da2
    a9e6ef}.TMContainer00000000000000000002.regtrans-ms
    07/03/2011  12:40 PM            65,536 NTUSER.DAT{fb9ab016-a556-11e0-bd98-f04da2
    a9e6ef}.TM.blf
    07/03/2011  12:40 PM           524,288 NTUSER.DAT{fb9ab016-a556-11e0-bd98-f04da2
    a9e6ef}.TMContainer00000000000000000001.regtrans-ms
    07/03/2011  12:40 PM           524,288 NTUSER.DAT{fb9ab016-a556-11e0-bd98-f04da2
    a9e6ef}.TMContainer00000000000000000002.regtrans-ms
    08/30/2011  10:36 PM            65,536 NTUSER.DAT{fbb057c2-d2e0-11e0-bdbb-f04da2
    a9e6ef}.TM.blf
    08/30/2011  10:36 PM           524,288 NTUSER.DAT{fbb057c2-d2e0-11e0-bdbb-f04da2
    a9e6ef}.TMContainer00000000000000000001.regtrans-ms
    08/30/2011  10:36 PM           524,288 NTUSER.DAT{fbb057c2-d2e0-11e0-bdbb-f04da2
    a9e6ef}.TMContainer00000000000000000002.regtrans-ms
    08/23/2011  11:36 PM            65,536 NTUSER.DAT{fd71ff18-cd6b-11e0-8f59-f04da2
    a9e6ef}.TM.blf
    08/23/2011  11:36 PM           524,288 NTUSER.DAT{fd71ff18-cd6b-11e0-8f59-f04da2
    a9e6ef}.TMContainer00000000000000000001.regtrans-ms
    08/23/2011  11:36 PM           524,288 NTUSER.DAT{fd71ff18-cd6b-11e0-8f59-f04da2
    a9e6ef}.TMContainer00000000000000000002.regtrans-ms
    05/06/2012  02:04 PM            65,536 ntuser.dat{fe22555a-977b-11e1-8252-806e6f
    6e6963}.TM.blf
    05/06/2012  02:04 PM           524,288 ntuser.dat{fe22555a-977b-11e1-8252-806e6f
    6e6963}.TMContainer00000000000000000001.regtrans-ms
    05/06/2012  02:04 PM           524,288 ntuser.dat{fe22555a-977b-11e1-8252-806e6f
    6e6963}.TMContainer00000000000000000002.regtrans-ms
    08/25/2011  10:32 AM            65,536 NTUSER.DAT{ff0cb64f-cef4-11e0-9185-f04da2
    a9e6ef}.TM.blf
    08/25/2011  10:32 AM           524,288 NTUSER.DAT{ff0cb64f-cef4-11e0-9185-f04da2
    a9e6ef}.TMContainer00000000000000000001.regtrans-ms
    08/25/2011  10:32 AM           524,288 NTUSER.DAT{ff0cb64f-cef4-11e0-9185-f04da2
    a9e6ef}.TMContainer00000000000000000002.regtrans-ms
                 301 File(s)    110,565,376 bytes
                   1 Dir(s)  240,123,613,184 bytes free

    C:\Windows\system32>


    Monday, May 14, 2012 8:47 PM
  • (thanks, Darin for the prod - I had missed this response!)

    From what I can make out, there is noo good reason for you to have that number of files present unless there are other issues as well.

    the 'error accessing the registry' is most likely a permissions problem - and that means that there's a possibility that you have no real control over your own computer!

    Such problems tend to be caused by rootkit or even bootkit malware - and once a machine is so infected, the general recommendation has to be for a clean install.


    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth

    Thursday, May 17, 2012 7:37 PM
    Moderator
  • Hello Noel,

    Thanks once again for this - didn't think you had abandoned me! Anyhow I will recommend that we follow your advice. Many thanks! Over and out.

    Thursday, May 24, 2012 3:54 PM
  • "San Alwigi" wrote in message news:fd9108b9-4ea2-42d6-a7aa-a115dac5b1cc...

    Hello Noel,

    Thanks once again for this - didn't think you had abandoned me! Anyhow I will recommend that we follow your advice. Many thanks! Over and out.

    .

    Good Luck!

    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth
    Thursday, May 24, 2012 4:39 PM
    Moderator