Recovering from 10 hours Windows XP activation horror

[hartiberlin]

Many thanks for all your help and tips.
Please open up a new topic over here in this board and post about your favourite backup-process and
software to prevent failure of a Windows XP installation.
Surely there are programs, that still dont exist under Linux, so me and probably many other people too would still need for the first time a dual boot setup
or using 2 PCs.
I am really looking forward to use a very slim linux disti like Damn Small Linux DSL with Firefox, Thunderbird for my daily online work, that is very fast and boots up in 10 seconds from the HD or USB stick  and easy to maintain and backup and for all the other work being done offline use a bigger disti with lots of programs.
What do you think about this ?

[zero]

I run 4 hard drives.

1) OS
2) Data Drive

3) Backup OS
4) Backup Data

I partition the OS drive so that its a bit safer as well,
so that the OS could if needed, be erased and all the
major data would be fine.

I do not backup the drives using Raid.   Because if you do that, and you
get a virus.. it would clone the virus to the backup drives.

I manually backup entire HDs every month or so.   Anything that new and very
important, I will also manually backup to the backup drives.


I do not use Dvds or other physical media, because its more costly,
very slow.. and they can get scratched etc.   

HDs do fail however.   You must keep them ultra cool for them to last
a long time.  1" space between each drive and a fan blowing air
between them.   

I lost like 3 drives before because I didnt have good cooling.  The bottom
drives heat would rise and cook the upper drives to early deaths.   With new
cooling via a custom case mod..  Ive not lost a drive yet - and its been years.

Good luck

[Iosh]

Good. Damn Small Linux is a Debian-derived light distribution, so it's a great choice to start with.

[rensseak]

Hi,
I just had to work a 10 hours to fix some horrible Windows XP
activation loop on my laptop PC.

It was started by trendmicro.de online scanner trying to delete
the winlogon.exe file and then there was always a bluecreen
on bootup and not coming out of this loop.

So I am really sick now of the Windows XP crap with all
its activation hurdles and annoying big installation files...

More than 50.000 Files on drive C:
what a f..ck this is...

I am going now to switch to Linux for sure.
I have enough of it now...

Herzlichen Gl?ckwunsch und willkommen in der Linux-Welt!  Wurde allerh?chste Zeit.

Gru?
Norbert

[hartiberlin]

Check whether you multiple copies of  winlogon.exe  If yes then your Pc is infected.

Troj/Madr-B is a backdoor Trojan which allows a remote intruder to access and control the computer via IRC channels.

When first run the Trojan copies itself as winlogon.exe to the folders <WINDOWS>\system\ and <WINDOWS>\system32\wins\ with the read-only and hidden attributes set and creates the following registry entries, so that winlogon.exe is run automatically each time Windows is started: [/b]
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
Winlogon = <WINDOWS>\system\winlogon.exe

HKCU\Software\Microsoft\Windows\CurrentVersion\Run\
Winlogon = <WINDOWS>\system32\wins\winlogon.exe

Each time the Trojan is run it tries to connect to a remote IRC server and join a specific channel using a random nickname. The Trojan then runs continuously in the background, listening on the channel for commands to execute.

Recovery
Summary  Description  Recovery   
This section tells you how to remove the threat.
Please follow the instructions for removing Trojans.


Windows NT/2000/XP/2003

In Windows NT/2000/XP/2003 you will also need to edit the following registry entries. The removal of these entries is optional in Windows 95/98/Me. Please read the warning about editing the registry.

At the taskbar, click Start|Run. Type 'Regedit' and press Return. The registry editor opens.

Before you edit the registry, you should make a backup. On the 'Registry' menu, click 'Export Registry File'. In the 'Export range' panel, click 'All', then save your registry as Backup.

Locate the HKEY_LOCAL_MACHINE entry:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
Winlogon = <WINDOWS>\system\winlogon.exe

and delete it if it exists.

Each user has a registry area named HKEY_USERS\[code number indicating user]\. For each user locate the entry:

HKU\[code number]\Software\Microsoft\Windows\
CurrentVersion\Run\Winlogon = <WINDOWS>\system32\wins\winlogon.exe

and delete it if it exists.

Close the registry editor and reboot your computer.

Hi,
many thanks for this info.
I just scanned my PC again and I have just:

winlogon.bak
in addition to
winlogon.exe both in the windows/system32 folder.

If I use STRG ALT DEL to see the running tasks,
it also displays winlogon.exe
but I can not shut this down.

Is WinXP needing this task for normal use or how
can I disable it ?
Under services ?

Does anyone have a good list of the lowest possible services
that a single user WinXP machine only needs to run ,
when using just DSL for Internet and using a Fritzbox  router
and in another place only a DSL Modem via PPPOE ?

I want to disable all the services I really don?t need to run
in the background.

I already tried this some time ago and if you don?t
have save a registry backup, I had disabled too many
services and the PC did not run anymore...
so one has to be really cautious about this..

Also what is the best software firewall under WinXP ?

Is the free version of Zonealarm still preferred ?
Or is Sygate better ?
It must a Firewall, which is very easy to configure,
not like Zonealarm Pro, which has 1000 options...