Hope this helps someone using domain accounts instead of local ones!

1. You will have to burn the cd and boot from it.
2. Selected your language.
3. At the bottom right (or was it left) I clicked the Repair option.
4. Windows will do a quick scan then came back and say it found an issue with my startup files and asked if i wanted to repair and reboot.
5. I chose ok and reboot was successful!

I hope this helps you with the “Windows error 0Xc000000f windows failed to boot, Windows\System32\winload.exe is corrupt or missing” error.

Basically the long and short of it was the start menu wasn’t working because the profile permission’s were messed up. There had been a virus on the machine and the UAC system file plus numberous other system files were messed up.

Disabling the UAC ended up being the only way I got the Vista start menu to work. I first did my usual array of top secret virus scans and removed 8 trojans. Next I had a feeling there was some hard drive corruption. I ran an intensive chkdsk scan I was able to fix the bad sectors on the hard drive. I also ran System File Checker scaner (sfc /scannow) and it died at about 86%. There is some mentions that you can check the logs and start manual copying files from the Vista DVD using a PE disk but felt that was just too much work for the price I was charging. Even then you are never garunteed that the machine will work 100%.

So if you are experiencing the Vista startmenu doesn’t work issue it is most likely due to hard drive corruption that happened after a virus had it’s way with your computer.

While sometimes this error can be seen because of bad ram or a hard drive that has some corrupt files, it typically means that there is some issues with the windows folder permission from a previous patch. It can also be caused by security suites like Norton 360 preventing Windows patches from executing propperly!

The trick is to rename the following folder:

C:\Windows\System32\LogFiles\WMI\RtBackup

The problem, however, is that because the permissions on this folder are wrong, you can’t rename it yourself without some additional help. You’ll need to download the Unlocker utility:

http://ccollomb.free.fr/unlocker/

1. Downloaded and installed unlocker
2. Right click on it, select properties > Compatibility tab > tick “Run as Administrator” and click OK.
3. Now, run Unlocker.
4. Go to the Windows Start menu. In the run box at the bottom of the menu, type in: C:\Windows\System32\LogFiles\WMI\ and press Enter.
5. Windows will now open the folder that contains the dodgy RtBackup folder. Right click on RtBackup, and select “unlocker”.
6. You will get a message reading:
7. “No locking handle found. However Unlocker can help you deal with this object. Choose the action you want to perform on this object.”
8. Select “rename” from the dropdown menu in Unlocker, and type a name for it (e.g. RtBackup.bak).
9. Click Ok.
10. You will now get an error message from Unlocker saying, “The object could not be renamed. Do you want to perform the requested rename operation at next reboot?” Click “Yes”.
11. Reboot Vista.
12. Unlocker will now rename the RtBackup folder as Windows starts up, and Windows will recreate the original RtBackup folder with correct permissions, which allows the Event Logger service to work

Now Vista SP1 might work but I am assuming you will still get the “An internal error occurred while installing the service pack. Error code: 0×80070490” error.

You will need to download the “Windows Readiness Tool” You can find it here:

http://support.microsoft.com/kb/947366

Download and install the version that you need. ie. 32bit or 64bit.

Once that installs (it will most likely take quite a while), Use Windows Update to keep installing the updates. Eventually you will get to Windows SP1. You should now find that it now installs just fine. You should no longer get the error:  An internal error occurred while installing the service pack. Error code: 0×80070490

Finish the rest of the updates.

1. Open up notepad from the start menu. In Windows Vista/Windows 7 you can easily find it by typing notepad in the search box.
2. Paste the info in the box into notepad and save it as “EXE-Fix.reg” on your desktop.
3. Double-Click the EXE-Fix.reg file. Your machine will ask if you want to import the registry info. Say yes.
4. It should say It was imported successfully and click “OK”.

Windows Registry Editor Version 5.00


[HKEY_CLASSES_ROOT\.exe]

@="exefile"

"Content Type"="application/x-msdownload"


[HKEY_CLASSES_ROOT\.exe\PersistentHandler]

@="{098f2470-bae0-11cd-b579-08002b30bfeb}"


[HKEY_CLASSES_ROOT\exefile]

@="Application"

"EditFlags"=hex:38,07,00,00

"TileInfo"="prop:FileDescription;Company;FileVersion"

"InfoTip"="prop:FileDescription;Company;FileVersion;Create;Size"


[HKEY_CLASSES_ROOT\exefile\DefaultIcon]

@="%1"


[HKEY_CLASSES_ROOT\exefile\shell]


[HKEY_CLASSES_ROOT\exefile\shell\open]

"EditFlags"=hex:00,00,00,00


[HKEY_CLASSES_ROOT\exefile\shell\open\command]

@="\"%1\" %*"


[HKEY_CLASSES_ROOT\exefile\shell\runas]


[HKEY_CLASSES_ROOT\exefile\shell\runas\command]

@="\"%1\" %*"


[HKEY_CLASSES_ROOT\exefile\shellex]


[HKEY_CLASSES_ROOT\exefile\shellex\DropHandler]

@="{86C86720-42A0-1069-A2E8-08002B30309D}"


[HKEY_CLASSES_ROOT\exefile\shellex\PropertySheetHandlers]


[HKEY_CLASSES_ROOT\exefile\shellex\PropertySheetHandlers\PEAnalyser]

@="{09A63660-16F9-11d0-B1DF-004F56001CA7}"


[HKEY_CLASSES_ROOT\exefile\shellex\PropertySheetHandlers\PifProps]

@="{86F19A00-42A0-1069-A2E9-08002B30309D}"


[HKEY_CLASSES_ROOT\exefile\shellex\PropertySheetHandlers\ShimLayer Property Page]

@="{513D916F-2A8E-4F51-AEAB-0CBC76FB1AF8}"


[HKEY_CLASSES_ROOT\regfile]

@="Registration Entries"

"EditFlags"=dword:00100000

"BrowserFlags"=dword:00000008


[HKEY_CLASSES_ROOT\regfile\DefaultIcon]

@=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,\

00,5c,00,72,00,65,00,67,00,65,00,64,00,69,00,74,00,2e,00,65,00,78,00,65,00,\

2c,00,31,00,00,00


[HKEY_CLASSES_ROOT\regfile\shell]

@="open"


[HKEY_CLASSES_ROOT\regfile\shell\edit]


[HKEY_CLASSES_ROOT\regfile\shell\edit\command]

@=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,\

00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,4e,00,4f,00,\

54,00,45,00,50,00,41,00,44,00,2e,00,45,00,58,00,45,00,20,00,25,00,31,00,00,\

00


[HKEY_CLASSES_ROOT\regfile\shell\open]

@="Mer&ge"


[HKEY_CLASSES_ROOT\regfile\shell\open\command]

@="regedit.exe \"%1\""


[HKEY_CLASSES_ROOT\regfile\shell\print]


[HKEY_CLASSES_ROOT\regfile\shell\print\command]

@=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,\

00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,4e,00,4f,00,\

54,00,45,00,50,00,41,00,44,00,2e,00,45,00,58,00,45,00,20,00,2f,00,70,00,20,\

00,25,00,31,00,00,00


[HKEY_CLASSES_ROOT\.lnk]

@="lnkfile"


[HKEY_CLASSES_ROOT\.lnk\ShellEx]


[HKEY_CLASSES_ROOT\.lnk\ShellEx\{000214EE-0000-0000-C000-000000000046}]

@="{00021401-0000-0000-C000-000000000046}"


[HKEY_CLASSES_ROOT\.lnk\ShellEx\{000214F9-0000-0000-C000-000000000046}]

@="{00021401-0000-0000-C000-000000000046}"


[HKEY_CLASSES_ROOT\.lnk\ShellEx\{00021500-0000-0000-C000-000000000046}]

@="{00021401-0000-0000-C000-000000000046}"


[HKEY_CLASSES_ROOT\.lnk\ShellEx\{BB2E617C-0920-11d1-9A0B-00C04FC2D6C1}]

@="{00021401-0000-0000-C000-000000000046}"


[HKEY_CLASSES_ROOT\.lnk\ShellNew]

"Command"="rundll32.exe appwiz.cpl,NewLinkHere %1"


[HKEY_CLASSES_ROOT\lnkfile]

@="Shortcut"

"EditFlags"=dword:00000001

"IsShortcut"=""

"NeverShowExt"=""


[HKEY_CLASSES_ROOT\lnkfile\CLSID]

@="{00021401-0000-0000-C000-000000000046}"


[HKEY_CLASSES_ROOT\lnkfile\shellex]


[HKEY_CLASSES_ROOT\lnkfile\shellex\ContextMenuHandlers]


[HKEY_CLASSES_ROOT\lnkfile\shellex\ContextMenuHandlers\Offline Files]

@="{750fdf0e-2a26-11d1-a3ea-080036587f03}"


[HKEY_CLASSES_ROOT\lnkfile\shellex\ContextMenuHandlers\{00021401-0000-0000-C000-000000000046}]


[HKEY_CLASSES_ROOT\lnkfile\shellex\DropHandler]

@="{00021401-0000-0000-C000-000000000046}"


[HKEY_CLASSES_ROOT\lnkfile\shellex\IconHandler]

@="{00021401-0000-0000-C000-000000000046}"


[HKEY_CLASSES_ROOT\lnkfile\shellex\PropertySheetHandlers]


[HKEY_CLASSES_ROOT\lnkfile\shellex\PropertySheetHandlers\ShimLayer Property Page]

@="{513D916F-2A8E-4F51-AEAB-0CBC76FB1AF8}"


[HKEY_CLASSES_ROOT\CLSID\{00021401-0000-0000-C000-000000000046}]

@="Shortcut"


[HKEY_CLASSES_ROOT\CLSID\{00021401-0000-0000-C000-000000000046}\InProcServer32]

@="shell32.dll"

"ThreadingModel"="Apartment"


[HKEY_CLASSES_ROOT\CLSID\{00021401-0000-0000-C000-000000000046}\PersistentAddinsRegistered]


[HKEY_CLASSES_ROOT\CLSID\{00021401-0000-0000-C000-000000000046}\PersistentAddinsRegistered\{89BCB740-6119-101A-BCB7-00DD010655AF}]

@="{00021401-0000-0000-C000-000000000046}"


[HKEY_CLASSES_ROOT\CLSID\{00021401-0000-0000-C000-000000000046}\PersistentHandler]

@="{00021401-0000-0000-C000-000000000046}"


[HKEY_CLASSES_ROOT\CLSID\{00021401-0000-0000-C000-000000000046}\ProgID]

@="lnkfile"


[HKEY_CLASSES_ROOT\CLSID\{00021401-0000-0000-C000-000000000046}\shellex]


[HKEY_CLASSES_ROOT\CLSID\{00021401-0000-0000-C000-000000000046}\shellex\MayChangeDefaultMenu] 

Screenshot of the error: “This file does not have a program associated with it for performing this action”.

This issue is something I’ve only seen when a program or virus managed to corrupt the .exe association in registry causing the user unable to run any programs.

If you have solved this issue on XP the items a bit different on Vista and Windows 7. It turns out to be a corrupted .exe association and the reason those steps I taken didn’t work is because the Windows Vista registry location for exe association is different from XP. Obviously using the XP fix cannot work on Vista!

When you have a corrupted exe association, you definitely cannot use any registry editor to fix it because it is impossible to run it in the first place. So here are a few methods you can try:

1. Open the command prompt. Make sure to run it as “Administrator”. Run command prompt and type assoc.exe=exefile (If you get access denied error, try step 2). If you want to run a file as administrator right click a shortcut to the program and select “Run as Administrator”. This will normally fix the corrupt exe

2. Download this file called “Vista-7-fixexe.txt and rename it to “Vista-7-fixexe.reg”. Some security software will not let you download registry files. If you open the file it’s contents should look like this:

3. Open command prompt and type the following command REG IMPORT vista-7-fixexe.reg. Make sure you’ve already CD to the directory where the .reg file is. (If you have problems getting this to work, try step 4)

4. Download the compiled version of the registry file above and run it.

5. Microsoft Fix It has an automated way to fixing the exe association problem. Simply download this MicrosoftFixit50194.msi file and run it.

If done correctly, it should fix the problem instantly and no reboot is required.

The link to download the program to open those file can be found below.

Windows Help program (WinHlp32.exe)

Another example would be software coded in .NET. Most of the .NET coded software seems to be portable because it doesn’t require installation but since .NET Framework doesn’t come pre-installed in Windows XP, we can’t say that it’s portable. Perhaps when Windows Vista or 7 has totally replaced XP, then we can call software coded in .NET portable.

Last week I tried to run Remove Restriction Tool on one of a customer’s computer that has been infected by a computer virus but it gave an error. I couldn’t figure out what was wrong but I can only suspect that maybe one of the DLL files that was required to run RRT has corrupted but I didn’t know which one. Many years ago I had a tool that was able to check what DLL or OCX files is needed to run the executable file but I’ve lost it since I didn’t have a blog at that time to record it down. I searched around and found a similar tool called Dependency Walker.

Dependency Walker is a free utility that scans any 32-bit or 64-bit Windows module (exe, dll, ocx, sys, etc.) and builds a hierarchical tree diagram of all dependent modules. For each module found, it lists all the functions that are exported by that module, and which of those functions are actually being called by other modules. Another view displays the minimum set of required files, along with detailed information about each file including a full path to the file, base address, version numbers, machine type, debug information, and more.

All you need to do is run depends.exe and then load an executable (EXE) file that you want to check what file is required to run it. Within a few seconds Dependency Walker will show you the required files. As you can see on the image above, I loaded RRT.exe (Remove Restriction Tool) unto Dependency Walker and it shows me that KERNEL32.DLL and MSVBVM60.DLL is required. Every Windows has kernel32.dll file so we don’t need to worry on the availability of that file. As for msvbvm60.dll, I can place a working copy of that DLL file at the same folder as where the RRT.exe is and it will automatically load the DLL file if it can’t find one in system32 folder.

Service Pack Cleanup Tool In Vista SP2 To Clean up Old RTM & SP1 Backup Files

The recently released Windows Vista SP2 has shown significant enhancement and improvement in terms of compatibility, reliability, performance, and speed compared to the earlier SP1. If users had noticed, after installing the Vista SP2, the hard disk’s space had been taken up substantially. This was mainly because a lot of old Vista RTM and SP1 backup files and components were not deleted upon the installation of new SP2.

To housekeep your hard disk and clean up those old and unused SP1 backup files, users probably can try the new Service Pack Cleanup Tool which is also named as compcln.exe. This successor for SP1 cleanup tool, Vsp1cln.exe, can easily remove all the system files (RTM & SP1) inherited from the older versions but replaced by Vista SP2.

Running this compeln.exe tool is pretty simple:

1. Click Start>All Programs>Accessories>Command Prompt or click Start>Run and type cmd to open Command Prompt Windows
2. Execute the command “Compcln.exe”. The path is “c:\Windows\System32 \compcln.exe”.
3. Users will be prompted a question whether to keep Vista SP2 permanently in the system.
4. Once users type “Y” and press enter, the system will start performing the windows components clean

After the cleansing process, users will notice the free hard disk space has increased substantially.

Depending on your background, you may find different sections of the newly published Microsoft Security Intelligence Report (SIR) to be of more interest.  In today’s post, we would like to highlight the section on infection rates based on the operating system (OS) version and the service pack level.  Microsoft has consistently observed that machines with newer OS and with more recent service packs are less likely to be infected by malware.  The graph below shows the number of computers having malware removed per 1,000 executions of the MSRT on that OS/SP during the second half of 2008 (2H08).

In the SIR, you will find the the following conclusions based on this data:

• The infection rate for Windows Vista is significantly lower than that of its predecessor, Windows XP, in all configurations.
• Comparing the latest service packs for each version, the infection rate of Windows Vista SP1 is 60.6 percent less than that of Windows XP SP3.
• Comparing the RTM versions of these operating systems, the infection rate of the RTM version of Windows Vista is 89.1 percent less than that of the RTM version of Windows XP.
• The infection rate of Windows Server 2008 RTM is 52.6 percent less than that of its predecessor, Windows Server 2003 SP2.
• The higher the service pack level, the lower the rate of infection. This trend can be observed consistently across client and server operating systems.

There are two reasons for this:

1. Service packs include all previously released security updates. They can also include additional security features, mitigations, or changes to default settings to protect users.
2. Users who install service packs generally maintain their computers better than users who do not install service packs and may also be more cautious in the way they browse the Internet, open attachments, and engage in other activities that can open computers to attack.

Server versions of Windows typically display a lower infection rate on average than client versions. Servers tend to have a lower effective attack surface than computers running client operating systems as they are more likely to be used under controlled conditions by trained administrators and to be protected by one or more layers of security. In particular, Windows Server 2003 its successors are hardened against attack in a number of ways, reflecting this difference in usage.

Continue http://blogs.technet.com/mmpc/archive/2009/04/21/malware-distribution-across-operating-systems.aspx