problems with users in control panel + windows activation

had a computer here that was a real mess with spyware, got it all cleaned up as far as i can tell (microsoft anti spyware, spybot, adaware), have checked LSPs, done a few registry scans (microsofts scanner, easy cleaner). Done a repair install over the top of what ive got (XP home SP2), and got the same problems.

Initial problem reported was nusrmgr.cpl (users in control panel) would load for a second and disappear. after doing a repair install, the problem is still here, and the windows product activation will never load onto the screen.

Running out of options, and a format and reload is a last resort that i dont want to have to rely on..

Any thoughts would be appreciated, i can post logs or screenshots of whatever you want to see.

Also would like to add, same thing happens in safe mode.

Thanks

 

A repair install isn't going to make malware problems go away.

You want the Spyware Specific Forum.

Before posting there read the following thread:

READ ME FIRST BEFORE ASKING FOR SUPPORT: Basic Spyware, Trojan And Virus Removal

Also read this about HJT logs:

NO HIJACK THIS LOG FILES BEFORE READING THIS: HJT Tutorial & LOG File Posting

The guys over there are very good at getting rid of malware issues.

 

hijackthis log is 100% clean, it COULD be malware, but it seems more of a general problem with windows.

i do this stuff for a living and could get rid of most malware with my eyes closed..

thanks anyways

 

Give this a shot.

1. Go to Start>Run, type in "msconfig" (without the quotes), click OK.
2. On the General tab, click the "Expand File" button.
3. The "File to restore" is nusrmgr.cpl
4. "Restore From" either your Windows XP CD or the I386 folder on the harddrive (if it's there); either type in the path or use the "Browse To..." button
5. "Save file in" C:\Windows\System32 - either type in the path or use the "Browse To..." button
6. Click the expand button

 

ive pulled good nusrmgr.cpl from other machines, no go, have also restored from cd same result. i dont think its a problem directly with the .cpl file, it has to be something in windows both users in control panel and windows product activation depends on...

thanks

 

Does it work in Safe Mode?

 

from original post

"Also would like to add, same thing happens in safe mode."

thanks

 

Oops.

Do you have any trouble with anything else opening up, then promptly closing?

Regedit, msconfig, taskmgr, for example?

Do you ACTUALLY see the window, or just an hourglass?


Does control userpasswords2 work?

 

Ok, try this

Open Regedit and go to:
[HKEY_CURRENT_USER\Control Panel\]

Look for a key named Don't Load

Delete it.

Then reboot.

 

Adrynalyne --

nothing that i have noticed, the ones you mentioned all work fine

thanks again

 

I editted my post

A couple more questions.

 

Shadow_Puter_Dude --

key was there, deleted it, rebooted

problem still exists

 

Adrynalyne --

control userpasswords does same thing as control panel
control userpasswords2 does work, i find it a bit odd

as far as the users in control panel, you do see the window for a split second, but on windows product activation, just an hourglass and some more processes in the taskmanager (mshta.exe and maybe a couple more)

 

This XP Pro?

If it is, then run from a cmd prompt:

tasklist >c:\tasks.txt and then post a list if you don't mind.

 

quote from first msg

"Done a repair install over the top of what ive got (XP home SP2), and got the same problems."

XP Home

 

I'm a little rusty on this stuff, but have you tried, start, run,

regsvr32 nusrmgr.cpl

 

Stop that!






I just woke up, sorry

 

regsvr32 nusrmgr.cpl

no help :|

 

...

regsvr32 jscript.dll?

I'm starting to miss my old technical resources

 

Also, if you could, just give a screenshot of your running proccesses in taskmgr, if its not too much trouble.

 

regsvr32 jscript.dll no help on that one..

yea i will create a screenshot and drop it on one of my webservers.
here is the link --

http://obliviated.org/task.jpg

dont let the CPU usage spike fool you, this was during a fresh boot and still going thru init

http://obliviated.org/task2.jpg

there is one after it settled down

 

Somewhat off the beaten track here, but after reregistering jscript.dll, did that make any difference with WPA?

 

nope, after i try product activation i have a rogue process of msoobe.exe just hanging in the task manager, doing nothing...

http://obliviated.org/task3.jpg

 

And no other control panel items do this, correct?

Can I assume other user accounts do this as well?

 

ok i went ahead and checked everything out, seems everything works but one other thing not associated with windows, Sofftex Omni Pass. Also noticed there were 2 icons in control panel for network connections...

everything else appears fine

There is only 1 account on the computer, plus the administrator. login as admin in safe mode produces the same results, so i assume its system-wide

 

Is Security Accounts Manager service started?

 

> Is Security Accounts Manager service started?

yup

 

http://labmice.techtarget.com/windowsxp/articles/changeID.htm
Does that have anything?

 

doesnt look like it... ;(

 

Try
run>sfc /scannow

 

> Try run>sfc /scannow

been there done that, im not sure ive ever even seen this do any good before..

 

Have you tried replacing mshta.exe?

 

nah but i will give it a shot now, computer is booted in Windows PE... so i will copy it over and see what happens...


copied the file over no change!

 

What else did you do after the repair install?

 

nothing too serious, just poked around with software, looked thru the registry, trying to find something inconsistant or out of place.

It seems like it may be a problem nested somewhere in the registry, but i have NO good restore points in the system volume information folder (even in the old install ids, seems maybe they disabled system restore)

bangin my head

 

Try replacing csrss.exe?

 

i'll give it a shot, but honestly, all of these files were installed fresh during the repair install of windows...

 

copied over and same results..

 

regsvr32 licdll.dll

 

no help on that one either

 

WPA.DBL
Is there any such file in system32?

 

yes its there, although about 1/2 the size as the one on my working machine...

 

It should be smaller before activation,no chance there.If you have an old wpa.dbl from the same machine it might not ask for activation.But you are better off reformating.

 

I hear ya there...

 

now thats not a good answer ;(

i dont like to give up that easy

 

I have some old co-workers who do tech support for MS looking at this as well.

I do agree its registry related, not file related. I haven't given up, I am still looking into it.

 

Anything of any significance showing up in event viewer under system?

 

thats just it, NOTHING shows up there (well, nothing related to this and nothing bad) all looks well...

 

If all your files are ok,your solution will be to delete something that was created before the repair install but interferes with the new install.It can be in th registry also.

 

problem is its not my machine, so god only knows what could have caused this or how long its been going on.. the joys of being a technician