Today, I was removing malware and spyware bits from a Windows XP Professional machine. When the infected machine was cleaned, I checked the machine for updates using our in-house WSUS server. I noticed two things which were the Automatic Update notification icon was not appearing and the Security Center notification icon was not functioning at all…no notification icons appearing in the Notification Tray.
The Windows XP Automatic Update notification icon appears when updates are ready to be downloaded and / or updates are ready to be installed. The Windows XP Security Center notification icon appears when the firewall is disabled. no antivirus product is installed or definitions out of date, or Automatic Updates are set to Off.
|
|
|
Automatic Update and Security Center Notification Icons
|
I checked if the Security Center service was running using the following commands:
sc query wscsvc
sc qc wscsvc
The Security Center service was started and the startup type was set to Automatic. I also checked if the Security Center Alert Settings were disabled. The Security Center Alert Settings were not disabled, refer to Image below.
|
|
|
Security Center Alert Settings
|
I started to think the WMI repository were somehow not consistent or corrupted, so I rebuilt the WMI repository using this blog article "Security Center not Accurately Reporting Anti-Virus / Firewall Status for Windows XP" and the notification icons still were not appearing.
I checked if the Customize Notification icons were set to Always Hide for the Automatic Update and Security Center notification icons. The notification icons were not in the Customize Notification icons list, refer to image below.
In was a little bit puzzled after I check for any Group Policies that may have been enabled by the malware and spyware to enforce some machine or personal settings and I could not detect any issues with Group Policy settings.
I open the "WindowsUpdate.log" and found some interesting clues which were:
2008-03-25 12:29:55:578 848 634 Service WARNING: GetUserTokenFromSessionId failed with error 800704dd for session 0
2008-03-25 12:29:55:578 848 634 AU WARNING: AU found no suitable session to launch client in
I did some searching and found this knowledge base article, "Error messages that you may receive when you try to download and install updates from the Windows Update Web site, from the Microsoft Update Web site, or from a WSUS server: "0x800704DD," "0x80240020," or both". I check the registry and found the following subkey missing:
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn
I re-created the missing registry subkey and its entries. Rebooted the computer and the Security Center and Automatic Update notification icons appeared.
NOTE
To enlarge the images, simply click on the images you would like to view. With Internet Explorer 7, you can right-click on the image to select Open in New Tab.
Manual Steps to Repair / Re-created the ‘SensLogn’ Registry Subkey for Windows XP
- Click Start and then Run.
- Type regedit.exe in the Run dialog box.
- Press ENTER on your keyboard.
- Navigate to:HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify
- Right-click Notify to select New > Key.
- Name the new key SensLogn.
- Right-click SensLogn to select New > DWORD Value.
- Name the new DWORD Asynchronous.
- Double click Asynchronous to assign a value data of 1.
- Right-click SensLogn to select New > String Value.
- Name the new String Disconnect.
- Double click Disconnect to assign a value data of SensDisconnectEvent.
- Right-click SensLogn to select New > String Value.
- Name the new String DLLName.
- Double click DLLName to assign a value data of WlNotify.dll.
- Right-click SensLogn to select New > DWORD Value.
- Name the new DWORD Impersonate.
- Double click Impersonate to assign a value data of 1.
- Right-click SensLogn to select New > String Value.
- Name the new String Lock.
- Double click Lock to assign a value data of SensLockEvent.
- Right-click SensLogn to select New > String Value.
- Name the new String Logoff.
- Double click Logoff to assign a value data of SensLogoffEvent.
- Right-click SensLogn to select New > String Value.
- Name the new String Logon.
- Double click Logon to assign a value data of SensLogonEvent.
- Right-click SensLogn to select New > DWORD Value.
- Name the new DWORD MaxWait.
- Double click MaxWait to assign a value data of 1.
- Right-click SensLogn to select New > String Value.
- Name the new String PostShell.
- Double click PostShell to assign a value data of SensPostShellEvent.
- Right-click SensLogn to select New > String Value.
- Name the new String Reconnect.
- Double click Reconnect to assign a value data of SensReconnectEvent.
- Right-click SensLogn to select New > DWORD Value.
- Name the new DWORD Safe.
- Double click Safe to assign a value data of 1.
- Right-click SensLogn to select New > String Value.
- Name the new String Shutdown.
- Double click Shutdown to assign a value data of SensShutdownEvent.
- Right-click SensLogn to select New > String Value.
- Name the new String StartScreenSaver.
- Double click StartScreenSaver to assign a value data of SensStartScreenSaverEvent.
- Right-click SensLogn to select New > String Value.
- Name the new String StartShell.
- Double click StartShell to assign a value data of SensStartShellEvent.
- Right-click SensLogn to select New > String Value.
- Name the new String Startup.
- Double click Startup to assign a value data of SensStartupEvent.
- Right-click SensLogn to select New > String Value.
- Name the new String StopScreenSaver.
- Double click StopScreenSaver to assign a value data of SensStopScreenSaverEvent.
- Right-click SensLogn to select New > String Value.
- Name the new String Unlock.
- Double click Unlock to assign a value data of SensUnlockEvent.
- Exit the Windows XP Registry Editor.
- Reboot Windows XP.
Automated Fix to Repair / Re-created the ‘SensLogn’ Registry Subkey for Windows XP
- Download to senslogn.reg a folder on your hard drive.
- Right-click sendlogn.reg to select Merge.
- Now the registration entries are added for you.
- Reboot Windows XP.
NOTES
The sendlogn.reg file is from my web server (http://lprf.homeserver.com). You also can view the contents of the sendlogn.reg file by right-clicking the file and selecting Edit. You may need to log off then log on to your user account or restart your computer for the changes to take affect.
Platforms Tested
- Microsoft Windows XP Professional SP2
- Microsoft Windows XP Home SP2
Related Articles
Version 1.2
Edited: May 11, 2012
BillJr's Space 
Recent Comments