I think I found what ails my PC. I found a blank entry in Winlogon\GPExtensions list. And from the online research the entry that's blank has the GUID that should run the Administrative Templates that start the user services and group policies via userenv.dll
I'm running Windows Vista Home Premium 32bit. Could someone running the same version please extract the contents of that key for me and post the results so that I can populate the key?
The GUID I'm needing is: 35378EAC-683F-11D2-A89A-00C04FBBCFA2 (that's the only blank one)
The full location is HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\Winlogon\GPExtensions\
By the way, I've checked a couple of old backup's made by JRT back in April and May of this year and the value of that key was blank way back then. I remember I needed to get jiggy with some nasty malware around that time. Life's lessons are tedious at best.
=====edit01======
I've been searching for an online reg file solution the past few hours and the thought occurred that others are having similar errors and that this is more than likely caused by malware of some sort. In almost every case that I've come across, services in the GPExtensions stack have not been deleted but more often all of the subfolders/attributes have been deleted.
I'm not sure if the Windows Repair tool checks this 'Run Once at StartUp' command list for blanked out or invalid entries because this is a clever way of killing a bunch of security services while leaving other services running that the malware needs. It's actually quite silly that Windows has no built in fall-back procedure if one of it's key systems isn't where it's supposed to be. A cascade of errors can be caused by one blanked out registry entry. In the old DOS world, if you wanted to mess with the operating system at the level we're talking about, you'd have to mess with assembler or compiled code. Gates has given us a system full of back doors and loop holes. By exposing the registry, Windows makes all of us vulnerable to having our high-speed internet connections used by nefarious nerds of various ages. Now I ask you, how much code would it take to ensure such key systems are running and available?
While I'm asking questions that I don't expect answers to, I was looking at the logs and noticed one system (MCIupdate) that was running twice a minute, with the obligatory log entry each time. The spooler service is sending one error a second to a log file. It's pointing at a registry address that does not exist. I found the only existence of that particular location in an xml file. I renamed it to *.old, only to have it appear again a few seconds later. Now that's good management of resources. It's absolutely no wonder that svchost is eating up such a huge volume of cpu clicks. With the help of Process Explorer, I've had more of a look at the innards of Windows Vista than I really wanted, but the closer I look, the quicker I want to dump it.
