Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Got a call from my dad that his computer is trying to uninstall XP. Established RDC and this is what is appearing when the system boots to desktop:

enter image description here

The full text is "Setup cannot uninstall windows XP because the necessary registration information is missing". After clicking OK nothing happens, and he can use the computer as usual. It comes up every time he reboots or starts the system.

He says he did not try to uninstall XP, and we're not sure where this message originated. We do not want to uninstall XP. If this is a legit notification, how would I halt the attempted uninstall process?

share|improve this question
add comment

2 Answers 2

Look in the startup items to see if there's anything funky. Remove any items that aren't necessary and reboot. Start > Run > msconfig.exe > Startup

share|improve this answer
add comment

According to this article at Microsoft Support, there is a program that can be run to uninstall XP. It is unlikely that your father intended to run it... in fact, it is unlikely that he ran it at all. More than likely it was run by some other process or program; an infection of some sort most likely.

At any rate, MDMarra's advice is sound. See if...

c:\windows\system32\osuninst.exe

... is present in the Startup section of MSConfig. You can go one step further by searching for just osuninst.exe in the registry (start-run-regedit) and removing it from any key that is involved with being run at startup. There are 4, and it might be within any of them.

  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce

I'll keep digging, but there doesn't appear to be a specific/malicious infection out in the wild that runs this. That doesn't mean there isn't one.

share|improve this answer
    
SysInternals/MS' AutoRuns should help as well in tracking down the entry if it's not to be found in the obvious locations. –  Karan Apr 8 '13 at 14:55
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.