<?xml version="1.0" encoding="UTF-8"?>
<feed xmlns="http://www.w3.org/2005/Atom" 
      xmlns:thr="http://purl.org/syndication/thread/1.0">
  <link rel="alternate" type="text/html" href="http://blog.tmcnet.com/blog/tom-keating/microsoft/windows-7-ultimate-upgrade-to-windows-8-problem-solved.asp" />
  <link rel="self" type="application/atom+xml" href="http://blog.tmcnet.com/blog/tom-keating/atom.xml" />
  <id>tag:blog.tmcnet.com,2013:/blog/tom-keating//4/tag:blog.tmcnet.com,2012:/blog/tom-keating//4.49946-</id>
  <updated></updated>
  <title>Comments for Windows 7 Ultimate Upgrade to Windows 8 Problem Solved!</title>
  <subtitle>VoIP &amp; Gadgets blog - Latest news in VoIP &amp; gadgets, wireless, mobile phones, reviews, &amp; opinions</subtitle>
  <generator uri="http://www.sixapart.com/movabletype/">Movable Type 4.38</generator>
  <entry>
    <id>tag:blog.tmcnet.com,2012:/blog/tom-keating//4.49946</id>
    <link rel="alternate" type="text/html" href="http://blog.tmcnet.com/blog/tom-keating/microsoft/windows-7-ultimate-upgrade-to-windows-8-problem-solved.asp" />
    <link rel="service.edit" type="application/atom+xml" href="http://blog.tmcnet.com/mt/mt-atom.cgi/weblog/blog_id=4/entry_id=49946" title="Windows 7 Ultimate Upgrade to Windows 8 Problem Solved!" />
    <published>2012-09-20T14:58:21Z</published>
    <updated>2012-09-20T15:00:06Z</updated>
    <title>Windows 7 Ultimate Upgrade to Windows 8 Problem Solved!</title>
    <summary>I decided to upgrade my Windows 7 Ultimate laptop to Windows 8 Pro. I wanted an in-place upgrade keeping all my apps and settings. Yeah, no judgement here for not doing a clean install! No time.Anyway, the options available to...</summary>
    <author>
      <name>Tom Keating</name>
      <uri>http://blog.tmcnet.com/blog/tom-keating/</uri>
    </author>
    
    <category term="Microsoft" />
    
    <category term="TMCnet" />
    
    <content type="html" xml:lang="en" xml:base="http://blog.tmcnet.com/blog/tom-keating/">
      <![CDATA[I decided to upgrade my Windows 7 Ultimate laptop to Windows 8 Pro. I wanted an in-place upgrade keeping all my apps and settings. Yeah, no judgement here for not doing a clean install! No time.<br /><br />Anyway, the options available to me were 'Keep personal files only' and 'Nothing'. There is supposed to be an option 'Keep Windows settings, personal files and applications' but it was missing. I'm supposed to see this:<br /><a href="http://blog.tmcnet.com/blog/tom-keating/images/windows-8-keep-windows-settings-personal-files-apps-nothing.jpg"><img src="http://blog.tmcnet.com/blog/tom-keating/assets_c/2012/09/windows-8-keep-windows-settings-personal-files-apps-nothing-thumb-500x380-11755.jpg" alt="windows-8-keep-windows-settings-personal-files-apps-nothing.jpg" width="500" height="380" /></a><br />But the top option in the graphic ('Keep Windows settings, personal files and applications') was missing. Damn it, I really don't have time for a clean install. <img title="cry_smile" src="http://blog.tmcnet.com/mt-static/plugins/TinyMCE/lib/jscripts/tiny_mce/plugins/emotions/img/cry_smile.gif" border="0" alt="cry_smile" /> I decided to do some digging and found that the Windows 8 installer does some logging. <br /><br />One important install log is: C:\$WINDOWS.~BT\Sources\Panther\setupact.log
<p>In this file I saw these interesting 3 lines:</p>
<p><span style="font-family: courier new,courier;">2012-09-18 16:49:17, Info&nbsp; DetectedEdition&nbsp;&nbsp; = <strong>Ultimate</strong></span><br /><span style="font-family: courier new,courier;">2012-09-18 16:49:17, Info&nbsp; DetectedArch&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; = x86</span><br /><span style="font-family: courier new,courier;">2012-09-18 16:49:17, Info&nbsp; DetectedVersion&nbsp;&nbsp; = <strong>6.0.6000.0</strong></span></p>
<p>The Ultimate above is good since it's Windows 7 Ultimate, but the detected <a href="http://en.wikipedia.org/wiki/List_of_Microsoft_Windows_versions">version 6.0.6000.0 correlates to Windows Vista Enterprise</a> not Windows 7! What sort of evil witchcraft is this? This laptop has never run Vista and I resent Microsoft accusing me of such. <img title="angry_smile" src="http://blog.tmcnet.com/mt-static/plugins/TinyMCE/lib/jscripts/tiny_mce/plugins/emotions/img/angry_smile.gif" border="0" alt="angry_smile" /></p>
<p>Virus or trojan perhaps?</p>
<p>I dug deeper into the log and just after "Install choices after being filtered by compatibility scan" in the log I saw this:</p>
<p><span style="font-family: courier new,courier;">CONX&nbsp;&nbsp; Install choices defined by Install Matrix are: <strong>CleanInstall | DataOnly</strong></span></p>
<p>Yep, indeed it's saying only CleanInstall ('Nothing') or Data Only ('Keep personal files'). Well that sucks.&nbsp;</p>
<p>Another line also points to Vista:<br /><span style="font-family: courier new,courier;">2012-09-18 16:49:17, Info&nbsp;&nbsp;&nbsp; CONX&nbsp;&nbsp; <strong>Host OS version: 6.0.6000.1130&nbsp;</strong> (0.0) Platform 0x2, SuiteMask 0x100, ProdType 0x1</span></p>
<p>Time to get to the bottom of this. I launched Firefox and did a Google search on this issue. I clicked the result and the browser was redirected to gethotresults.com domain and avast! anti-virus gave me a red popup window telling me it blocked a virus. Sweet mother of... What now? Can't upgrade to Windows 8 and <em>now my laptop has a virus?</em> <img title="Computers_comp26" src="http://blog.tmcnet.com/mt-static/plugins/TinyMCE/lib/jscripts/tiny_mce/plugins/emotions/img/Computers_comp26.gif" border="0" alt="Computers_comp26" />Browser hijacking of Google search results to other domains <a href="https://www.google.com/search?hl=en&q=google+redirect+gethotresults.com">including gethotresults.com</a> is pretty common, but I never get infected, so now I was pretty annoyed. I suspect a Java exploit -- that or I'm blaming my kids or wife who often borrow my laptop.</p>
<p>I ran a full avast! anti-virus scan, <a href="http://www.bleepingcomputer.com/combofix/how-to-use-combofix">ComboFix</a>, <a href="http://www.malwarebytes.org">Malwarebytes</a>, <a href="support.kaspersky.com/faq/?qid=208283363">TDSSKiller</a>, and a few other malware utilities. It did fine one virus which was removed. <em>But how would a virus make the Windows 8 installer think I'm running Windows Vista? </em>I know the Registry contains a key showing what operating system is running.</p>
<p>I checked it and here's the key:<br /><span style="font-family: courier new,courier;">[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion]</span><br /><span style="font-family: courier new,courier;"><strong>"CurrentVersion"="6.1"</strong></span><br /><span style="font-family: courier new,courier;"><strong>"CurrentBuild"="7601"</strong></span><br /><span style="font-family: courier new,courier;">"SoftwareType"="System"</span><br /><span style="font-family: courier new,courier;">"CurrentType"="Multiprocessor Free"</span><br /><span style="font-family: courier new,courier;">"InstallDate"=dword:4c166d0f</span><br /><span style="font-family: courier new,courier;">"SystemRoot"="C:\\Windows"</span><br /><span style="font-family: courier new,courier;">"InstallationType"="Client"</span><br /><span style="font-family: courier new,courier;">"EditionID"="Ultimate"</span><br /><span style="font-family: courier new,courier;"><strong>"ProductName"="Windows 7 Ultimate"</strong></span><br /><span style="font-family: courier new,courier;">"ProductId"="00426-066-*******-*****" </span><br /><span style="font-family: courier new,courier;">"CurrentBuildNumber"="7601"</span><br /><span style="font-family: courier new,courier;"><strong>"BuildLab"="7601.win7sp1_gdr.120330-1504"</strong></span><br /><span style="font-family: courier new,courier;"><strong>"BuildLabEx"="7601.17803.x86fre.win7sp1_gdr.120330-1504"</strong></span><br /><span style="font-family: courier new,courier;">"BuildGUID"="e710007a-190f-4183-96a0-89e83150dbe2"</span><br /><span style="font-family: courier new,courier;">"CSDBuildNumber"="1130"</span><br /><span style="font-family: courier new,courier;">"PathName"="C:\\Windows"</span><br /><span style="font-family: courier new,courier;">"RegisteredOrganization"=""</span><br /><span style="font-family: courier new,courier;">"RegisteredOwner"="tkeating"</span><br /><span style="font-family: courier new,courier;">"CSDVersion"="Service Pack 1"</span></p>
<p>All of the bolded parts correctly identify the operating system as   Windows 7 Ultimate and not Vista. 6.1 (Windows 7) vs. 6.0 (Vista) for   instance. I searched the Registry for '6.0.6000' but nothing was   returned. Come to find out from a Microsoft employee that the Windows 8   installer doesn't use the Registry but rather it uses the <a href="http://msdn.microsoft.com/en-us/library/windows/desktop/ms724451(v=vs.85).aspx">GetVersionEx </a>API,   which can act rather funky. I was also told GetVersionEx doesn't pull   from the Registry, but from a non-modifiable system file. Yeah, well   somehow the virus modified this file!</p>]]>
      <![CDATA[<p>After a couple hours of using various scanning utilities and the  Windows 8 installer still refused to allow an in-place upgrade I thought  I'd give System Restore a shot since that has a backup of the Registry  and critical operating system files. I restored back to the oldest  restore snapshot - May 5 2012, ironically "Cinco de Mayo", a day of  celebration. Well, after the restore was complete I launched the Windows  8 installer and success! The option 'Keep Windows settings, personal  files and applications appeared! Time to celebrate indeed - I might have  to have some Mexican food for lunch. <img title="smiley-tongue-out" src="http://blog.tmcnet.com/mt-static/plugins/TinyMCE/lib/jscripts/tiny_mce/plugins/emotions/img/smiley-tongue-out.gif" border="0" alt="smiley-tongue-out" /> System Restore FTW!</p>]]>
    </content>
  </entry>

</feed>
