{"id":130562,"date":"2023-03-02T01:33:01","date_gmt":"2023-03-01T23:33:01","guid":{"rendered":"https:\/\/www.moh.gov.ps\/portal\/?p=130562"},"modified":"2023-03-17T11:08:20","modified_gmt":"2023-03-17T09:08:20","slug":"how-to-fix-windows-10-11-stuck-on-welcome-screen","status":"publish","type":"post","link":"https:\/\/www.moh.gov.ps\/portal\/how-to-fix-windows-10-11-stuck-on-welcome-screen\/","title":{"rendered":"How to Fix Windows 10 11 Stuck on Welcome Screen 2023"},"content":{"rendered":"<p><img decoding=\"async\" src=\"http:\/\/www.pagestart.com\/images\/800_BackupRestore_0x81000037--02.jpg style=margin:0px auto 0px auto; display:block\"\/><\/p>\n<p>S0439 Okrum Okrum establishes persistence by creating a .lnk shortcut to  itself in the Startup folder. S0228 NanHaiShu NanHaiShu modifies the %regrun% Registry to point itself to an autostart mechanism. S0256 Mosquito Mosquito establishes persistence under the Registry key HKCU\\Software\\Run <a href=\"https:\/\/rocketdrivers.com\/dll\/iphlpsvc_dll\">iphlpsvc.dll<\/a> auto_update. G0100 Inception Inception has maintained persistence by modifying Registry run key value HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\. S0483 IcedID IcedID has established persistence by creating a Registry run key.<\/p>\n<ul>\n<li>I recently re-did my windows deployment process on my home lab to use packer.io and autounattend.xml answer files to fully automate my builds.<\/li>\n<li>This is why threat hunting combines innovative technology with human intelligence to identify attacks that are missed by automated security tools alone.<\/li>\n<li>S0331 Agent Tesla Agent Tesla can add itself to the Registry as a startup program to establish persistence.<\/li>\n<\/ul>\n<p>To use REGEDIT, select Start and type REGEDIT in the Search dialog box. Only experienced administrators should use the Registry Editor. It is intended for making configuration changes that can be made directly through the Registry only. Once you\u2019re in the editor, navigate to HKEY_USERS and select the user that you chose in the command prompt.<\/p>\n<p>This was the only time the command line finished without error. This registers all standard apps, and thereby fixes the original issue for some users.<\/p>\n<h2>Registry values<\/h2>\n<p>If you are still able to start Windows and log into the system, then you can try to restore the registry by opening System Restore. Click on Start and type in system restore and click on the first result. There is a way to export the entire registry, but that\u2019s not a good option for several reasons. Firstly, you\u2019re going to get a large file that you have to store somewhere.<\/p>\n<h2>Windows Registry: Malware Persistence<\/h2>\n<p>If you feel like you don\u2019t need that, you can turn the Lockscreen off altogether. Next, right-click the entry in the right-hand pane called \u201cHideBasedOnVelocityId\u201d, click \u201cRename\u201d and add a \u201c_\u201d at the start of the name so it doesn\u2019t register it anymore. After approving the change, go back to the main permission entry window shown below. Give the admin owner \u201cFull control\u201d and \u201cRead\u201d permissions.<\/p>\n<p>Sometimes an individual program or process can experience bugs or errors, such as memory leaks, which can cause a much higher strain on your system than intended. Open Task Manager, open the &#8220;Processes&#8221; tab, then click &#8220;CPU&#8221; to sort all your processes by the level of processing power each program is taking up. If you see any applications using an unusually high percentage that does not decrease within a few minutes, you may need to troubleshoot this program for errors or reinstall it. If most of the time, the CPU usage is 100%, it seems  your PC is trying to process more tasks than it can.<\/p>\n<p>Finally gave up on windows update and installed &#8220;WSUS Offline Update&#8221;, an open source updater intended to build update files for use without an internet connection. WSUS built an updater for me that brought my PC up to date. As a side effect it also fixed Microsoft&#8217;s Windows Update! Having installed those updates I wasnt really expecting much, but I ran windows update manually and noticed a definite change of behaviour between svchost and TrustedInstaller.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>S0439 Okrum Okrum establishes persistence by creating a .lnk shortcut [&hellip;]<\/p>\n","protected":false},"author":51,"featured_media":124946,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[254],"tags":[],"class_list":["post-130562","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-254"],"acf":[],"jetpack_featured_media_url":"https:\/\/www.moh.gov.ps\/portal\/wp-content\/uploads\/2022\/10\/logo-2.png","_links":{"self":[{"href":"https:\/\/www.moh.gov.ps\/portal\/wp-json\/wp\/v2\/posts\/130562","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.moh.gov.ps\/portal\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.moh.gov.ps\/portal\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.moh.gov.ps\/portal\/wp-json\/wp\/v2\/users\/51"}],"replies":[{"embeddable":true,"href":"https:\/\/www.moh.gov.ps\/portal\/wp-json\/wp\/v2\/comments?post=130562"}],"version-history":[{"count":0,"href":"https:\/\/www.moh.gov.ps\/portal\/wp-json\/wp\/v2\/posts\/130562\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.moh.gov.ps\/portal\/wp-json\/wp\/v2\/media\/124946"}],"wp:attachment":[{"href":"https:\/\/www.moh.gov.ps\/portal\/wp-json\/wp\/v2\/media?parent=130562"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.moh.gov.ps\/portal\/wp-json\/wp\/v2\/categories?post=130562"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.moh.gov.ps\/portal\/wp-json\/wp\/v2\/tags?post=130562"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}