TechSpot

Very slow xp log off (or not loggin off at all).

By moonfruit
Jun 25, 2006
  1. Hi

    Recently I have seem to have inherited a problem. When logging off or switching user, is seems to be extremely slow, or doesnt even log off.

    It takes an age to close all programs, then gets to the blue logging off screen and stops?

    The only thing I have recently changed is ZoneAlarm, I updated it according to the new version warning.
     
  2. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    Boot into safe mode. See how HERE. http://www.bleepingcomputer.com/forums/tutorial61.html

    Turn off system restore.(XP/ME only) See how HERE. http://www.bleepingcomputer.com/forums/tutorial56.html

    In Windows Explorer, turn on "Show all files and folders, including hidden and system". See how HERE. http://www.bleepingcomputer.com/forums/tutorial62.html

    Go to add remove programmes in your control panel and uninstall anything to do with(if there).

    Go!Zilla

    Close control panel.

    Open your task manager, by holding down the ctrl and alt keys and pressing the delete key.

    Click on the processes tab and end process for(if there).

    Go.exe
    ShowWnd.exe
    ALCMTR.EXE

    Close task manager.

    Run HJT with no other programmes open. Have HJT fix the following, by placing a tick in the little box next to(if there).

    O2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file)

    O2 - BHO: IEHlprObj Class - {CD4C3CF0-4B15-11D1-ABED-709549C10000} - C:\PROGRA~1\Go!Zilla\GoIEHlp.dll

    O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)

    O4 - HKLM\..\Run: [ShowWnd] ShowWnd.exe

    O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE

    O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup

    O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start

    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1120931859187
    O16 - DPF: {6E5A37BF-FD42-463A-877C-4EB7002E68AE} (Housecall ActiveX 6.5) - http://housecall65.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
    O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
    O16 - DPF: {C606BA60-AB76-48B6-96A7-2C4D5C386F70} (PreQualifier Class) - http://www.telewest.co.uk/motive/files/MotivePreQual.cab

    O17 - HKLM\System\CCS\Services\Tcpip\..\{A026C74D-A0EB-410A-BD59-1D93B8C3F2CA}: NameServer = 194.168.4.100 194.168.8.100<only fix this, if it doesn`t belong to your ISP.

    Click on the fix checked button.

    Close HJT.

    Locate and delete the following bold files and/or directories(if there).

    C:\PROGRA~1\Go!Zilla
    ShowWnd.exeYou will need to search your system for this file.
    ALCMTR.EXEYou will need to search your system for this file.

    Reboot into normal mode and turn system restore back on.

    Post a fresh HJT log.


    Regards Howard :)
     
  3. moonfruit

    moonfruit TS Rookie Topic Starter Posts: 30

    Thanks a lot Howard for the quick reply!

    Heres my new log...
     
  4. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    Please go HERE and follow the instructions.

    Post the Ewido log and a fresh HJT log.

    Regards Howard :)
     
  5. moonfruit

    moonfruit TS Rookie Topic Starter Posts: 30

    Cheers, heres the fresh logs..
     
  6. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    The following files are still on your system.

    ShowWnd.exe and ALCMTR.EXE

    Boot into safe mode. See how HERE. http://www.bleepingcomputer.com/forums/tutorial61.html

    Turn off system restore.(XP/ME only) See how HERE. http://www.bleepingcomputer.com/forums/tutorial56.html

    In Windows Explorer, turn on "Show all files and folders, including hidden and system". See how HERE. http://www.bleepingcomputer.com/forums/tutorial62.html

    Search for and delete the above files. If you can`t delete them manually, do the following.

    Run HJT and click on the config button, followed by the misc tools button. Click on the delete files on reboot button and browse to where the files are. Click open and you will be prompted to reboot your computer, click yes. Do this for each file.

    Turn system restore back on.

    Then, post a fresh HJT log.

    Regards Howard :)
     
  7. moonfruit

    moonfruit TS Rookie Topic Starter Posts: 30

    Heres a fresh log. I searched for and found the files, deleted them. I then searched again and could not find them! Hopefully they are gone!
     
  8. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    Nope, they are still there.

    Go HERE and follow the instructions under the heading "How to remove these infections"

    Once you`ve finished, please post a fresh HJT log.

    Regards Howard :)
     
  9. moonfruit

    moonfruit TS Rookie Topic Starter Posts: 30

    I think ive cracked it!! Heres hoping!
     
  10. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    You have indeed cracked it. Well done.

    Just let HJT fix the following entries.

    O2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file)

    O2 - BHO: (no name) - {CD4C3CF0-4B15-11D1-ABED-709549C10000} - (no file)

    O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)

    Other than the above superfluous entries, your HJT log is clean.

    Regards Howard :)
     
  11. moonfruit

    moonfruit TS Rookie Topic Starter Posts: 30

    Many thanks for your help and patience! :grinthumb
     
  12. moonfruit

    moonfruit TS Rookie Topic Starter Posts: 30

    Computer running slow and freezing on log off.

    Hi
    My computer seems to be running slow and occasionally freezing on log off. I had a similar problem a few months ago and Howard Hopkinso helped me out. I was wondering if someone could take a look at my HJT log.

    I have run Ewido and AVG and cleaned any issues.

    Many thanks
     
  13. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    I have merged your new thread into this one.

    You might want to copy and paste these instructions into a notepad file. Then you can have the file open in safe mode, so you can follow the instructions easier.

    Boot into safe mode, under your normal user name(NOT THE ADMINISTRATOR ACCOUNT). See how here.> http://www.bleepingcomputer.com/forums/tutorial61.html

    Turn off system restore.(XP/ME only) See how here.> http://www.bleepingcomputer.com/forums/tutorial56.html

    In Windows Explorer, turn on "Show all files and folders, including hidden and system". See how here.> http://www.bleepingcomputer.com/forums/tutorial62.html

    Go to add remove programmes in your control panel and uninstall anything to do with(if there).

    Go!Zilla

    Close control panel.

    Run HJT with no other programmes open(except notepad). Click the scan button. Have HJT fix the following, by placing a tick in the little box next to(if there).

    O2 - BHO: IEHlprObj Class - {CD4C3CF0-4B15-11D1-ABED-709549C10000} - C:\PROGRA~1\Go!Zilla\GoIEHlp.dll

    O8 - Extra context menu item: Download with Go!Zilla - file://C:\Program Files\Go!Zilla\download-with-gozilla.html

    Click on the fix checked button.

    Close HJT.

    Locate and delete the following bold files and/or directories(if there).

    C:\Program Files\Go!Zilla


    Reboot into normal mode and turn system restore back on.

    Post a fresh HJT log.

    Regards Howard :)

    This thread is for the use of moonfruit only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
     
  14. moonfruit

    moonfruit TS Rookie Topic Starter Posts: 30

    Heres a new log....
     
  15. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    Well done, your HJT log is clean.

    If you have any further virus/spyware problems, please post in this thread.

    Regards Howard :)

    This thread is for the use of moonfruit only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
     
Topic Status:
Not open for further replies.

Similar Topics

Add New Comment

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...