Very slow xp log off (or not loggin off at all).

[moonfruit]

Hi

Recently I have seem to have inherited a problem. When logging off or switching user, is seems to be extremely slow, or doesnt even log off.

It takes an age to close all programs, then gets to the blue logging off screen and stops?

The only thing I have recently changed is ZoneAlarm, I updated it according to the new version warning.

 

[howard_hopkinso]

Boot into safe mode. See how HERE. http://www.bleepingcomputer.com/forums/tutorial61.html

Turn off system restore.(XP/ME only) See how HERE. http://www.bleepingcomputer.com/forums/tutorial56.html

In Windows Explorer, turn on "Show all files and folders, including hidden and system". See how HERE. http://www.bleepingcomputer.com/forums/tutorial62.html

Go to add remove programmes in your control panel and uninstall anything to do with(if there).

Go!Zilla

Close control panel.

Open your task manager, by holding down the ctrl and alt keys and pressing the delete key.

Click on the processes tab and end process for(if there).

Go.exe
ShowWnd.exe
ALCMTR.EXE

Close task manager.

Run HJT with no other programmes open. Have HJT fix the following, by placing a tick in the little box next to(if there).

O2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file)

O2 - BHO: IEHlprObj Class - {CD4C3CF0-4B15-11D1-ABED-709549C10000} - C:\PROGRA~1\Go!Zilla\GoIEHlp.dll

O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)

O4 - HKLM\..\Run: [ShowWnd] ShowWnd.exe

O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE

O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup

O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start

O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1120931859187
O16 - DPF: {6E5A37BF-FD42-463A-877C-4EB7002E68AE} (Housecall ActiveX 6.5) - http://housecall65.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {C606BA60-AB76-48B6-96A7-2C4D5C386F70} (PreQualifier Class) - http://www.telewest.co.uk/motive/files/MotivePreQual.cab

O17 - HKLM\System\CCS\Services\Tcpip\..\{A026C74D-A0EB-410A-BD59-1D93B8C3F2CA}: NameServer = 194.168.4.100 194.168.8.100<only fix this, if it doesn`t belong to your ISP.

Click on the fix checked button.

Close HJT.

Locate and delete the following bold files and/or directories(if there).

C:\PROGRA~1\Go!Zilla
ShowWnd.exeYou will need to search your system for this file.
ALCMTR.EXEYou will need to search your system for this file.

Reboot into normal mode and turn system restore back on.

Post a fresh HJT log.


Regards Howard

 

[moonfruit]

Thanks a lot Howard for the quick reply!

Heres my new log...

 

[howard_hopkinso]

Please go HERE and follow the instructions.

Post the Ewido log and a fresh HJT log.

Regards Howard

 

[moonfruit]

Cheers, heres the fresh logs..

 

[howard_hopkinso]

The following files are still on your system.

ShowWnd.exe and ALCMTR.EXE

Boot into safe mode. See how HERE. http://www.bleepingcomputer.com/forums/tutorial61.html

Turn off system restore.(XP/ME only) See how HERE. http://www.bleepingcomputer.com/forums/tutorial56.html

In Windows Explorer, turn on "Show all files and folders, including hidden and system". See how HERE. http://www.bleepingcomputer.com/forums/tutorial62.html

Search for and delete the above files. If you can`t delete them manually, do the following.

Run HJT and click on the config button, followed by the misc tools button. Click on the delete files on reboot button and browse to where the files are. Click open and you will be prompted to reboot your computer, click yes. Do this for each file.

Turn system restore back on.

Then, post a fresh HJT log.

Regards Howard

 

[moonfruit]

Heres a fresh log. I searched for and found the files, deleted them. I then searched again and could not find them! Hopefully they are gone!

 

[howard_hopkinso]

Nope, they are still there.

Go HERE and follow the instructions under the heading "How to remove these infections"

Once you`ve finished, please post a fresh HJT log.

Regards Howard

 

[moonfruit]

I think ive cracked it!! Heres hoping!

 

[howard_hopkinso]

You have indeed cracked it. Well done.

Just let HJT fix the following entries.

O2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file)

O2 - BHO: (no name) - {CD4C3CF0-4B15-11D1-ABED-709549C10000} - (no file)

O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)

Other than the above superfluous entries, your HJT log is clean.

Regards Howard

 

[moonfruit]

Many thanks for your help and patience! :grinthumb

 

[moonfruit]

Computer running slow and freezing on log off.

Hi
My computer seems to be running slow and occasionally freezing on log off. I had a similar problem a few months ago and Howard Hopkinso helped me out. I was wondering if someone could take a look at my HJT log.

I have run Ewido and AVG and cleaned any issues.

Many thanks

 

[howard_hopkinso]

I have merged your new thread into this one.

You might want to copy and paste these instructions into a notepad file. Then you can have the file open in safe mode, so you can follow the instructions easier.

Boot into safe mode, under your normal user name(NOT THE ADMINISTRATOR ACCOUNT). See how here.> http://www.bleepingcomputer.com/forums/tutorial61.html

Turn off system restore.(XP/ME only) See how here.> http://www.bleepingcomputer.com/forums/tutorial56.html

In Windows Explorer, turn on "Show all files and folders, including hidden and system". See how here.> http://www.bleepingcomputer.com/forums/tutorial62.html

Go to add remove programmes in your control panel and uninstall anything to do with(if there).

Go!Zilla

Close control panel.

Run HJT with no other programmes open(except notepad). Click the scan button. Have HJT fix the following, by placing a tick in the little box next to(if there).

O2 - BHO: IEHlprObj Class - {CD4C3CF0-4B15-11D1-ABED-709549C10000} - C:\PROGRA~1\Go!Zilla\GoIEHlp.dll

O8 - Extra context menu item: Download with Go!Zilla - file://C:\Program Files\Go!Zilla\download-with-gozilla.html

Click on the fix checked button.

Close HJT.

Locate and delete the following bold files and/or directories(if there).

C:\Program Files\Go!Zilla


Reboot into normal mode and turn system restore back on.

Post a fresh HJT log.

Regards Howard

This thread is for the use of moonfruit only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

 

[moonfruit]

Heres a new log....

 

[howard_hopkinso]

Well done, your HJT log is clean.

If you have any further virus/spyware problems, please post in this thread.

Regards Howard

This thread is for the use of moonfruit only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.