Slow logoff and shutdown

[bobl61]

I'm having an issue (slow logoff and shutdown) in WinXP.
I've attached log. Any help appreciated.

 

[Bobbye]

A slow logoff and shutdown could mean applications are hanging- that is, not shutting down properly. It can also mean the there are too many programs starting at boot and running in the background. Each of these has to close when you shutdown

It is better to follow the order of the malware cleaning, running Malwarebytes first, then Superantispyware, followed by Hijackthis, then attaching all 3 logs. But we will try this. If problems persist, you will need to follow: https://www.techspot.com/community/...lware-removal-preliminary-instructions.58138/
You are running two antivirus programs. Decide which you want to keep, then remove the other one:
Ontrack:

Part of Ontrack's Fix-it Utilities Suite. Loads a System Tray icon that lets you access the full program. Needed if you run the crash guard, intellicluster, anti-virus, or autoupdater. Otherwise not required
C:\PROGRA~1\AVANQU~1\SYSTEM~1\MXTask.exe>> Related to Ontrack Inc.
C:\PROGRA~1\AVANQU~1\SYSTEM~1\mxtask.exe
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\Avanquest\SystemSuite\LinkScannerIE.dll
O2 - BHO: Data Vault - {8373ADC0-6330-11DD-9D77-22C856D89593} - C:\Program Files\Avanquest\SystemSuite\IE_ContextMenu_Vault.dll

Vipre:

2. C:\Program Files\Common Files\AntiVirus\SBAMSvc.exe
SBAMSvc.exe>> SBAMSvc.exe is the Vipre engine. It should eat up memory as it works, if that bothers you install something like cacheman to keep your entire machine under control.
O23 - Service: Sunbelt VIPRE Antivirus Service (SBAMSvc) - Sunbelt Software - C:\Program Files\Common Files\AntiVirus\SBAMSvc.exe

Update Java:

Your version of Java is now outdated. Java vulnerabilities are commonly exploited by viruses so I strongly recommend you update. Click here to download the latest version of java ( Java Runtime Environment (JRE) 6.0 Update 10 ): http://java.com/en/download/manual.jsp
Please install it and then reboot your computer.

Reset Cookies:

Internet Options (through Tools or Control Panel) Privacy tab> Advanced button> CHECK 'override automatic Cookie handling'> CHECK 'accept first party Cookies'> CHECK 'Block third party Cookies'> CHECK 'allow per session Cookies'> Apply> OK.

Please re-open HiJackThis and scan.*Check* the boxes next to all the entries listed below.
NOTE: AdvPack is the Advanced INF Package Installer. This dll assists with hardware and software installs by providing advanced setup functionality on top of setupapi.dll. The files below are 'left over' from the run of nLite. Advise remove all:

O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user')

Only delete these entries if they don`t belong to your ISP

Definition: The IP address 192.168.0.1 is the default for certain home broadband routers, principally various D-Link and Netgear models. 192.168.0.1 is a private IPv4 network address:
O17 - HKLM\System\CCS\Services\Tcpip\..\{5716DD0E-ACED-4A77-9CA2-1FE710A3C432}: NameServer = 192.168.0.1,192.168.0.38
O17 - HKLM\System\CS1\Services\Tcpip\..\{5716DD0E-ACED-4A77-9CA2-1FE710A3C432}: NameServer = 192.168.0.1,192.168.0.38
O17 - HKLM\System\CS2\Services\Tcpip\..\{5716DD0E-ACED-4A77-9CA2-1FE710A3C432}: NameServer = 192.168.0.1,192.168.0.38

Now close all windows other than HiJackThis, then click Fix Checked. Close HiJackThis and reboot into Safe Mode:
Start> Run> type 'msconfig' without quotes> enter> Selective Startup> Startup tab> UNCHECK
Processes belonging to either Ontrack OR Vipre, whichever you are NOT going to keep

Advpack
LaunchINFSectionEx
nLite
Click on Apply> OK

Control PAnel> Add/Remove Programs> Uninstall the following if present:

Advpack
nLite
Either Vipre OR Avanquest, whichever you are NOT going to keep

IF you are not going to keep Vipre:
Start> Run> services.msc> right click on Sunbelt VIPRE Antivirus Service> Properties> Change Startup Type to Disabled.

Reboot into Normal Mode. You will get a nag message you can ignore after checking 'don't show this message again'. Stay in Selective Startup.

Please advise of system status.

 

[bobl61]

Thanks for the detailed information. Will execute and post back :approve:

 

[bobl61]

WOO-HOO Problem solved. I think SBAMSvc.exe was the major culprit, but I followed Your advice entirely and shutdown has to be a hundred times faster. Thanks again for Your efforts :wave:

 

[Bobbye]

You're welcome! Love to start the day with a WOO-HOO! Vipre is a known high resource user. Be sure and follow through with the other suggestions.