New Error When I Start

  • Thread starter Thread starter Jethro
  • Start date Start date
J

Jethro

WXP PRO SP2

The past two days - everytime I boot up XP, I can't do anything for
about 5 minutes while something hidden and unknown to me is executing.

If I try to execute an app during that time, I get an error window
saying:

Microsoft Visual C++ Runtime Library
Program: c:\windows\explorer.exe
This application has requested the Runtime to terminate it in an
unusual way. Please contact the application's support team for more
info.

I have no idea what is happening. I have scanned TaskManager, but see
nothing untoward. I tried killing several apps using Taskmanager, but
nothing improved.

I am hoping someone can tell me how I can determine what app is
actually causing the problem so I can deal with it

Thanks, I hope

Jethro
 
What happens when you start in Safe Mode?

If you can boot in Safe Mode, check your Event Viewer log for errors.
 
Jethro said:
WXP PRO SP2

The past two days - everytime I boot up XP, I can't do anything for
about 5 minutes while something hidden and unknown to me is executing.

If I try to execute an app during that time, I get an error window
saying:

Microsoft Visual C++ Runtime Library
Program: c:\windows\explorer.exe
This application has requested the Runtime to terminate it in an
unusual way. Please contact the application's support team for more
info.

I have no idea what is happening. I have scanned TaskManager, but see
nothing untoward. I tried killing several apps using Taskmanager, but
nothing improved.

I am hoping someone can tell me how I can determine what app is
actually causing the problem so I can deal with it

Thanks, I hope

Jethro

Hi Jet,
Adding to NewScience try to scan for malwares and Viruses on your computer,
this error can be caused with corrupted applications or mismatched/outdated
Programs on your system.
You can Start with selective/Clean Boot by opening the Run command and type
in :
msconfig click [OK] and on the system Configuration Window click on Start
Up Tab and uncheck some applications/Progams (but not the MS necessary ones)
and Reboot and see if you didn't get the error message then try to renable
all programs one-by-one and see the culprit and uninstall it or Repair it.

1- The best is to scan your computer with online scanner from here:
http://www.pandasecurity.com/activescan
http://www.trendmicro.com
And also for malwares from here:
http://www.lavasoft.com/products/ad-aware_se_personal.php
http://www.safer-networking.org ; for Spybot S&D

2= If all fail download the Hijackthis and send the report to one of many
forums for analysis and troubleshooting:
When all else fails, HijackThis v1.99.1
(http://aumha.org/downloads/hijackthis.zip) is the preferred tool to use.
It will help you to both identify and remove any hijackware/spyware. Post
your log to http://aumha.net/viewforum.php?f=30,
http://castlecops.com/forum67.html,
http://forums.subratam.org/index.php?showforum=7, or other appropriate
forums for expert analysis, not here.
Please perform one step (1,2) at a time and see if that will help your
issue.
HTH.
Please let us know.
Regards,
nass
 
Jethro said:
WXP PRO SP2

The past two days - everytime I boot up XP, I can't do anything for
about 5 minutes while something hidden and unknown to me is executing.

If I try to execute an app during that time, I get an error window
saying:

Microsoft Visual C++ Runtime Library
Program: c:\windows\explorer.exe
This application has requested the Runtime to terminate it in an
unusual way. Please contact the application's support team for more
info.

I have no idea what is happening. I have scanned TaskManager, but see
nothing untoward. I tried killing several apps using Taskmanager, but
nothing improved.

I am hoping someone can tell me how I can determine what app is
actually causing the problem so I can deal with it

Thanks, I hope

Jethro

Hi Jet,
Adding to NewScience try to scan for malwares and Viruses on your computer,
this error can be caused with corrupted applications or mismatched/outdated
Programs on your system.
You can Start with selective/Clean Boot by opening the Run command and type
in :
msconfig click [OK] and on the system Configuration Window click on Start
Up Tab and uncheck some applications/Progams (but not the MS necessary ones)
and Reboot and see if you didn't get the error message then try to renable
all programs one-by-one and see the culprit and uninstall it or Repair it.

1- The best is to scan your computer with online scanner from here:
http://www.pandasecurity.com/activescan
http://www.trendmicro.com
And also for malwares from here:
http://www.lavasoft.com/products/ad-aware_se_personal.php
http://www.safer-networking.org ; for Spybot S&D

2= If all fail download the Hijackthis and send the report to one of many
forums for analysis and troubleshooting:
When all else fails, HijackThis v1.99.1
(http://aumha.org/downloads/hijackthis.zip) is the preferred tool to use.
It will help you to both identify and remove any hijackware/spyware. Post
your log to http://aumha.net/viewforum.php?f=30,
http://castlecops.com/forum67.html,
http://forums.subratam.org/index.php?showforum=7, or other appropriate
forums for expert analysis, not here.
Please perform one step (1,2) at a time and see if that will help your
issue.
HTH.
Please let us know.
Regards,
nass


Thanks you two.

I looked at the event log both in normal mode and safe mode. It looks
same.

It looks like two apps run one after the other every time I try to
open a folder during this 'dead' period and I get the error I
described.

They are umxagent and winlogon

A quick check in Google shows me that umxagent is anti-virus related
or somesuch. It happens that I just installed CA Security Suite v2007
two days ago. I can't say the problem started with that, but then, it
never happened before. I'm going to try to uninstall CA to see if
problem disappears.

Jethro
 
Jethro said:
WXP PRO SP2

The past two days - everytime I boot up XP, I can't do anything for
about 5 minutes while something hidden and unknown to me is executing.

If I try to execute an app during that time, I get an error window
saying:

Microsoft Visual C++ Runtime Library
Program: c:\windows\explorer.exe
This application has requested the Runtime to terminate it in an
unusual way. Please contact the application's support team for more
info.

I have no idea what is happening. I have scanned TaskManager, but see
nothing untoward. I tried killing several apps using Taskmanager, but
nothing improved.

I am hoping someone can tell me how I can determine what app is
actually causing the problem so I can deal with it

Thanks, I hope

Jethro

Hi Jet,
Adding to NewScience try to scan for malwares and Viruses on your computer,
this error can be caused with corrupted applications or mismatched/outdated
Programs on your system.
You can Start with selective/Clean Boot by opening the Run command and type
in :
msconfig click [OK] and on the system Configuration Window click on Start
Up Tab and uncheck some applications/Progams (but not the MS necessary ones)
and Reboot and see if you didn't get the error message then try to renable
all programs one-by-one and see the culprit and uninstall it or Repair it.

1- The best is to scan your computer with online scanner from here:
http://www.pandasecurity.com/activescan
http://www.trendmicro.com
And also for malwares from here:
http://www.lavasoft.com/products/ad-aware_se_personal.php
http://www.safer-networking.org ; for Spybot S&D

2= If all fail download the Hijackthis and send the report to one of many
forums for analysis and troubleshooting:
When all else fails, HijackThis v1.99.1
(http://aumha.org/downloads/hijackthis.zip) is the preferred tool to use.
It will help you to both identify and remove any hijackware/spyware. Post
your log to http://aumha.net/viewforum.php?f=30,
http://castlecops.com/forum67.html,
http://forums.subratam.org/index.php?showforum=7, or other appropriate
forums for expert analysis, not here.
Please perform one step (1,2) at a time and see if that will help your
issue.
HTH.
Please let us know.
Regards,
nass


I'm back - you two.

Well I uninstalled CS Security Suite, and re-booted. The problem
still exists. Now the event log table shows only winlogon for each
time that I try to open a folder during the 'dead' time. I guess I
need to determine what winlogon is. Whatever it is, it does not seem
to come up when I open the same folder after the so-called 'dead'
time.

Jethro
 
Jethro said:
Jethro said:
WXP PRO SP2

The past two days - everytime I boot up XP, I can't do anything for
about 5 minutes while something hidden and unknown to me is executing.

If I try to execute an app during that time, I get an error window
saying:

Microsoft Visual C++ Runtime Library
Program: c:\windows\explorer.exe
This application has requested the Runtime to terminate it in an
unusual way. Please contact the application's support team for more
info.

I have no idea what is happening. I have scanned TaskManager, but see
nothing untoward. I tried killing several apps using Taskmanager, but
nothing improved.

I am hoping someone can tell me how I can determine what app is
actually causing the problem so I can deal with it

Thanks, I hope

Jethro

Hi Jet,
Adding to NewScience try to scan for malwares and Viruses on your computer,
this error can be caused with corrupted applications or mismatched/outdated
Programs on your system.
You can Start with selective/Clean Boot by opening the Run command and type
in :
msconfig click [OK] and on the system Configuration Window click on Start
Up Tab and uncheck some applications/Progams (but not the MS necessary ones)
and Reboot and see if you didn't get the error message then try to renable
all programs one-by-one and see the culprit and uninstall it or Repair it.

1- The best is to scan your computer with online scanner from here:
http://www.pandasecurity.com/activescan
http://www.trendmicro.com
And also for malwares from here:
http://www.lavasoft.com/products/ad-aware_se_personal.php
http://www.safer-networking.org ; for Spybot S&D

2= If all fail download the Hijackthis and send the report to one of many
forums for analysis and troubleshooting:
When all else fails, HijackThis v1.99.1
(http://aumha.org/downloads/hijackthis.zip) is the preferred tool to use.
It will help you to both identify and remove any hijackware/spyware. Post
your log to http://aumha.net/viewforum.php?f=30,
http://castlecops.com/forum67.html,
http://forums.subratam.org/index.php?showforum=7, or other appropriate
forums for expert analysis, not here.
Please perform one step (1,2) at a time and see if that will help your
issue.
HTH.
Please let us know.
Regards,
nass


I'm back - you two.

Well I uninstalled CS Security Suite, and re-booted. The problem
still exists. Now the event log table shows only winlogon for each
time that I try to open a folder during the 'dead' time. I guess I
need to determine what winlogon is. Whatever it is, it does not seem
to come up when I open the same folder after the so-called 'dead'
time.

Jethro

Hi Jet,
Run a thorough scan from the links i provided earlier and scan for malwares
on your computer.
Winlogon.exe can be both Legitimate and a Viral infections, winlogon.exe is
the User Authentication to log on the system.
Also check this KEY in the Registry and Note the enrties in it:
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion = look in the
Right Pane/Window for the Entries.
If after the Scan nothing found try to run the Hijackthis nd send the Report
to one of the forums for Analysis.
HTH.
Regards,
nass
 
Jethro said:
:

WXP PRO SP2

The past two days - everytime I boot up XP, I can't do anything for
about 5 minutes while something hidden and unknown to me is executing.

If I try to execute an app during that time, I get an error window
saying:

Microsoft Visual C++ Runtime Library
Program: c:\windows\explorer.exe
This application has requested the Runtime to terminate it in an
unusual way. Please contact the application's support team for more
info.

I have no idea what is happening. I have scanned TaskManager, but see
nothing untoward. I tried killing several apps using Taskmanager, but
nothing improved.

I am hoping someone can tell me how I can determine what app is
actually causing the problem so I can deal with it

Thanks, I hope

Jethro

Hi Jet,
Adding to NewScience try to scan for malwares and Viruses on your computer,
this error can be caused with corrupted applications or mismatched/outdated
Programs on your system.
You can Start with selective/Clean Boot by opening the Run command and type
in :
msconfig click [OK] and on the system Configuration Window click on Start
Up Tab and uncheck some applications/Progams (but not the MS necessary ones)
and Reboot and see if you didn't get the error message then try to renable
all programs one-by-one and see the culprit and uninstall it or Repair it.

1- The best is to scan your computer with online scanner from here:
http://www.pandasecurity.com/activescan
http://www.trendmicro.com
And also for malwares from here:
http://www.lavasoft.com/products/ad-aware_se_personal.php
http://www.safer-networking.org ; for Spybot S&D

2= If all fail download the Hijackthis and send the report to one of many
forums for analysis and troubleshooting:
When all else fails, HijackThis v1.99.1
(http://aumha.org/downloads/hijackthis.zip) is the preferred tool to use.
It will help you to both identify and remove any hijackware/spyware. Post
your log to http://aumha.net/viewforum.php?f=30,
http://castlecops.com/forum67.html,
http://forums.subratam.org/index.php?showforum=7, or other appropriate
forums for expert analysis, not here.
Please perform one step (1,2) at a time and see if that will help your
issue.
HTH.
Please let us know.
Regards,
nass


I'm back - you two.

Well I uninstalled CS Security Suite, and re-booted. The problem
still exists. Now the event log table shows only winlogon for each
time that I try to open a folder during the 'dead' time. I guess I
need to determine what winlogon is. Whatever it is, it does not seem
to come up when I open the same folder after the so-called 'dead'
time.

Jethro

Hi Jet,
Run a thorough scan from the links i provided earlier and scan for malwares
on your computer.

I will do this next.
Winlogon.exe can be both Legitimate and a Viral infections, winlogon.exe is
the User Authentication to log on the system.

My winlogon is under system32. I looked - found none anywhere else.
Also check this KEY in the Registry and Note the enrties in it:
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion = look in the
Right Pane/Window for the Entries.

Most everything thereunder are my printers.
If after the Scan nothing found try to run the Hijackthis nd send the Report
to one of the forums for Analysis.
HTH.
Regards,
nass

Sounds like am eventuality.

Thanks again

J
 
Check the following registry key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\Winlogon\Notify

You should have:

crypt32chain
cryptnet
cscdll
ScCertProp
Schedule
sclgntfy
SensLogn
termsrv
WgaLogon
wlballoon

keys under Notify key.

Also check to see if CA was TOTALLY removed by checking SERVICE.MSC
(sometimes they add services and don't remove them).

I would also check all the Run keys in the registry:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

and see if there are any CA entries left.

Jethro said:
Jethro said:
On Sat, 16 Dec 2006 12:26:01 -0800, nass



:

WXP PRO SP2

The past two days - everytime I boot up XP, I can't do anything for
about 5 minutes while something hidden and unknown to me is
executing.

If I try to execute an app during that time, I get an error window
saying:

Microsoft Visual C++ Runtime Library
Program: c:\windows\explorer.exe
This application has requested the Runtime to terminate it in an
unusual way. Please contact the application's support team for more
info.

I have no idea what is happening. I have scanned TaskManager, but
see
nothing untoward. I tried killing several apps using Taskmanager,
but
nothing improved.

I am hoping someone can tell me how I can determine what app is
actually causing the problem so I can deal with it

Thanks, I hope

Jethro

Hi Jet,
Adding to NewScience try to scan for malwares and Viruses on your
computer,
this error can be caused with corrupted applications or
mismatched/outdated
Programs on your system.
You can Start with selective/Clean Boot by opening the Run command and
type
in :
msconfig click [OK] and on the system Configuration Window click on
Start
Up Tab and uncheck some applications/Progams (but not the MS necessary
ones)
and Reboot and see if you didn't get the error message then try to
renable
all programs one-by-one and see the culprit and uninstall it or Repair
it.

1- The best is to scan your computer with online scanner from here:
http://www.pandasecurity.com/activescan
http://www.trendmicro.com
And also for malwares from here:
http://www.lavasoft.com/products/ad-aware_se_personal.php
http://www.safer-networking.org ; for Spybot S&D

2= If all fail download the Hijackthis and send the report to one of
many
forums for analysis and troubleshooting:
When all else fails, HijackThis v1.99.1
(http://aumha.org/downloads/hijackthis.zip) is the preferred tool to
use.
It will help you to both identify and remove any hijackware/spyware.
Post
your log to http://aumha.net/viewforum.php?f=30,
http://castlecops.com/forum67.html,
http://forums.subratam.org/index.php?showforum=7, or other appropriate
forums for expert analysis, not here.
Please perform one step (1,2) at a time and see if that will help your
issue.
HTH.
Please let us know.
Regards,
nass
----
www.nasstec.co.uk


I'm back - you two.

Well I uninstalled CS Security Suite, and re-booted. The problem
still exists. Now the event log table shows only winlogon for each
time that I try to open a folder during the 'dead' time. I guess I
need to determine what winlogon is. Whatever it is, it does not seem
to come up when I open the same folder after the so-called 'dead'
time.

Jethro

Hi Jet,
Run a thorough scan from the links i provided earlier and scan for
malwares
on your computer.

I will do this next.
Winlogon.exe can be both Legitimate and a Viral infections, winlogon.exe
is
the User Authentication to log on the system.

My winlogon is under system32. I looked - found none anywhere else.
Also check this KEY in the Registry and Note the enrties in it:
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion = look in
the
Right Pane/Window for the Entries.

Most everything thereunder are my printers.
If after the Scan nothing found try to run the Hijackthis nd send the
Report
to one of the forums for Analysis.
HTH.
Regards,
nass

Sounds like am eventuality.

Thanks again

J
 
Check the following registry key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\Winlogon\Notify

You should have:

crypt32chain
cryptnet
cscdll
ScCertProp
Schedule
sclgntfy
SensLogn
termsrv
WgaLogon
wlballoon

keys under Notify key.

I find nothing (keys?) at all on the left under Winlogon. I think
what should be there may be (from my companion machine):

Credentials
GPExtensions
Notify
WOW
WPAEvents

I wonder where they went, especially Notify
Also check to see if CA was TOTALLY removed by checking SERVICE.MSC
(sometimes they add services and don't remove them).

I don't find 'service.msc' either in the registry or anywhere on the
hard drive.
I would also check all the Run keys in the registry:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

and see if there are any CA entries left.

I don't see any CA entries.

BTW as I was examining the registry I spotted an entry following
Microsoft as Miscrosoft. Strange. Had nothing under it (left or
right). I removed it.

Thanks for helps

Jethro

Jethro said:
:

On Sat, 16 Dec 2006 12:26:01 -0800, nass



:

WXP PRO SP2

The past two days - everytime I boot up XP, I can't do anything for
about 5 minutes while something hidden and unknown to me is
executing.

If I try to execute an app during that time, I get an error window
saying:

Microsoft Visual C++ Runtime Library
Program: c:\windows\explorer.exe
This application has requested the Runtime to terminate it in an
unusual way. Please contact the application's support team for more
info.

I have no idea what is happening. I have scanned TaskManager, but
see
nothing untoward. I tried killing several apps using Taskmanager,
but
nothing improved.

I am hoping someone can tell me how I can determine what app is
actually causing the problem so I can deal with it

Thanks, I hope

Jethro

Hi Jet,
Adding to NewScience try to scan for malwares and Viruses on your
computer,
this error can be caused with corrupted applications or
mismatched/outdated
Programs on your system.
You can Start with selective/Clean Boot by opening the Run command and
type
in :
msconfig click [OK] and on the system Configuration Window click on
Start
Up Tab and uncheck some applications/Progams (but not the MS necessary
ones)
and Reboot and see if you didn't get the error message then try to
renable
all programs one-by-one and see the culprit and uninstall it or Repair
it.

1- The best is to scan your computer with online scanner from here:
http://www.pandasecurity.com/activescan
http://www.trendmicro.com
And also for malwares from here:
http://www.lavasoft.com/products/ad-aware_se_personal.php
http://www.safer-networking.org ; for Spybot S&D

2= If all fail download the Hijackthis and send the report to one of
many
forums for analysis and troubleshooting:
When all else fails, HijackThis v1.99.1
(http://aumha.org/downloads/hijackthis.zip) is the preferred tool to
use.
It will help you to both identify and remove any hijackware/spyware.
Post
your log to http://aumha.net/viewforum.php?f=30,
http://castlecops.com/forum67.html,
http://forums.subratam.org/index.php?showforum=7, or other appropriate
forums for expert analysis, not here.
Please perform one step (1,2) at a time and see if that will help your
issue.
HTH.
Please let us know.
Regards,
nass
----
www.nasstec.co.uk


I'm back - you two.

Well I uninstalled CS Security Suite, and re-booted. The problem
still exists. Now the event log table shows only winlogon for each
time that I try to open a folder during the 'dead' time. I guess I
need to determine what winlogon is. Whatever it is, it does not seem
to come up when I open the same folder after the so-called 'dead'
time.

Jethro

Hi Jet,
Run a thorough scan from the links i provided earlier and scan for
malwares
on your computer.

I will do this next.
Winlogon.exe can be both Legitimate and a Viral infections, winlogon.exe
is
the User Authentication to log on the system.

My winlogon is under system32. I looked - found none anywhere else.
Also check this KEY in the Registry and Note the enrties in it:
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion = look in
the
Right Pane/Window for the Entries.

Most everything thereunder are my printers.
If after the Scan nothing found try to run the Hijackthis nd send the
Report
to one of the forums for Analysis.
HTH.
Regards,
nass

Sounds like am eventuality.

Thanks again

J
 
Also check to see if CA was TOTALLY removed by checking SERVICE.MSC
I don't find 'service.msc' either in the registry or anywhere on the
hard drive.

Sorry, typing too fast ... SERVICES.MSC it should be.
I find nothing (keys?) at all on the left under Winlogon. I think
what should be there may be (from my companion machine):

Credentials
GPExtensions
Notify
WOW
WPAEvents

You have the Notify key there. You did not look far under enough based on
my path I gave you.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\Winlogon\Notify

You have (based on the above list) the Notify key ... what is there?

Jethro said:
Check the following registry key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\Winlogon\Notify

You should have:

crypt32chain
cryptnet
cscdll
ScCertProp
Schedule
sclgntfy
SensLogn
termsrv
WgaLogon
wlballoon

keys under Notify key.

I find nothing (keys?) at all on the left under Winlogon. I think
what should be there may be (from my companion machine):

Credentials
GPExtensions
Notify
WOW
WPAEvents

I wonder where they went, especially Notify
Also check to see if CA was TOTALLY removed by checking SERVICE.MSC
(sometimes they add services and don't remove them).

I don't find 'service.msc' either in the registry or anywhere on the
hard drive.
I would also check all the Run keys in the registry:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

and see if there are any CA entries left.

I don't see any CA entries.

BTW as I was examining the registry I spotted an entry following
Microsoft as Miscrosoft. Strange. Had nothing under it (left or
right). I removed it.

Thanks for helps

Jethro

Jethro said:
On Sat, 16 Dec 2006 14:03:01 -0800, nass



:

On Sat, 16 Dec 2006 12:26:01 -0800, nass



:

WXP PRO SP2

The past two days - everytime I boot up XP, I can't do anything for
about 5 minutes while something hidden and unknown to me is
executing.

If I try to execute an app during that time, I get an error window
saying:

Microsoft Visual C++ Runtime Library
Program: c:\windows\explorer.exe
This application has requested the Runtime to terminate it in an
unusual way. Please contact the application's support team for
more
info.

I have no idea what is happening. I have scanned TaskManager, but
see
nothing untoward. I tried killing several apps using Taskmanager,
but
nothing improved.

I am hoping someone can tell me how I can determine what app is
actually causing the problem so I can deal with it

Thanks, I hope

Jethro

Hi Jet,
Adding to NewScience try to scan for malwares and Viruses on your
computer,
this error can be caused with corrupted applications or
mismatched/outdated
Programs on your system.
You can Start with selective/Clean Boot by opening the Run command
and
type
in :
msconfig click [OK] and on the system Configuration Window click on
Start
Up Tab and uncheck some applications/Progams (but not the MS
necessary
ones)
and Reboot and see if you didn't get the error message then try to
renable
all programs one-by-one and see the culprit and uninstall it or
Repair
it.

1- The best is to scan your computer with online scanner from here:
http://www.pandasecurity.com/activescan
http://www.trendmicro.com
And also for malwares from here:
http://www.lavasoft.com/products/ad-aware_se_personal.php
http://www.safer-networking.org ; for Spybot S&D

2= If all fail download the Hijackthis and send the report to one of
many
forums for analysis and troubleshooting:
When all else fails, HijackThis v1.99.1
(http://aumha.org/downloads/hijackthis.zip) is the preferred tool to
use.
It will help you to both identify and remove any hijackware/spyware.
Post
your log to http://aumha.net/viewforum.php?f=30,
http://castlecops.com/forum67.html,
http://forums.subratam.org/index.php?showforum=7, or other
appropriate
forums for expert analysis, not here.
Please perform one step (1,2) at a time and see if that will help
your
issue.
HTH.
Please let us know.
Regards,
nass
----
www.nasstec.co.uk


I'm back - you two.

Well I uninstalled CS Security Suite, and re-booted. The problem
still exists. Now the event log table shows only winlogon for each
time that I try to open a folder during the 'dead' time. I guess I
need to determine what winlogon is. Whatever it is, it does not seem
to come up when I open the same folder after the so-called 'dead'
time.

Jethro

Hi Jet,
Run a thorough scan from the links i provided earlier and scan for
malwares
on your computer.

I will do this next.

Winlogon.exe can be both Legitimate and a Viral infections, winlogon.exe
is
the User Authentication to log on the system.

My winlogon is under system32. I looked - found none anywhere else.

Also check this KEY in the Registry and Note the enrties in it:
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion = look in
the
Right Pane/Window for the Entries.

Most everything thereunder are my printers.

If after the Scan nothing found try to run the Hijackthis nd send the
Report
to one of the forums for Analysis.
HTH.
Regards,
nass
----------
www.nasstec.co.uk

Sounds like am eventuality.

Thanks again

J
 
Sorry, typing too fast ... SERVICES.MSC it should be.


You have the Notify key there. You did not look far under enough based on
my path I gave you.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\Winlogon\Notify

You have (based on the above list) the Notify key ... what is there?

Sorry about that. Looks okay:
crypt32chain
cryptnet
cscdll
ScCertProp
Schedule
sclgntfy
SensLogn
termsrv
WgaLogon
wlballoon

Jethro
Jethro said:
Check the following registry key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\Winlogon\Notify

You should have:

crypt32chain
cryptnet
cscdll
ScCertProp
Schedule
sclgntfy
SensLogn
termsrv
WgaLogon
wlballoon

keys under Notify key.

I find nothing (keys?) at all on the left under Winlogon. I think
what should be there may be (from my companion machine):

Credentials
GPExtensions
Notify
WOW
WPAEvents

I wonder where they went, especially Notify
Also check to see if CA was TOTALLY removed by checking SERVICE.MSC
(sometimes they add services and don't remove them).

I don't find 'service.msc' either in the registry or anywhere on the
hard drive.
I would also check all the Run keys in the registry:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

and see if there are any CA entries left.

I don't see any CA entries.

BTW as I was examining the registry I spotted an entry following
Microsoft as Miscrosoft. Strange. Had nothing under it (left or
right). I removed it.

Thanks for helps

Jethro

On Sat, 16 Dec 2006 14:03:01 -0800, nass



:

On Sat, 16 Dec 2006 12:26:01 -0800, nass



:

WXP PRO SP2

The past two days - everytime I boot up XP, I can't do anything for
about 5 minutes while something hidden and unknown to me is
executing.

If I try to execute an app during that time, I get an error window
saying:

Microsoft Visual C++ Runtime Library
Program: c:\windows\explorer.exe
This application has requested the Runtime to terminate it in an
unusual way. Please contact the application's support team for
more
info.

I have no idea what is happening. I have scanned TaskManager, but
see
nothing untoward. I tried killing several apps using Taskmanager,
but
nothing improved.

I am hoping someone can tell me how I can determine what app is
actually causing the problem so I can deal with it

Thanks, I hope

Jethro

Hi Jet,
Adding to NewScience try to scan for malwares and Viruses on your
computer,
this error can be caused with corrupted applications or
mismatched/outdated
Programs on your system.
You can Start with selective/Clean Boot by opening the Run command
and
type
in :
msconfig click [OK] and on the system Configuration Window click on
Start
Up Tab and uncheck some applications/Progams (but not the MS
necessary
ones)
and Reboot and see if you didn't get the error message then try to
renable
all programs one-by-one and see the culprit and uninstall it or
Repair
it.

1- The best is to scan your computer with online scanner from here:
http://www.pandasecurity.com/activescan
http://www.trendmicro.com
And also for malwares from here:
http://www.lavasoft.com/products/ad-aware_se_personal.php
http://www.safer-networking.org ; for Spybot S&D

2= If all fail download the Hijackthis and send the report to one of
many
forums for analysis and troubleshooting:
When all else fails, HijackThis v1.99.1
(http://aumha.org/downloads/hijackthis.zip) is the preferred tool to
use.
It will help you to both identify and remove any hijackware/spyware.
Post
your log to http://aumha.net/viewforum.php?f=30,
http://castlecops.com/forum67.html,
http://forums.subratam.org/index.php?showforum=7, or other
appropriate
forums for expert analysis, not here.
Please perform one step (1,2) at a time and see if that will help
your
issue.
HTH.
Please let us know.
Regards,
nass
----
www.nasstec.co.uk


I'm back - you two.

Well I uninstalled CS Security Suite, and re-booted. The problem
still exists. Now the event log table shows only winlogon for each
time that I try to open a folder during the 'dead' time. I guess I
need to determine what winlogon is. Whatever it is, it does not seem
to come up when I open the same folder after the so-called 'dead'
time.

Jethro

Hi Jet,
Run a thorough scan from the links i provided earlier and scan for
malwares
on your computer.

I will do this next.

Winlogon.exe can be both Legitimate and a Viral infections, winlogon.exe
is
the User Authentication to log on the system.

My winlogon is under system32. I looked - found none anywhere else.

Also check this KEY in the Registry and Note the enrties in it:
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion = look in
the
Right Pane/Window for the Entries.

Most everything thereunder are my printers.

If after the Scan nothing found try to run the Hijackthis nd send the
Report
to one of the forums for Analysis.
HTH.
Regards,
nass
----------
www.nasstec.co.uk

Sounds like am eventuality.

Thanks again

J
 
Sorry, typing too fast ... SERVICES.MSC it should be.


It is under Microsoft Management Console>settings (on the right) and
is located at C:\Windows\System32 and that's all. I looked under
ControlPanel>Administrative Services>Services, but CA is not listed
amongst all the apps therunder. The 5-minute freeze at bootup
happened again this AM.
I find nothing (keys?) at all on the left under Winlogon. I think
what should be there may be (from my companion machine):

Credentials
GPExtensions
Notify
WOW
WPAEvents

You have the Notify key there. You did not look far under enough based on
my path I gave you.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\Winlogon\Notify

You have (based on the above list) the Notify key ... what is there?

Jethro said:
Check the following registry key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\Winlogon\Notify

You should have:

crypt32chain
cryptnet
cscdll
ScCertProp
Schedule
sclgntfy
SensLogn
termsrv
WgaLogon
wlballoon

keys under Notify key.

I find nothing (keys?) at all on the left under Winlogon. I think
what should be there may be (from my companion machine):

Credentials
GPExtensions
Notify
WOW
WPAEvents

I wonder where they went, especially Notify
Also check to see if CA was TOTALLY removed by checking SERVICE.MSC
(sometimes they add services and don't remove them).

I don't find 'service.msc' either in the registry or anywhere on the
hard drive.
I would also check all the Run keys in the registry:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

and see if there are any CA entries left.

I don't see any CA entries.

BTW as I was examining the registry I spotted an entry following
Microsoft as Miscrosoft. Strange. Had nothing under it (left or
right). I removed it.

Thanks for helps

Jethro

On Sat, 16 Dec 2006 14:03:01 -0800, nass



:

On Sat, 16 Dec 2006 12:26:01 -0800, nass



:

WXP PRO SP2

The past two days - everytime I boot up XP, I can't do anything for
about 5 minutes while something hidden and unknown to me is
executing.

If I try to execute an app during that time, I get an error window
saying:

Microsoft Visual C++ Runtime Library
Program: c:\windows\explorer.exe
This application has requested the Runtime to terminate it in an
unusual way. Please contact the application's support team for
more
info.

I have no idea what is happening. I have scanned TaskManager, but
see
nothing untoward. I tried killing several apps using Taskmanager,
but
nothing improved.

I am hoping someone can tell me how I can determine what app is
actually causing the problem so I can deal with it

Thanks, I hope

Jethro

Hi Jet,
Adding to NewScience try to scan for malwares and Viruses on your
computer,
this error can be caused with corrupted applications or
mismatched/outdated
Programs on your system.
You can Start with selective/Clean Boot by opening the Run command
and
type
in :
msconfig click [OK] and on the system Configuration Window click on
Start
Up Tab and uncheck some applications/Progams (but not the MS
necessary
ones)
and Reboot and see if you didn't get the error message then try to
renable
all programs one-by-one and see the culprit and uninstall it or
Repair
it.

1- The best is to scan your computer with online scanner from here:
http://www.pandasecurity.com/activescan
http://www.trendmicro.com
And also for malwares from here:
http://www.lavasoft.com/products/ad-aware_se_personal.php
http://www.safer-networking.org ; for Spybot S&D

2= If all fail download the Hijackthis and send the report to one of
many
forums for analysis and troubleshooting:
When all else fails, HijackThis v1.99.1
(http://aumha.org/downloads/hijackthis.zip) is the preferred tool to
use.
It will help you to both identify and remove any hijackware/spyware.
Post
your log to http://aumha.net/viewforum.php?f=30,
http://castlecops.com/forum67.html,
http://forums.subratam.org/index.php?showforum=7, or other
appropriate
forums for expert analysis, not here.
Please perform one step (1,2) at a time and see if that will help
your
issue.
HTH.
Please let us know.
Regards,
nass
----
www.nasstec.co.uk


I'm back - you two.

Well I uninstalled CS Security Suite, and re-booted. The problem
still exists. Now the event log table shows only winlogon for each
time that I try to open a folder during the 'dead' time. I guess I
need to determine what winlogon is. Whatever it is, it does not seem
to come up when I open the same folder after the so-called 'dead'
time.

Jethro

Hi Jet,
Run a thorough scan from the links i provided earlier and scan for
malwares
on your computer.

I will do this next.

Winlogon.exe can be both Legitimate and a Viral infections, winlogon.exe
is
the User Authentication to log on the system.

My winlogon is under system32. I looked - found none anywhere else.

Also check this KEY in the Registry and Note the enrties in it:
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion = look in
the
Right Pane/Window for the Entries.

Most everything thereunder are my printers.

If after the Scan nothing found try to run the Hijackthis nd send the
Report
to one of the forums for Analysis.
HTH.
Regards,
nass
----------
www.nasstec.co.uk

Sounds like am eventuality.

Thanks again

J
 
Back
Top