virus scanner hangs system after login

[Christian Barmala]

Hi,

I boot up my system
- Immediately when the login screen appears, I log in as a regular user,
not as an Administrator
- The virusscanner splash screen appears, but does not disappear any more
- I get a normal mouse courson on the screen, but as soon as I move the
mouse over the task bar or the start button, it becomes a wait cursor
(sand dial)
- Most times I cannot even invoke the task manager and if I can, I
cannot kill any task or reboot the system
- The only thing that helps is to power cycle.

This (usually) does not occur if
- I log in as Administrator
- I wait about 2 minutes after the login screen appears and before I log in

I observe this behavior on two systems:
- A laptop with Windows XP 32 bit, Windows XP firewall and McAfee
Virusscan (the McAfee symbol appears dashed in the task bar)
- A desktop with Windows XP 64 bit Nvidia ActiveArmor firewall and NOD32
(the splash screen does not disappear)

The operating system on both systems is updated from
windowsupdate.microsoft.com, and the virusscanner has the latest updates
too.

Did anyone observe a similar behavior?

Christian

 

[Dave Patrick]

Check Event Viewer for errors. You may want to get in touch with McAfee tech
support.

--

Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect

| Hi,
|
| I boot up my system
| - Immediately when the login screen appears, I log in as a regular user,
| not as an Administrator
| - The virusscanner splash screen appears, but does not disappear any more
| - I get a normal mouse courson on the screen, but as soon as I move the
| mouse over the task bar or the start button, it becomes a wait cursor
| (sand dial)
| - Most times I cannot even invoke the task manager and if I can, I
| cannot kill any task or reboot the system
| - The only thing that helps is to power cycle.
|
| This (usually) does not occur if
| - I log in as Administrator
| - I wait about 2 minutes after the login screen appears and before I log
in
|
| I observe this behavior on two systems:
| - A laptop with Windows XP 32 bit, Windows XP firewall and McAfee
| Virusscan (the McAfee symbol appears dashed in the task bar)
| - A desktop with Windows XP 64 bit Nvidia ActiveArmor firewall and NOD32
| (the splash screen does not disappear)
|
| The operating system on both systems is updated from
| windowsupdate.microsoft.com, and the virusscanner has the latest updates
| too.
|
| Did anyone observe a similar behavior?
|
| Christian

 

[David H. Lipman]

From: "Dave Patrick" <[email protected]>

| Check Event Viewer for errors. You may want to get in touch with McAfee tech
| support.
|

And the McAfee Forums is the place to start...

http://forums.mcafeehelp.com/index.php

 

[Christian Barmala]

In order to make sure I catch the relevant entries I proceeded as follows:
- log in as administrator
- clear all events
- log out
- log in as user
- system hangs
- power cycle
- log in as administrator
- start | control panel | administrative tools | Event viewer

It displayed:
Application
Security Center
The description for Event ID ( 1800 ) in Source ( SecurityCenter )
cannot be found. The local computer may not have the necessary
registry information or message DLL files to display messages from a
remote computer. You may be able to use the /AUXSOURCE= flag to
retrieve this description; see Help and Support for details. The
following information is part of the event: .
ForceWare Intelligent Application Manager (IAM)
The description for Event ID ( 0 ) in Source ( ForceWare Intelligent
Application Manager (IAM) ) cannot be found. The local computer may
not have the necessary registry information or message DLL files to
display messages from a remote computer. You may be able to use the
/AUXSOURCE= flag to retrieve this description; see Help and Support
for details. The following information is part of the event: Service
started.
Event System
The EventSystem sub system is suppressing duplicate event log
entries for a duration of 86400 seconds. The suppression timeout
can be controlled by a REG_DWORD value named
SuppressDuplicateDuration under the following registry key:
HKLM\Software\Microsoft\EventSystem\EventLog. For more information,
see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Security
Multiple messages about my login/logout activity
System
25 times "Information" about various services starting
1 "Warining" that my 2nd NIC, cannot get an IP address via DHCP.
This shouldn't be a problem, since the primary NIC has a working
Internet connection.

Does this tell you anything?

And the McAfee Forums (http://forums.mcafeehelp.com/index.php) is the place to start...

Since similart symptoms occur on two systems only one of which has
McAfee installed, I doubt't it's a McAffee issue. I cannot even tell for
sure if it has to do anything with the virusscanner or if the
virusscanner is just the "victim" or more precisely, the visible symptom
of another cause.


Christian

 

[David H. Lipman]

From: "Christian Barmala" <[email protected]>

|
| In order to make sure I catch the relevant entries I proceeded as follows:
| - log in as administrator
| - clear all events
| - log out
| - log in as user
| - system hangs
| - power cycle
| - log in as administrator
| - start | control panel | administrative tools | Event viewer
|
| It displayed:
| Application
| Security Center
| The description for Event ID ( 1800 ) in Source ( SecurityCenter )
| cannot be found. The local computer may not have the necessary
| registry information or message DLL files to display messages from a
| remote computer. You may be able to use the /AUXSOURCE= flag to
| retrieve this description; see Help and Support for details. The
| following information is part of the event: .
| ForceWare Intelligent Application Manager (IAM)
| The description for Event ID ( 0 ) in Source ( ForceWare Intelligent
| Application Manager (IAM) ) cannot be found. The local computer may
| not have the necessary registry information or message DLL files to
| display messages from a remote computer. You may be able to use the
| /AUXSOURCE= flag to retrieve this description; see Help and Support
| for details. The following information is part of the event: Service
| started.
| Event System
| The EventSystem sub system is suppressing duplicate event log
| entries for a duration of 86400 seconds. The suppression timeout
| can be controlled by a REG_DWORD value named
| SuppressDuplicateDuration under the following registry key:
| HKLM\Software\Microsoft\EventSystem\EventLog. For more information,
| see Help and Support Center at
| http://go.microsoft.com/fwlink/events.asp.
| Security
| Multiple messages about my login/logout activity
| System
| 25 times "Information" about various services starting
| 1 "Warining" that my 2nd NIC, cannot get an IP address via DHCP.
| This shouldn't be a problem, since the primary NIC has a working
| Internet connection.
|
| Does this tell you anything?
||
| Since similart symptoms occur on two systems only one of which has
| McAfee installed, I doubt't it's a McAffee issue. I cannot even tell for
| sure if it has to do anything with the virusscanner or if the
| virusscanner is just the "victim" or more precisely, the visible symptom
| of another cause.
|
| Christian

I'm sorry I can't provide further assistance :-(

 

[Dave Patrick]

Simply means the developer provided a means to write to the event log, but
didn't provide a description for this event.

This link may help.

http://support.dell.com/support/topics/global.aspx/support/kb/en/document?DN=1074668

The second one indicates the service successfully started.

The third will go away when you fix the former.

--

Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect

:
| In order to make sure I catch the relevant entries I proceeded as follows:
| - log in as administrator
| - clear all events
| - log out
| - log in as user
| - system hangs
| - power cycle
| - log in as administrator
| - start | control panel | administrative tools | Event viewer
|
| It displayed:
| Application
| Security Center
| The description for Event ID ( 1800 ) in Source ( SecurityCenter )
| cannot be found. The local computer may not have the necessary
| registry information or message DLL files to display messages from a
| remote computer. You may be able to use the /AUXSOURCE= flag to
| retrieve this description; see Help and Support for details. The
| following information is part of the event: .
| ForceWare Intelligent Application Manager (IAM)
| The description for Event ID ( 0 ) in Source ( ForceWare Intelligent
| Application Manager (IAM) ) cannot be found. The local computer may
| not have the necessary registry information or message DLL files to
| display messages from a remote computer. You may be able to use the
| /AUXSOURCE= flag to retrieve this description; see Help and Support
| for details. The following information is part of the event: Service
| started.
| Event System
| The EventSystem sub system is suppressing duplicate event log
| entries for a duration of 86400 seconds. The suppression timeout
| can be controlled by a REG_DWORD value named
| SuppressDuplicateDuration under the following registry key:
| HKLM\Software\Microsoft\EventSystem\EventLog. For more information,
| see Help and Support Center at
| http://go.microsoft.com/fwlink/events.asp.
| Security
| Multiple messages about my login/logout activity
| System
| 25 times "Information" about various services starting
| 1 "Warining" that my 2nd NIC, cannot get an IP address via DHCP.
| This shouldn't be a problem, since the primary NIC has a working
| Internet connection.
|
| Does this tell you anything?
| Since similart symptoms occur on two systems only one of which has
| McAfee installed, I doubt't it's a McAffee issue. I cannot even tell for
| sure if it has to do anything with the virusscanner or if the
| virusscanner is just the "victim" or more precisely, the visible symptom
| of another cause.
|
|
| Christian

 

[Christian Barmala]

Christian Barmala wrote

McAfee installed, I doubt't it's a McAffee issue.

Simply means the developer provided a means to write to the event log, but
didn't provide a description for this event.
This link may help.
http://support.dell.com/support/topics/global.aspx/support/kb/en/document?DN=1074668

The URL links to "How do I Contact McAfee for Dell SecurityCenter
Support?" I cannot see the relation to the event viewer output.

Christian

 

[Dave Patrick]

Take a look at the source for Event ID 1800

--

Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect

:
I cannot see the relation to the event viewer output.
|
| Christian

 

[Rock]

Hi,

I boot up my system
- Immediately when the login screen appears, I log in as a regular user,
not as an Administrator
- The virusscanner splash screen appears, but does not disappear any more
- I get a normal mouse courson on the screen, but as soon as I move the
mouse over the task bar or the start button, it becomes a wait cursor
(sand dial)
- Most times I cannot even invoke the task manager and if I can, I
cannot kill any task or reboot the system
- The only thing that helps is to power cycle.

This (usually) does not occur if
- I log in as Administrator
- I wait about 2 minutes after the login screen appears and before I log in

I observe this behavior on two systems:
- A laptop with Windows XP 32 bit, Windows XP firewall and McAfee
Virusscan (the McAfee symbol appears dashed in the task bar)
- A desktop with Windows XP 64 bit Nvidia ActiveArmor firewall and NOD32
(the splash screen does not disappear)

The operating system on both systems is updated from
windowsupdate.microsoft.com, and the virusscanner has the latest updates
too.

Did anyone observe a similar behavior?

Christian

Do some clean boot troubleshooting to see what program is causing the
problem.

How to Troubleshoot By Using the Msconfig Utility in Windows XP
http://support.microsoft.com/?id=310560

How to perform advanced clean-boot troubleshooting in Windows XP
http://support.microsoft.com/?id=316434