Re: Re: RE: New Error When I Start

Tech-Archive recommends: Repair Windows Errors & Optimize Windows Performance

Check the following registry key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\Winlogon\Notify

You should have:

crypt32chain
cryptnet
cscdll
ScCertProp
Schedule
sclgntfy
SensLogn
termsrv
WgaLogon
wlballoon

keys under Notify key.

Also check to see if CA was TOTALLY removed by checking SERVICE.MSC
(sometimes they add services and don't remove them).

I would also check all the Run keys in the registry:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

and see if there are any CA entries left.

"Jethro" <Wilson@xxxxxxxxxxxxx> wrote in message
news:p209o2lj6tlmm7l1v015cfel6qf9i2mrrt@xxxxxxxxxx
On Sat, 16 Dec 2006 14:03:01 -0800, nass
<nass@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote:



"Jethro" wrote:

On Sat, 16 Dec 2006 12:26:01 -0800, nass
<nass@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote:



"Jethro" wrote:

WXP PRO SP2

The past two days - everytime I boot up XP, I can't do anything for
about 5 minutes while something hidden and unknown to me is
executing.

If I try to execute an app during that time, I get an error window
saying:

Microsoft Visual C++ Runtime Library
Program: c:\windows\explorer.exe
This application has requested the Runtime to terminate it in an
unusual way. Please contact the application's support team for more
info.

I have no idea what is happening. I have scanned TaskManager, but
see
nothing untoward. I tried killing several apps using Taskmanager,
but
nothing improved.

I am hoping someone can tell me how I can determine what app is
actually causing the problem so I can deal with it

Thanks, I hope

Jethro

Hi Jet,
Adding to NewScience try to scan for malwares and Viruses on your
computer,
this error can be caused with corrupted applications or
mismatched/outdated
Programs on your system.
You can Start with selective/Clean Boot by opening the Run command and
type
in :
msconfig click [OK] and on the system Configuration Window click on
Start
Up Tab and uncheck some applications/Progams (but not the MS necessary
ones)
and Reboot and see if you didn't get the error message then try to
renable
all programs one-by-one and see the culprit and uninstall it or Repair
it.

1- The best is to scan your computer with online scanner from here:
http://www.pandasecurity.com/activescan
http://www.trendmicro.com
And also for malwares from here:
http://www.lavasoft.com/products/ad-aware_se_personal.php
http://www.safer-networking.org ; for Spybot S&D

2= If all fail download the Hijackthis and send the report to one of
many
forums for analysis and troubleshooting:
When all else fails, HijackThis v1.99.1
(http://aumha.org/downloads/hijackthis.zip) is the preferred tool to
use.
It will help you to both identify and remove any hijackware/spyware.
Post
your log to http://aumha.net/viewforum.php?f=30,
http://castlecops.com/forum67.html,
http://forums.subratam.org/index.php?showforum=7, or other appropriate
forums for expert analysis, not here.
Please perform one step (1,2) at a time and see if that will help your
issue.
HTH.
Please let us know.
Regards,
nass
----
www.nasstec.co.uk


I'm back - you two.

Well I uninstalled CS Security Suite, and re-booted. The problem
still exists. Now the event log table shows only winlogon for each
time that I try to open a folder during the 'dead' time. I guess I
need to determine what winlogon is. Whatever it is, it does not seem
to come up when I open the same folder after the so-called 'dead'
time.

Jethro

Hi Jet,
Run a thorough scan from the links i provided earlier and scan for
malwares
on your computer.

I will do this next.

Winlogon.exe can be both Legitimate and a Viral infections, winlogon.exe
is
the User Authentication to log on the system.

My winlogon is under system32. I looked - found none anywhere else.

Also check this KEY in the Registry and Note the enrties in it:
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion = look in
the
Right Pane/Window for the Entries.

Most everything thereunder are my printers.

If after the Scan nothing found try to run the Hijackthis nd send the
Report
to one of the forums for Analysis.
HTH.
Regards,
nass
----------
www.nasstec.co.uk

Sounds like am eventuality.

Thanks again

J


.

Relevant Pages

  • Re: Winlogon is not logging events in event viewer
    ... Have you done the same tests on other XP workstations? ... import the Winlogon registry key from a working computer to see whether it ... |> If the file system type of the volume which you'd like to check is NTFS, ...
    (microsoft.public.windowsxp.help_and_support)
  • Re: Winlogon is not logging events in event viewer
    ... Have you done the same tests on other XP workstations? ... import the Winlogon registry key from a working computer to see whether it ... |> screen of checking file system before you logon. ...
    (microsoft.public.windowsxp.help_and_support)
  • is win32cfg.exe nasty?
    ... was winlogon which was hogging most of my resources. ... found an entry for Shell for which the value was "explorer.exe win32cfg.exe". ... entry in my RunOnce registry key named MS38495 for which the value was ...
    (microsoft.public.win2000.security)
  • Re: FileError_22001 Fix
    ... You are actually replying to the OP. ... Judging by some of the successful malware ... to a registry key - to get a filename - and delete both the file and the key ... I cannot vouch for any information found in such "forums". ...
    (microsoft.public.security.virus)
  • Re: Rundll error after deleting spyware
    ... but you need to remove the registry key that is executing it. ... Go to Start, Run, and type regedit and hit OK. ... An alternative method is to download HijackThis at ... Hit Fix Checked and close HijackThis and reboot. ...
    (microsoft.public.windowsxp.perform_maintain)