[SOLVED] ongoing shutdown problem

[cubbycuddly]

I cannot resolve XP not shutting down correctly. It always stops at the "saving your settings" point. I know that this is very much a known problem for XP and I have downloaded the patch on the Microsoft website to solve it but it still the problem persists. Also I have turned off the welcome screen, in a hope to cure it but still it hasn't. Does anyone have any other ideas as to what could be causing it.

thanks

cubbycuddly

 

[~Candy~]

Will it shut down normally from safe mode?

 

[cubbycuddly]

No problems at all when shutting down in safe mode

cubbycuddly

 

[~Candy~]

Ok, let's see what kind of programs you have loading at startup.

Start, run, type msinfo32 and hit ok, go to software, startups, edit, select all, edit, copy and come back and paste.

 

[cubbycuddly]

AVG_CC c:\progra~1\grisoft\avg6\avgcc32.exe /startup All Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Ashampoo PopUpBlocker c:\progra~1\ashampoo\ashamp~1\popupkiller.exe MYCOMPUTER\Owner HKU\S-1-5-21-1123561945-1757981266-725345543-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
CTFMON.EXE c:\windows\system32\ctfmon.exe NT AUTHORITY\SYSTEM HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
CTFMON.EXE c:\windows\system32\ctfmon.exe NT AUTHORITY\LOCAL SERVICE HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
CTFMON.EXE c:\windows\system32\ctfmon.exe NT AUTHORITY\NETWORK SERVICE HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
CTFMON.EXE c:\windows\system32\ctfmon.exe MYCOMPUTER\Owner HKU\S-1-5-21-1123561945-1757981266-725345543-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
CTFMON.EXE c:\windows\system32\ctfmon.exe .DEFAULT HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
DSLAGENTEXE dslagent.exe usb All Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
GSICONEXE gsicon.exe All Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HotKeysCmds c:\windows\system32\hkcmd.exe All Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
IgfxTray c:\windows\system32\igfxtray.exe All Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
MSMSGS "c:\program files\messenger\msmsgs.exe" /background MYCOMPUTER\Owner HKU\S-1-5-21-1123561945-1757981266-725345543-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Microsoft Update msconfg.exe NT AUTHORITY\SYSTEM HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Microsoft Update msconfg.exe MYCOMPUTER\Owner HKU\S-1-5-21-1123561945-1757981266-725345543-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Microsoft Update msconfg.exe .DEFAULT HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Microsoft Update msconfg.exe All Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
NavRegReminder "c:\windows\temp\navbrowser.exe" /r /i "c:\windows\temp\navload.ini" All Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
PCMService "c:\program files\dell\media experience\pcmservice.exe" All Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
QuickTime Task "c:\program files\quicktime\qttask.exe" -atboottime All Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
SmcService c:\progra~1\sygate\spf\smc.exe -startgui All Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
SpywareGuard spywareguard.lnk MYCOMPUTER\Owner Startup
SunJavaUpdateSched c:\program files\java\j2re1.4.2_05\bin\jusched.exe All Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
TkBellExe "c:\program files\common files\real\update_ob\realsched.exe" -osboot All Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
desktop desktop.ini NT AUTHORITY\SYSTEM Startup
desktop desktop.ini MYCOMPUTER\Owner Startup
desktop desktop.ini .DEFAULT Startup
desktop desktop.ini All Users Common Startup


thanks

cubbycuddly

 

[~Candy~]

NavRegReminder "c:\windows\temp\navbrowser.exe" /r /i "c:\windows\temp\navload.ini" All Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
TkBellExe "c:\program files\common files\real\update_ob\realsched.exe" -osboot All Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
QuickTime Task "c:\program files\quicktime\qttask.exe" -atboottime All Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run


Uncheck those three via start, run, msconfig, startup tab, reboot and try to shutdown normally.

 

[cubbycuddly]

it worked a treat!

Thanks
cubbycuddly

 

[~Candy~]

Great. That TkBellExe may put itself back the next time you run Real Player. I'm not sure if that was the MAJOR culprit or not......if it is, you may have to uncheck that one via Real Player startup options.

 

[cubbycuddly]

it has enabled itself again and the problem reoccured so it must be realplayer.

I've been looking to disable it from realplayer but can't find it. I've been looking in preferences.

cubbycuddly

 

[~Candy~]

Download Hijack this, scan and post your log. We'll fix it that way

Save to its own folder, NOT TO DESKTOP or TEMP folder.

http://www.majorgeeks.com/download3155.html

 

[cubbycuddly]

Logfile of HijackThis v1.98.2
Scan saved at 20:51:54, on 09/09/2004
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Sygate\SPF\smc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
C:\PROGRA~1\Grisoft\AVG6\avgserv.exe
C:\WINDOWS\system32\cisvc.exe
C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\dslagent.exe
C:\PROGRA~1\Grisoft\AVG6\avgcc32.exe
C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\Program Files\AOL 9.0c\waol.exe
C:\Program Files\AOL 9.0c\shellmon.exe
C:\Program Files\Common Files\AOL\aoltpspd.exe
C:\Program Files\Overnet\overnet.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\cidaemon.exe
C:\PROGRA~1\Grisoft\AVG6\avgw.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Outlook Express\msimn.exe
C:\Program Files\Messenger\msmsgs.exe
C:\DOCUME~1\OWNER~1.MYC\LOCALS~1\Temp\Temporary Directory 3 for hijackthis.zip\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ask.co.uk/
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: RefresherBand Class - {B24BA06E-FB7B-4757-95C2-DC01125F750E} - C:\PROGRA~1\YREFRE~1\YREFRE~1.DLL
O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\RoboForm.dll
O3 - Toolbar: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [DSLAGENTEXE] dslagent.exe USB
O4 - HKLM\..\Run: [Microsoft Update] msconfg.exe
O4 - HKLM\..\Run: [AVG_CC] C:\PROGRA~1\Grisoft\AVG6\avgcc32.exe /STARTUP
O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKLM\..\RunServices: [Microsoft Update] msconfg.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Microsoft Update] msconfg.exe
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Customize Menu &4 - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
O8 - Extra context menu item: Fill Forms &] - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O8 - Extra context menu item: Save Forms &[ - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file)
O9 - Extra button: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra 'Tools' menuitem: Fill Forms &] - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra button: Save - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra 'Tools' menuitem: Save Forms &[ - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O9 - Extra button: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra 'Tools' menuitem: RF Toolbar &2 - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O16 - DPF: {4E62C4DE-627D-4604-B157-4B7D6B09F02E} (AccountTracking Profile Manager Class) - https://moneymanager.egg.com/Pinsafe/accounttracking.cab
O16 - DPF: {CE3409C4-9E26-4F8E-83E4-778498F9E7B4} (PB_Uploader Class) - http://static.photobox.co.uk/sg/common/uploader.ocx
O17 - HKLM\System\CCS\Services\Tcpip\..\{4B3C7980-C043-42A1-8E7D-FED766D0EA92}: NameServer = 152.163.0.26 205.188.64.153
O17 - HKLM\System\CCS\Services\Tcpip\..\{60E1CA5F-92BB-4AB4-8CF7-10609EE1C6A7}: NameServer = 195.93.51.134

cubbycuddly

 

[~Candy~]

O4 - HKLM\..\RunServices: [Microsoft Update] msconfg.exe
http://www3.ca.com/securityadvisor/virusinfo/virus.aspx?id=39662

Have we scanned for viruses lately?

 

[~Candy~]

Also the real player update isn't there? Did you already fix it?