Win Min Error upon shutdown

IN pop-up blocker , i have sent check for this messenger service and disable it

Sunray

>> My homepage always gets reset to one of the cool web search engines -- Possible spyware...

Run Hijackthis and give us the log file.We may be able to help you ...

Sunray

Check general troubleshooting of xp shutdown

http://www.theeldergeek.com/shutdown_issues_in_xp.htm

Sunray

http://aumha.org/win5/a/shtdwnxp.php

Sunray

Also try doing Chkdsk and sfc /scannow going to start --> run

Sunray

Look for a file called msupdate or similar in the following location:

C:\Documents and Settings\All Users\Start Menu\Programs\Startup

Delete it if you find it, remove all unwanted favorites and reset home page.

Restart machine.

For Mr_Skinny --
   
I found a file under C:\CABS\WIN98_51.CAB called "msupdate.ocx".  It says it is an Active X control but the last time it was modified was long before I started having the problem.  

Under the location you mentioned I found a shortcut for MS Office and a program called "winlogon".  Access was denied for "winlogon" and  I don't think that would have anything to do with my problem.  Am I correct?

Most likely it is that the winlogon causing it, there are many varieties of this hijacker.  Ive got a url somewhere to a site that describes the different type and how to remove, now if only I can find it!

Here it is : http://www.spywareinfo.com/~merijn/cwschronicles.html

Mr_ Skinny --

Tried the CWShredder 3 times.  Didn't work though.  Problem still exists.

Thanks anyway

Mr_Skinny --

The file winlogon still exists and I also noticed the file was created very close to the time I started having the problem.  Is there a way to remove a file that denies access to it?  

Right click on the file and choose properties, check that its not set to read ony.

It is not set as read only.  The box "checked" is under advanced attributes and says"...allow Indexing Servce...

I have checked another computer with Windows XP and it has the same file but not the problems.  However, the computers are about the same age and the other one says the file was created over a year ago.  Mine says the file was created about 1 week ago.  Mine also says it was modified about a week ago.  

I am not a comp. whiz but evidently this file is supposed to be on WIndows XP.  I believe mine has been modified with something like a hijacker.  Would there be any problem copying the file from a computer without the problem and replacing the file on my computer with the good copy?

Will it even allow me to do that if it denies access when trying to delete it?

Its supposed to be in the windows\system32 folder.  It wont let you overwrite if its in use.  You may have to boot into dos and delete it from there.

Skinny --

I ran a search and found it in 3 places.  Two are 505KB and one is 19.5KB.  I found it in these locations:

C:\WINDOWS\SYSTEM32

C:\WINDOWS\ServicePackFiles\i386   (These first two are the same size.  Both last modified over a year ago)

C:\Documents and Settings\All Users\Start Menu\Programs\Startup  (this is the small one and says it was last modified a week ago.  I have not knowingly done anything to modify it.  I am not sure what modified it and not the others as well.  I have not recently changed my password or anything that would seem to be a logical change in a file with that name.)

Skinny --

Whatever that file was, removing it seemed to do the trick.  I have restarted a couple of times and everything seems to be working fine.  I am not getting the Win Min error.  Ireset my homepage again and removed the junk from the Favorites list and everything has stayed where I left it during the restarts I have done.

Thanks for all the help!  Glad to see there was an easy solution.

Glad to be of help!

How do I get rid of win min???????

Hi newman,

Have you followed any of the advice above?

Well there are a lot of advice and plenty of links, but which is most effective?Any further advice?

First of all do you have any files in the following location:

C:\Documents and Settings\All Users\Start Menu\Programs\Startup

Also try this http://www.spywareinfo.com/~merijn/cwschronicles.html

There are 8 files under C:\Documents and Settings\All Users\Start Menu\Programs\Startup.

Can you list them for me please?

Sure:
1)AOL 7.0 Tray Icon
2)hpoddt01.exe
3)hp psc 1000 series
4)Microsoft Office
5)RAMASST
6)Kodak EasyShare Software
7)MSupdate
8)winlogon

MSupdate and winlogon are known to cause this behavior.

1.)Delete any unwanted favorites from IE, set your homepage back to what it should be (if its changed).
2.)Drag msupdate and winlogon to the desktop as you will find that you are unable to delete them from their current location because they are currently in use.
3.)Reboot and delete them from the desktop.
4.)Reboot again, you should now be free of any win min problems.

I tried what you recommended and it seems to have worked because now I can log off without any problems. However, after I set my homepage back to what it was(several times), it keeps changing. Any idea why this is?Finally, do you have any suggestions as to how I can avoid the win min problems in the future?Thank you

Might I add, if you want to delete it try disabling it forst in your alt ctrl del menu under processes. But you dont want to disable win min, as far as I know its what stops additional pop-ups from occuring.

I tried all of this and found the winlogon file but I CANT DELETE it and I tried to stop it under ctrl alt del menu and it said that it counld not. I have tried to move it also and it says taht it wont let me.

I found the problem last time..you only have a problem if you have two winlogon.exe  processes in your alt crt del processes menu. Do a search for winlogon.exe and if you have more then one as a result, the 505kb one in your windows\system32 is the real one, do not delete that.
Now the problem file is the one in your C:\Documents and Settings\All Users\Start menu\Programs\Startup directory. first you can try disabling it in your processes menu then deleting it, but chances are it wont work. what I did, is I did a search for a script someone made to disable it, once its disabled, you simply go in the C:\Documents and Settings\All Users\Start Menu\Programs\Startup directory and delete it. As for that, I'm sorry I cant find that script anymore, however, if you know how to start your computer in safe mode, I guess you can simply go to that directory and delete it, then restart your computer and that should work, I've never tried it, but it sounds right.

Hey All,

Yes, I had this friggen thing install itself onto my computer as well.  Experienced many problems, some bigger than the others:

Problems the spyware caused/performed:
 - couldn't logoff cleanly due the process "Win Min"
 - my home page in IE 6.0 got reset to some darn search page
 - a bunch of new Favorites were added
 - (worse) the thing completely cleared my "hosts" file -- this is bad
 - (worst) installed registry entry IEengine  in HKCU\Software\Microsoft\Windows\CurrentVersion\Run which called C:\Program Files\Internet Explorer\IEengine.exe -- this was the cause of all the problems

Resolution
 - removed a "winlogon.exe" which was in "C:\Documents and Settings\All Users\Start Menu\Programs\Startup" (running Windows XP).  I had to kill the process "winlogon.exe" first though -- make sure you chose the correct one!  I just flipped a coin.
 - ran HijackThis.exe which pointed to a bunch of registry files for the new home page and associated unwanted Favorites
 - ran StartupList.exe which directed me to an IEengine.exe -- being started
 - removed the regentry IEengine in HKCU\Software\Microsoft\Windows\CurrentVersion\Run  and the associated program C:\Program Files\Internet Explorer\IEengine.exe
 - rebuilt my hosts file !!!!!


I think that's about it.  I'd love to find the idiot who made that thing.


Todd

Hello all,

I am running win xp pro. and I am having the sam problem that the original person was having.  I am getting the win min "box" at shut down and my homepage keeps changing.  I have looked for the files listed above but my winlogon file has not be modified.  I have run two anti-virus, and an anti-spyware program, but to no avail.  Any help will greatly be appreciated.

Hi Todd,

Thank you so much. I had the same problems but thanks to you it's all working fine again.
IEexplorer.exe was causing this problems.

Give me a call when you find the idiot.

Hey.  Cool beans, I'm glad I was able to help someone.


Todd

Thanks to everyone for the great postings!

I had the same problem on my windows xp computer (win min error).  The file I encounterd though was winlogin (instead of winlogon) in the startup area.  I did the following per the instructions above:
1) dragged winlogin to the desktop and deleted it.
2) ran hijackthis and cleaned the bad references
3) ran start-uplist and found the location of IEengine
4) dragged IEengine to the desktop and purged it
5) looked fine until my next google search and started to have problems again.
6) ran CWShredder which took off 6 IEengine type files
7) reset my start page and deleted the bad "favorites"
8) ran my virus scanner

Everything looks fine now.  I'll keep my fingers crossed that I don't get more problems in the futures.  Thanks again.

Almost forgot....  

9)  went to the microsoft website and installed all the security updates.  I think service pack 1 is the key one to helping prevent future problems, but one should probably install all of them.

Later.

Hey all

Im running on a Win2k machine. I have this win min problem as well, but none of the registry entries you guys are referring to. This is a computer I borrowed too so Im pulling my hair out to fix it. Adding to that, this computer is in Japanese so I cant read a lot of the menus   (:  

Any other suggestions? Will it be long until a program becomes available to fix it with two clicks, or will something else like Ad-Aware address it at some stage? I have found a lot of new posts on various forums about this one.

Thanks, Tyrone

Thanks to everyone who helped with this, I've been trying to deal with win min on a friends computer. poor guy's running win95, but hopefully all  your recommendations will work just as well. Keep up the good work.

Thanks, Tom

Unfortunately things have got worse. The day I posted the previous comment i had seen both winlogin and IEengine on the computer. When i went round the next day with HijackThis, etc. both had disappeared without trace, it's very strange. I removed the www.yoursearcher.com registry entries but after a restart they were back. Clearly there is something working in the background but none of the programs i tried could find it and neither could I manually.
If anybody has experienced win min et al. on windows 95 and has any advice i would be most grateful :)

thanks, Tom

OK, so i got the freakin homepage to stay put by using hijackthis and getting rid of the IEengine.exe file that was playing games with my homepage, but i still can't get the WIN MIN not responding box to go away at shutdown. I'm in XP Pro and have searched for the winlogon.exe files and have the only one, 505k that is the good one. Can you help?

hey Phinz,

look at your processes -- do you have two winlogon.exe's running?  if you do, then you have rogue process in operation, thus the Win Min problem.

let me know.


todd

just curious...

is anyone having problems with an iexplorer.exe application?  i think mine is infected with something as it uses 100% of my CPU and really slows things down....  i previously had a problem with the win min error and am wondering if this may be related.   i may have to post this on another page....  let me know if anyone has any suggestions.

regards.

by the way,

if i block iexplorer.exe from accessiing the internet with my firewall i don't seem to have problems with overload on my cpu...