Solved

Win Min Error upon shutdown

Posted on 2003-11-20
47
63,237 Views
Last Modified: 2013-12-04
I am running Windows XP and a I have started getting a "Win Min Error" every time I shut down.  My homepage always gets reset to one of the cool web search engines and a bunch of junk is added into my Favorites.  I am also getting popups even when I am not running internet.  I believe it is some form of spyware or hijacker.

I use Norton Anti-virus and also spybot S & D but neither one of these has been able to correct the problem.  I have done file searches, disk defrags, and everything else I can think of.

Looking for advice and solutions please, this is too annoying.
0
Comment
Question by:turfman
47 Comments
 
LVL 49

Expert Comment

by:sunray_2003
ID: 9788303
Dear turfman,

try these

Spyware/Adware removal tools:
------------------------------

What is spyware : http://www.spychecker.com/spyware.html

SpyBot-S&D : http://www.webattack.com/download/dlspybot.shtml

Ad-aware : http://www.webattack.com/download/dladaware.shtml

Trojan Remover :http://www.simplysup.com/

HijackThis : http://www.webattack.com/download/dlhijackthis.shtml

KL-Detector  :http://www.webattack.com/download/dlkldetector.shtml

X-Cleaner Free  :http://www.webattack.com/download/dlxcleaner.shtml

SpywareBlaster  :http://www.webattack.com/download/dlspywareblaster.shtml

SpywareGuard :http://www.webattack.com/download/dlspywareguard.shtml

SpySites  :http://www.webattack.com/download/dlspysites.shtml

Keylogger Hunter :http://www.webattack.com/download/dlklhunter.shtml

Spycop: http://www.spycop.com/

Goodbye Spy http://www.topshareware.com/GoodBye-Spy-download-2012.htm

Other spyware removal instructions: http://www.pchell.com/support/click2findnow.shtml


online virus scanner:
---------------------

http://housecall.trendmicro.com/

http://security.symantec.com/

http://www.pandasoftware.com/activescan/com/activescan_principal.htm

http://www.pcpitstop.com/antivirus/default.asp

DOS based : http://www.f-prot.com/download/download_fpdos.html

Pop-up blocker:
---------------

Messenger service: http://www.itc.virginia.edu/desktop/docs/messagepopup/

http://home.rochester.rr.com/artcfox/Pop-Down/

http://www.panicware.com/product_psfree.html

http://zdnet.search.com/search?channel=56&cat=279tag=st.zd.sr.srch.zdnet&q=popup+killer

http://12ghosts.com/ghosts/popup.htm

http://www.webwasher.com/client/home/index.html?lang=de_EN

http://www.adsgone.com/download.asp

Google toolbar: toolbar.google.com



Thanks,
Sunray
0
 
LVL 49

Expert Comment

by:sunray_2003
ID: 9788308
IN pop-up blocker , i have sent check for this messenger service and disable it

Sunray
0
 
LVL 49

Expert Comment

by:sunray_2003
ID: 9788327
>> My homepage always gets reset to one of the cool web search engines -- Possible spyware...

Run Hijackthis and give us the log file.We may be able to help you ...

Sunray
0
 
LVL 49

Expert Comment

by:sunray_2003
ID: 9788343
Check general troubleshooting of xp shutdown

http://www.theeldergeek.com/shutdown_issues_in_xp.htm

Sunray
0
 
LVL 49

Expert Comment

by:sunray_2003
ID: 9788352
0
 
LVL 49

Expert Comment

by:sunray_2003
ID: 9788371
Also try doing Chkdsk and sfc /scannow going to start --> run

Sunray
0
 
LVL 3

Expert Comment

by:Mr_Skinny
ID: 9800330

Look for a file called msupdate or similar in the following location:

C:\Documents and Settings\All Users\Start Menu\Programs\Startup

Delete it if you find it, remove all unwanted favorites and reset home page.

Restart machine.
0
 

Author Comment

by:turfman
ID: 9810143
For Mr_Skinny --
   
I found a file under C:\CABS\WIN98_51.CAB called "msupdate.ocx".  It says it is an Active X control but the last time it was modified was long before I started having the problem.  

Under the location you mentioned I found a shortcut for MS Office and a program called "winlogon".  Access was denied for "winlogon" and  I don't think that would have anything to do with my problem.  Am I correct?
0
 
LVL 3

Expert Comment

by:Mr_Skinny
ID: 9811478
Most likely it is that the winlogon causing it, there are many varieties of this hijacker.  Ive got a url somewhere to a site that describes the different type and how to remove, now if only I can find it!
0
 
LVL 3

Expert Comment

by:Mr_Skinny
ID: 9811536
0
 

Author Comment

by:turfman
ID: 9812482
Mr_ Skinny --

Tried the CWShredder 3 times.  Didn't work though.  Problem still exists.

Thanks anyway
0
 

Author Comment

by:turfman
ID: 9812521
Mr_Skinny --

The file winlogon still exists and I also noticed the file was created very close to the time I started having the problem.  Is there a way to remove a file that denies access to it?  
0
 
LVL 3

Expert Comment

by:Mr_Skinny
ID: 9812548
Right click on the file and choose properties, check that its not set to read ony.
0
 

Author Comment

by:turfman
ID: 9812647
It is not set as read only.  The box "checked" is under advanced attributes and says"...allow Indexing Servce...
0
 

Author Comment

by:turfman
ID: 9812703
I have checked another computer with Windows XP and it has the same file but not the problems.  However, the computers are about the same age and the other one says the file was created over a year ago.  Mine says the file was created about 1 week ago.  Mine also says it was modified about a week ago.  

I am not a comp. whiz but evidently this file is supposed to be on WIndows XP.  I believe mine has been modified with something like a hijacker.  Would there be any problem copying the file from a computer without the problem and replacing the file on my computer with the good copy?

Will it even allow me to do that if it denies access when trying to delete it?
0
 
LVL 3

Expert Comment

by:Mr_Skinny
ID: 9812784
Its supposed to be in the windows\system32 folder.  It wont let you overwrite if its in use.  You may have to boot into dos and delete it from there.
0
 

Author Comment

by:turfman
ID: 9812956
Skinny --

I ran a search and found it in 3 places.  Two are 505KB and one is 19.5KB.  I found it in these locations:

C:\WINDOWS\SYSTEM32

C:\WINDOWS\ServicePackFiles\i386   (These first two are the same size.  Both last modified over a year ago)

C:\Documents and Settings\All Users\Start Menu\Programs\Startup  (this is the small one and says it was last modified a week ago.  I have not knowingly done anything to modify it.  I am not sure what modified it and not the others as well.  I have not recently changed my password or anything that would seem to be a logical change in a file with that name.)
0
 
LVL 3

Accepted Solution

by:
Mr_Skinny earned 125 total points
ID: 9813093

Yeah, the two that are the same are ok.  If you cant delete the other one, try dragging it to the desktop, reboot and then delete the file from the desktop.
0
 

Author Comment

by:turfman
ID: 9813222
Skinny --

Whatever that file was, removing it seemed to do the trick.  I have restarted a couple of times and everything seems to be working fine.  I am not getting the Win Min error.  Ireset my homepage again and removed the junk from the Favorites list and everything has stayed where I left it during the restarts I have done.

Thanks for all the help!  Glad to see there was an easy solution.
0
 
LVL 3

Expert Comment

by:Mr_Skinny
ID: 9813253
Glad to be of help!
0
 

Expert Comment

by:newmancomp22
ID: 9945361
How do I get rid of win min???????
0
 
LVL 3

Expert Comment

by:Mr_Skinny
ID: 9947892
Hi newman,

Have you followed any of the advice above?
0
 

Expert Comment

by:newmancomp22
ID: 9952314
Well there are a lot of advice and plenty of links, but which is most effective?Any further advice?
0
Complete Microsoft Windows PC® & Mac Backup

Backup and recovery solutions to protect all your PCs & Mac– on-premises or in remote locations. Acronis backs up entire PC or Mac with patented reliable disk imaging technology and you will be able to restore workstations to a new, dissimilar hardware in minutes.

 
LVL 3

Expert Comment

by:Mr_Skinny
ID: 9952555

First of all do you have any files in the following location:

C:\Documents and Settings\All Users\Start Menu\Programs\Startup
0
 
LVL 3

Expert Comment

by:Mr_Skinny
ID: 9952600
0
 

Expert Comment

by:newmancomp22
ID: 9953103
There are 8 files under C:\Documents and Settings\All Users\Start Menu\Programs\Startup.
0
 
LVL 3

Expert Comment

by:Mr_Skinny
ID: 9955530
Can you list them for me please?
0
 

Expert Comment

by:newmancomp22
ID: 9959360
Sure:
1)AOL 7.0 Tray Icon
2)hpoddt01.exe
3)hp psc 1000 series
4)Microsoft Office
5)RAMASST
6)Kodak EasyShare Software
7)MSupdate
8)winlogon



0
 
LVL 3

Expert Comment

by:Mr_Skinny
ID: 9962907

MSupdate and winlogon are known to cause this behavior.

1.)Delete any unwanted favorites from IE, set your homepage back to what it should be (if its changed).
2.)Drag msupdate and winlogon to the desktop as you will find that you are unable to delete them from their current location because they are currently in use.
3.)Reboot and delete them from the desktop.
4.)Reboot again, you should now be free of any win min problems.
0
 

Expert Comment

by:newmancomp22
ID: 9967810
I tried what you recommended and it seems to have worked because now I can log off without any problems. However, after I set my homepage back to what it was(several times), it keeps changing. Any idea why this is?Finally, do you have any suggestions as to how I can avoid the win min problems in the future?Thank you
0
 

Expert Comment

by:yigyyo
ID: 10020394
Might I add, if you want to delete it try disabling it forst in your alt ctrl del menu under processes. But you dont want to disable win min, as far as I know its what stops additional pop-ups from occuring.
0
 

Expert Comment

by:LTrojans04
ID: 10318480
I tried all of this and found the winlogon file but I CANT DELETE it and I tried to stop it under ctrl alt del menu and it said that it counld not. I have tried to move it also and it says taht it wont let me.
0
 

Expert Comment

by:yigyyo
ID: 10327917
I found the problem last time..you only have a problem if you have two winlogon.exe  processes in your alt crt del processes menu. Do a search for winlogon.exe and if you have more then one as a result, the 505kb one in your windows\system32 is the real one, do not delete that.
Now the problem file is the one in your C:\Documents and Settings\All Users\Start menu\Programs\Startup directory. first you can try disabling it in your processes menu then deleting it, but chances are it wont work. what I did, is I did a search for a script someone made to disable it, once its disabled, you simply go in the C:\Documents and Settings\All Users\Start Menu\Programs\Startup directory and delete it. As for that, I'm sorry I cant find that script anymore, however, if you know how to start your computer in safe mode, I guess you can simply go to that directory and delete it, then restart your computer and that should work, I've never tried it, but it sounds right.
0
 

Expert Comment

by:the_pongo
ID: 11044951
Hey All,

Yes, I had this friggen thing install itself onto my computer as well.  Experienced many problems, some bigger than the others:

Problems the spyware caused/performed:
 - couldn't logoff cleanly due the process "Win Min"
 - my home page in IE 6.0 got reset to some darn search page
 - a bunch of new Favorites were added
 - (worse) the thing completely cleared my "hosts" file -- this is bad
 - (worst) installed registry entry IEengine  in HKCU\Software\Microsoft\Windows\CurrentVersion\Run which called C:\Program Files\Internet Explorer\IEengine.exe -- this was the cause of all the problems

Resolution
 - removed a "winlogon.exe" which was in "C:\Documents and Settings\All Users\Start Menu\Programs\Startup" (running Windows XP).  I had to kill the process "winlogon.exe" first though -- make sure you chose the correct one!  I just flipped a coin.
 - ran HijackThis.exe which pointed to a bunch of registry files for the new home page and associated unwanted Favorites
 - ran StartupList.exe which directed me to an IEengine.exe -- being started
 - removed the regentry IEengine in HKCU\Software\Microsoft\Windows\CurrentVersion\Run  and the associated program C:\Program Files\Internet Explorer\IEengine.exe
 - rebuilt my hosts file !!!!!


I think that's about it.  I'd love to find the idiot who made that thing.


Todd
0
 

Expert Comment

by:blakepatout
ID: 11112708
Hello all,

I am running win xp pro. and I am having the sam problem that the original person was having.  I am getting the win min "box" at shut down and my homepage keeps changing.  I have looked for the files listed above but my winlogon file has not be modified.  I have run two anti-virus, and an anti-spyware program, but to no avail.  Any help will greatly be appreciated.
0
 

Expert Comment

by:sokolov2
ID: 11121612
Hi Todd,

Thank you so much. I had the same problems but thanks to you it's all working fine again.
IEexplorer.exe was causing this problems.

Give me a call when you find the idiot.
0
 

Expert Comment

by:the_pongo
ID: 11121924
Hey.  Cool beans, I'm glad I was able to help someone.


Todd
0
 

Expert Comment

by:mted
ID: 11128986
Thanks to everyone for the great postings!

I had the same problem on my windows xp computer (win min error).  The file I encounterd though was winlogin (instead of winlogon) in the startup area.  I did the following per the instructions above:
1) dragged winlogin to the desktop and deleted it.
2) ran hijackthis and cleaned the bad references
3) ran start-uplist and found the location of IEengine
4) dragged IEengine to the desktop and purged it
5) looked fine until my next google search and started to have problems again.
6) ran CWShredder which took off 6 IEengine type files
7) reset my start page and deleted the bad "favorites"
8) ran my virus scanner

Everything looks fine now.  I'll keep my fingers crossed that I don't get more problems in the futures.  Thanks again.


0
 

Expert Comment

by:mted
ID: 11129059
Almost forgot....  

9)  went to the microsoft website and installed all the security updates.  I think service pack 1 is the key one to helping prevent future problems, but one should probably install all of them.

Later.
0
 

Expert Comment

by:tyronepoo
ID: 11132984
Hey all

Im running on a Win2k machine. I have this win min problem as well, but none of the registry entries you guys are referring to. This is a computer I borrowed too so Im pulling my hair out to fix it. Adding to that, this computer is in Japanese so I cant read a lot of the menus   (:  

Any other suggestions? Will it be long until a program becomes available to fix it with two clicks, or will something else like Ad-Aware address it at some stage? I have found a lot of new posts on various forums about this one.

Thanks, Tyrone
0
 

Expert Comment

by:tompease2000and1
ID: 11159623
Thanks to everyone who helped with this, I've been trying to deal with win min on a friends computer. poor guy's running win95, but hopefully all  your recommendations will work just as well. Keep up the good work.

Thanks, Tom
0
 

Expert Comment

by:tompease2000and1
ID: 11192353
Unfortunately things have got worse. The day I posted the previous comment i had seen both winlogin and IEengine on the computer. When i went round the next day with HijackThis, etc. both had disappeared without trace, it's very strange. I removed the www.yoursearcher.com registry entries but after a restart they were back. Clearly there is something working in the background but none of the programs i tried could find it and neither could I manually.
If anybody has experienced win min et al. on windows 95 and has any advice i would be most grateful :)

thanks, Tom
0
 

Expert Comment

by:Phinz12398
ID: 11204333
OK, so i got the freakin homepage to stay put by using hijackthis and getting rid of the IEengine.exe file that was playing games with my homepage, but i still can't get the WIN MIN not responding box to go away at shutdown. I'm in XP Pro and have searched for the winlogon.exe files and have the only one, 505k that is the good one. Can you help?
0
 

Expert Comment

by:the_pongo
ID: 11204679
hey Phinz,

look at your processes -- do you have two winlogon.exe's running?  if you do, then you have rogue process in operation, thus the Win Min problem.

let me know.


todd
0
 

Expert Comment

by:mted
ID: 11228686
just curious...

is anyone having problems with an iexplorer.exe application?  i think mine is infected with something as it uses 100% of my CPU and really slows things down....  i previously had a problem with the win min error and am wondering if this may be related.   i may have to post this on another page....  let me know if anyone has any suggestions.

regards.
0
 

Expert Comment

by:mted
ID: 11229932
by the way,

if i block iexplorer.exe from accessiing the internet with my firewall i don't seem to have problems with overload on my cpu...
0
 

Expert Comment

by:gendaiblade
ID: 12599210
As a side note, I had many of the same symptoms above. The most notable being that my IE6 homepage was hijacked to "my-searcher.com". I also had approx 4 new favorites added to my favorites list. Pest patrol found nothing, Spybot S&D didn't find the culprit so I ran HiJackThis which found the links in my favorites as well as some reg entries. But never fixed the problem as they would all come back after a reboot.

After reading above I decided to take a look at the startup file under "All Users" There I found an interesting shortcut called dlg.exe. This shortcut was linked to C://Program Files/Digital Line Detect, once I pulled the shortcut out of the startup folder to my desktop, ran HiJackThis, fixed and rebooted did I get my homepage back as well as the links in my favorites did not respawn.

So keep an eye out for DLG.exe on your system as it might be the root cause.

Gendai
0

Featured Post

Comprehensive Backup Solutions for Microsoft

Acronis protects the complete Microsoft technology stack: Windows Server, Windows PC, laptop and Surface data; Microsoft business applications; Microsoft Hyper-V; Azure VMs; Microsoft Windows Server 2016; Microsoft Exchange 2016 and SQL Server 2016.

Join & Write a Comment

In a recent article here at Experts Exchange (http://www.experts-exchange.com/articles/18880/PaperPort-14-in-Windows-10-A-First-Look.html), I discussed my nine-month sandbox testing of the Windows 10 Technical Preview, specifically with respect to r…
OfficeMate Freezes on login or does not load after login credentials are input.
Internet Business Fax to Email Made Easy - With eFax Corporate (http://www.enterprise.efax.com), you'll receive a dedicated online fax number, which is used the same way as a typical analog fax number. You'll receive secure faxes in your email, fr…
This video shows how to remove a single email address from the Outlook 2010 Auto Suggestion memory. NOTE: For Outlook 2016 and 2013 perform the exact same steps. Open a new email: Click the New email button in Outlook. Start typing the address: …

744 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

11 Experts available now in Live!

Get 1:1 Help Now