Forum Home
Press F1
 
Thread ID: 40717 2003-12-15 21:33:00 Windows XP Shutdown problem Pepper2 (4123) Press F1
Post ID Timestamp Content User
200911 2003-12-15 21:33:00 Please forgive me for a rather long explanation of my problem .

I have Windows XP running on an Athlon XP 3000 .

My computer has gone very well over the last six months and it has been protected by AV6 antivirus and Zonealarm . Recently I have received some Christmas Ecards with animation and the first one I received would not play the associated music . After that sound could be reinstated by turning the computer fully off and on again . The next time I tried another ecard I got the same result – loss of sound .

Within about 24 hours of the second ecard I found that the computer would not turn off to standby properly especially when the standby mode was selected . I restored the computer to the 6th December (a date prior to the first ecard) and this did not improve things .

The next problem I encountered was a difficult connection to the internet – slow connect and hangup with IE6 . I reinstalled IE6 but no change .

In desperation I uninstalled Zonealarm and most of my problems have disappeared . Internet connections restored to their former speed, etc . However I still have the problem of the shutdown options . I can only shutdown successfully using the “Turnoff” . If I use standby when I press the power button the computer starts but no video signal . Turn the computer off and then on (after a short time lapse) at the wall and press the power switch and it starts normally .

Do I have a virus? I do not suspect Zonealarm but rather that it was corrupted . Any suggestions would be welcomed .

Also “What is the difference between standby and hibernation?” This may seem like a dumb question but switching these facilities off and on may affect the startup routine .
Than you 		Pepper2 (4123)
200912 2003-12-15 22:04:00 A well detailed explanation, its a pleasure to see it on the forum.

I would suggest running either AdAware or Spybot Search & Destroy.
These are free applications, and a quick look on Google will give you download locations.

While Antivirus and firewall cover most things, some spyware and adware can cause problems. These are not detected by AV software.

Standby effectively closes the PC down to a non-functional low power "off" state, while hibernate is similar but actually (tries to) save all running applications to RAM, and resumes them when woken as if they had never halted.

Trouble is, not all applications like this activity and its common to have problems after hibernation. or the PC will not wake from hibernation due to the application having died in its sleep.

These functions work better on laptops, which are designed more to suit them, but some major PC makers simply don't advise them for desktop systems. Using them on any of my desktop systems does cause problems, so I never do. 		godfather (25)
200913 2003-12-15 22:23:00 To be a little clearer, hibernate actually shuts down the PC, but when resumed all applications are resumed where they were when shut down. godfather (25)
200914 2003-12-16 00:28:00 Thank you for your suggestion.

I downloaded AdAware and run the programme.

6 Objects were listed and the following is now in my quarantine file:
Alexa (RegKey)
Win32.Blaster (RegData)
2 Tracking Cookies
One other cookie
(Thats only 5!!)

There seems to be no change to the shutdown procedure but it is early days yet. 		Pepper2 (4123)
200915 2003-12-16 01:14:00 Alexa is from Internet Explorer,

Win32.Blaster that's a virus and the Registry information seems to be removed but what about the virus itself?

2 Tracking Cookies, most common type of cookies around the web tracking users.

So how is your antivirus? 		Kame (312)
200916 2003-12-16 01:35:00 I had a similar experience from a Christmas card. The Virus was "Pretty Park". It creates a file called "Files32.VXD" in the system folder. This file filters everything that is going on, the computer becomes very sluggish & takes ages to respond.
Have a look at this:-
Pretty Park Virus Fix

Manual removal instructions:
On the Windows taskbar, click Start > Run.
Type REGEDIT, then click OK.
Modify the following Registry value:
HKEY_LOCAL_MACHINE\SOFTWARE\
Classes\exefile\shell\open\command
and change
files32.vxd "%1" %*
to
"%1" %*
For clarity, these seven characters are the following: double quote, percent sign, the numeral one, double quote, space, percent sign, and asterisk. Don't forget the space.
Delete the PrettyPark.exe file.
Restart your computer.
Using Windows Explorer delete the \Windows\System\Files32.vxd file. 		Mzee (158)
200917 2003-12-16 01:41:00 My Card was calles "Pretty Park.exe" yours may be something else. Look for "Files32.vxd" in system folder.

You could also have a look for a "blaster" worm:-

press ctrl+shift+esc to open task manager
(right mouse on task bar in XP)
go to PROCESSES tab
find MBLAST.EXE
SELECT and end procesesses.

Start >run . type REGEDID
HKEY_LOCAL MACHINE>SOFTWARE>MICROSOFT>WINDOWS>CURRENT VERSION>RUN. in right panel delete MBLAST.EXE (if it's there) then close Registry Editor. If it's not there, you're not infected !!!! 		Mzee (158)
200918 2003-12-16 07:15:00 Thank you folks.

KAME - should I restore Alexa?

MZEE - I have done all the checks that you advocated and there is no sign of files32.vxd or PrettyPark.exe or Mblast.exe. So no modifications to the Registry were made.

I am using AV6 and I have kept it up to date. In the past it has detected incoming virus activity/files and quarantined them. I am sure that the Blaster virus was one of them but that was some time ago and i could be wrong. I did a full system check yesterday using AV6 and no viruses were detected. 		Pepper2 (4123)
1