end program/registry errors on shutdown

[mcmnky]

Howdy,

I recently installed Internet Security 5 on my father-in-law's 2 ThinkPads (Windows XP Pro SP3, avast 5.0.594); this was an upgrade from avast 4.8.

He immediately started getting errors when shutting down or restarting Windows.  I saw the errors when rebooting during the avast install and asked him about them, thinking it was an existing issue.  It doesn't happen all the time, but does occur more often than not, and on both computers.

The most common scenario is getting the error "End Program - XCP" when shutting down, with a single button in the error dialogue "End Now".

There is also an error in the Event Viewer from the same time.  The description is, "Windows saved user [computer name]\[user name] registry while an application or service was still using the registry during log off.  The memory used by the user's registry has not been freed. The registry will be unloaded when it is no longer in user."  (Event Type: Warning, Event ID: 1517)

Sometimes the "End Program - XCP" error is accompanied by "DW20.EXE - DLL Initialization Failed".  (And the same warning in the Event Viewer.)

I've found a handful of threads reporting similar issues, but those all referred to earlier versions (4.6 or older).

Any one else seeing this with 5?  And any thoughts on possible remedies?


Thanks.

[SafeSurf]

I saw the errors when rebooting during the avast install

The Event Viewer for 1517 you are referring to is: http://www.eventid.net/display.asp?eventid=1517&source=.

Since these errors starting to occur during the upgrade of Avast from 4.8 to 5.0.594, I suggest an uninstall and a CLEAN install to fix your problems:

1. Save a copy of newest version of Avast (5.0.594) for the version you need and save it to your HDD:
Free – http://files.avast.com/iavs5x/setup_av_free.exe
Pro  –  http://files.avast.com/iavs5x/setup_av_pro.exe
AIS  –  http://files.avast.com/iavs5x/setup_ais.exe
2. Download the Avast Uninstall Utility, aswClear5.exe http://www.avast.com/uninstall-utility and save it to your HDD (it has uninstall tools for both 4.0 and 5.0).  You will need to uninstall versions 4.0 and 5.0.
3. Disconnect from the Internet at this time.
4. Uninstall Avast through "Add/Remove Programs" through Control Panel. 
5. Boot into Safe Mode (hit F8 repeatedly) and run the Avast Uninstall Tool.
6. Reboot twice (especially for XP).
7. Clean your computer up (clean up cache, temporary Internet files, etc.).
8. Install the newest version of Avast and reboot.
9. Get Internet access and update Avast definitions.
10. Register your copy or add the license key for Free, Pro or AIS.
11. Reset your settings, if needed.

Please let us know how this works for you in your next post.

[YoKenny]

Have you installed User Profile Hive Cleanup Service?

Overview
The User Profile Hive Cleanup service helps to ensure user sessions are completely terminated when a user logs off. System processes and applications occasionally maintain connections to registry keys in the user profile after a user logs off. In those cases the user session is prevented from completely ending. This can result in problems when using Roaming User Profiles in a server environment or when using locked profiles as implemented through the Shared Computer Toolkit for Windows XP.

http://www.microsoft.com/downloads/details.aspx?FamilyID=1b286e6d-8912-4e18-b570-42470e2f3582&displaylang=en

[mcmnky]

Thanks.

I'll take a shot at the clean install tonight.  (5 was installed over 4.8 )

I'm also looking in to the Hive Cleanup Service.

[Eddy]

Delete the XCP, it is a Sony Rootkit

[YoKenny]

Delete the XCP, it is a Sony Rootkit

Google reference

Somehow I don't trust someone from the Netherlands that his site refuses to load and does not show his country in his profile:
HiLoA (HijackThis Log File Analyzer) - Malware Removal Instructions - Free Software - And much more

[DavidR]

Well I would have thought that for the length of time Eddy has been around these forums that you would somehow have remembered his previous activity.

The site opens OK for me.

[YoKenny]

The site opens OK for me.

Not for me

[DavidR]

You should use a good browser like firefox

[YoKenny]

You should use a good browser like firefox

Same results with Chrome and that is a good browser 

[wonderwrench]

Well I would have thought that for the length of time Eddy has been around these forums that you would somehow have remembered his previous activity.

The site opens OK for me.

Here is what I get in both FF and IE.

[mcmnky]

Since these errors starting to occur during the upgrade of Avast from 4.8 to 5.0.594, I suggest an uninstall and a CLEAN install to fix your problems:

SafeSurf,

That did the trick.  I uninstalled/reinstalled, but only has to run the avast clean utility for 5.0, not the 4.8.  (There was no avast 4 folder under C:\Program Files\Alwil Software)  Both computers shut down/reboot without error.

Thanks!

Delete the XCP, it is a Sony Rootkit

No signs for the Sony rootkit.  (Looked for the tell-tale files, services, registry entries.)  Google returns a few things that could be XCP.  Thanks for the suggestions though!

[SafeSurf]

I'm glad the uninstall and clean install worked for you.  I'd like you to try one more thing.  Do you have MBAM on your machine?

[SafeSurf]

Or have you run scans with Avast yet?  Full or a Boot-time?  Clean?

[SafeSurf]

Just to be sure you are clean of malware:

Check your computer for malware with Malwarebytes’ Anti-Malware (MBAM).
·   Download free http://www.malwarebytes.org/ for an on-demand scanner.
·   Double Click mbam-setup.exe to install the application.
·   After install, click update so you have latest database before scanning.
·   Under Settings:
o   General: Automatically Save File After Scan Completes is checked off
o   Scanner Settings:  Check all boxes
o   Updater: Download and install update if available is checked off
·   Once the program has loaded, select "Perform FULL Scan", then click Scan.
·   The scan may take some time to finish, so please be patient.
·   When the disinfection scan is complete, a log will appear in Notepad and you may be prompted to Restart. (See Extra Note).
·   Click the “remove selected” button to quarantine anything found.  You will find the infection details under the Quarantine tab.
·   The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
·   Copy & Paste the entire report in your next reply.

If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts -- Click OK to either and let MBAM proceed with the disinfection process; If asked to restart the computer, please do so immediately.