Windows XP Log

[dwlpl]

I am having difficulty shutting down Windows XP, its taking up to 5mins and sometimes it doesn't happen at all.

I seem to remember that there is some sort of log within Windows XP that identifies conflicts and problems etc.

Anyone know what it is, how to access it and how to deal with the conflicts/problems listed?

[frostbite]

First thing I would do is run one of the many free registry cleaners - it could well be the poor thing's getting confused trying to close a program that's not there any more.

[BLUE SKY THINKER]

Start > (right click blank area) Properties > Start Menu (tab) > Customize... > Advanced (tab) > Start menu items: System Administrative Tools > check Display on the All Programs Menu > OK.

Start > All Programs > Administrative Tools > Event Viewer ......... Look at the entries under Application and System. If it's full of persistant Warnings and Errors, double click them for further info.

Take a particular look for event id entries 1517 and 1524; if you've got them take a look at THIS (http://www.microsoft.com/downloads/details.aspx?familyid=1B286E6D-8912-4E18-B570-42470E2F3582&displaylang=en) and download.

If nothing of note is showing in Event Viewer, probably best come back here to pursue other options.

[dwlpl]

There are loads of 1517 and 1524 warnings.

If I understand it properly, to help in shutting down then this download will run it the background. All I have done is download it and nothing else.

Other Events have the following numbers:

51, 101, 105, 1000, 1001, 1002, 11707, 11724, 11728 and 11729.

[BLUE SKY THINKER]

OK. ...If you have downloaded/installed UPH Clean Up, I think things will improve. ...Some of those other events are day to day things, some of which will probably be cured by the above. ...If you want details of each, look HERE (http://www.eventid.net).

I now suggest you go back to Event Viewer, right-click 'Application' and 'System' and Clear all Events. ...When it asks if you want to 'save', click 'Yes' for a record of the situation to date and save to My Docs. ...Reboot and see if the UHP Clean Up has improved things (two reboots if no). ...If you note an improvement, keep an eye on Event Viewer for more specific probs. (you should have lost some). ...Most people are running a number of them on a day to day basis (I've got a couple of 'one off' ones), some never to be repeated. ...Yellow warnings are less serious than red errors. ...Blue is just for info.

[BLUE SKY THINKER]

Speechless Two . . . .

Surreal isn't it? ...Microsoft Windows Defender flags up Microsoft's own program!

However, a quick excursion around the web soon shows this is a fairly common problem with numerous legit programs, UPH included. ...But as someone highlights HERE (http://www.pcreview.co.uk/forums/thread-2526379.php), "it's just an unknown" (as bizarre as that seems in this particular case!); hence a yellow rather than a red warning.

Glad it was of some help; similarly sorted me some time back. ...Hopefully likewise, dwlpl.

[dwlpl]

Its been over 24hours since I loaded the UPH CLEAN UP.

This is whats there now in the way of 'alerts'(?):

APPLICATIONS - none
ANTIVIRUS - none
SECURITY - a few 'FAILURE AUDITS'
SYSTEM - DCOM 10010, Service Control Manager 2, 7000, 7023, 7026

Also whats the easiest to use registry cleaners available?

[BLUE SKY THINKER]

dwlpl . . . . .

You don't say whether it's solved the initial problem of start up/close down; if it has, I might be tempted not to get involved with the registry. ...Everyone is getting event entries now and then.

However, on that front I'm sure you will find a lot of people's favourites on here. ...Personally I have been using RegSeeker (http://www.hoverdesk.net/freeware.htm) for a couple of years (free). ...I warn you now though, before you get alarmed, it will invariably throw up dozens, sometimes hundreds, of entries on initial run. ...I would only fiddle with anything you are completely sure about and it's essential you have the Backup facility enabled (bottom left); maybe System Restore 'on' for double backup to previous state.

[Compass Call]

BST - Thanks for the advice. Solved my log on/off problems and everything loads faster too:ok:


CC

[dwlpl]

In the SYSTEMS folder of the EVENT VIEWER I am getting entries on every start-up.

Two of these entries are:

eeCtrl
Symantec Core LC

Both of the above are part of, I believe, Norton/Symantec. Its a while since I had Norton on my PC, does anyone know how to remove ALL traces of Norton/Symantec?

[BLUE SKY THINKER]

dwlpl . . . . .

Probabaly just an old registry entry; download THIS (http://freeware4u.com/modules/mydownloads/singlefile.php?lid=49) (free):

http://freeware4u.com/shots/regcleaner/main.gif

First page up, above, will show all programs registered to the registry (different and far more comprehensive to the standard add/remove list); you may find some related reference to 'Symantec' or 'Norton' there, with the facility - should you choose - to remove it (there is a backup). Right-clicking an entry gives further 'Advanced Info.'

Don't get carried away with other things there that you don't recognise; a lot of familiar programs contain legit third party programs that are required for them to function correctly.

You can also clean the whole registry with this program (although that's another subject). I only use it for the first page view of programs; preferrring an alternative for the rest.

-------------------------------------------------------------------------------------------------------

PS: When you uninstalled Symantec/Norton some time ago you may have assumed it was done properly, but I have never done so and NOT found related folders remaining. Before you look for above registry entries, would suggest you might look for them here:-

Program Files > Norton/Symantec/Live Update.

Program Files > Common Files > Norton/Symantec/Live Update.

(show hidden files and folders, via Control Panel > Folder Options) Start > My Computer > C Drive > Documents and Settings > (your named account) Folder > Application Data > Symantec.

(show hidden files and folders, via Control Panel > Folder Options) Start > My Computer > C Drive > Documents and Settings > 'All Users' Folder > Application Data > Symantec.

Likewise, last two entries for any other 'named' acconts on your PC.

Then check registry entries.

[dwlpl]

No sign of anything re Symantec/Norton in the above files, but its still coming up as an error in the Events Log (System).

I have noticed though that in Administrative Tools under Services there is an entry 'Symantec Core LC' (with the Startup Type listed as Automatic) with the Properties for this entry saying the address as being:

C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe"

Is this something left over from when I had Norton/Symantec and is this something I can delete? If so do you just highlight it and press delete?

[frostbite]

In the absence of BST, I would say Oh Yes!

In fact I would delete the Symantec Shared folder.

[BLUE SKY THINKER]

dwlpl . . . . .

Whilst I would agree with previous, I get the impression you have looked in Program Files > Common Files and can't find a Symantec Shared File.....?

Have you tried the registry program (you don't say)? If not, give it a try. If no luck either way I'll come back with another suggestion.

[dwlpl]

I have looked in all the files as listed in your post #12 of this thread.

Could it be that instead of the file being 'damaged' and getting listed in the Event log, the system cannot find the file 'Symantec Core LC'?

[BLUE SKY THINKER]

Sorry dwlpl, maybe it's me (been a long day), I know you have looked at the files, but I still can't fathom whether you have downloaded RegCleaner and looked at the initial software list. If you haven't then that's your next best bet.

Either way, if still no luck a similar program called RegSeeker -HERE (http://www.hoverdesk.net/freeware.htm) - has a useful 'search' facility. Once downloaded go to second item down in the left hand column and click 'find in registry'. Put 'Symantec' in the search box and tick all the 'Keys_____search options' below and see if it finds anything. Repeat likewise for Norton. (Could also try their separate 'search files' option, even though you've been there).

As a final suggestion, Symantec do a (free/downloadable) removal tool for many of their programs to get the final bits out not sorted by a standard uninstall. As far as Norton Internet Security is concerned, (as an example) there are different removal tools for different years, so you would need to know if your original program was 2002...2005, etc. Likewise I believe with their other programs. I'll leave you to do a search on the Symantec (http://www.symantec.com/en/uk/index.jsp) site.

Good luck.

BST

[dwlpl]

Sorry dwlpl, maybe it's me (been a long day), I know you have looked at the files, but I still can't fathom whether you have downloaded RegCleaner and looked at the initial software list. If you haven't then that's your next best bet.
Either way, if still no luck a similar program called RegSeeker -HERE (http://www.snapfiles.com/get/regseeker.html) - has a useful 'search' facility. Once downloaded go to second item down in the left hand column and click 'find in registry'. Put 'Symantec' in the search box and tick all the 'Keys_____search options' below and see if it finds anything. Repeat likewise for Norton. (Could also try their separate 'search files' option, even though you've been there).
As a final suggestion, Symantec do a (free/downloadable) removal tool for many of their programs to get the final bits out not sorted by a standard uninstall. As far as Norton Internet Security is concerned, (as an example) there are different removal tools for different years, so you would need to know if your original program was 2002...2005, etc. Likewise I believe with their other programs. I'll leave you to do a search on the Symantec (http://www.symantec.com/en/uk/index.jsp) site.
Good luck.
BST

Yes I have used the RegCleaner and found nothing, just about to download RegSeeker.

[dwlpl]

RegSeeker result;

Symantec = 67
Norton = 7

What do I do now, delete them using Reg Seeker?

[BLUE SKY THINKER]

dwlpl . . . . .

If you DEFINITELY have no other Symantec/Norton programs on your computer now, I would have no problem with deleting them.

As a precaution against trouble when fiddling with the registry, make sure the backup box is ticked in RegSeeker (bottom left-hand corner) and Windows System Restore is on (double precaution).

Afterwards, clear your Event Viewer > System (so you can track progress afresh) and reboot.

[dwlpl]

I have used RegSeekers 'Clean the Registry' feature to se whats there and believe me there is a lot of stuff CCCleaner has missed. I will delete those entries first and see how my PC reacts over a few days and then get down to the Symantec/Norton problem.

Couple of things, where does the RegSeeker put the backup files? And, I did run the Norton uninstall (designed for their 2003 to 2007 programs) and my problems are still being logged on start-up in the Event viewer, so this utility does not work.

[BLUE SKY THINKER]

dwlpl . . . . .

I think I'm running out of options, doing this 'long distance', if you've also had no luck with the RegSeeker and the Symantec removal tool.

With regard to the former, I see you've moved from the 'search' to the 'clean' function. That section needs treating with considerable caution; only touch anything there you are a hundred per cent sure of. That said, if you've enabled previously mentioned backups, you should be OK.

In answer to your question:

Start > My Computer > 'C' Drive > Program Files > RegSeeker > Backup > (right-click required file to restore) Merge.

[BLUE SKY THINKER]

PS to previous . . . . .

If all else fails, why not just double-click the two offending items in Administrative Tools > Services, 'Stop' the service and then 'Disable' it via the 'Startup type' drop down window.

It wont solve the irritant of something on the PC generating the 'Services' items, but at least they wont be running, which should solve the System Log entries.

[dwlpl]

Appears that the Symantec has gone.

Thanks for everything.

[dwlpl]

Its been over 24hours since I loaded the UPH CLEAN UP.

All was going well but now my PC has learnt a new trick.

On closing down my user (in XP) my PC is again taking longer to log off. It appears its down to the ZONE ALARM FIREWALL.

A window pops up entitled 'end program - Zone Alarm' a progress bar is also shown together with a END NOW button but with a warning that if I do select this button I stand to lose any data that is being saved.

Once this is done then another pop up appears saying ZONE ALARM is shutting down. Once this is done the PC logs off as normal.

Any ideas as to how to get around the ZONE ALARM thing?

[BLUE SKY THINKER]

Depending on how much fiddling you've done - re. previous - just a possibility this is a side effect if you've not had trouble with it prior to that. I would be tempted to uninstall Zone Alarm and then reinstall the latest version.

Just a thought.