southerncross

After typing in the password to startup xp pro, the windows installer box appears and causes a lengthy delay to the os booting up.

This is happening each and every time and i want to remedy this problem

A number of new applications have recently been added and unused applications removed, so i think this may well be what the cause of this is

Please help me with this one

thanks

Fren Banklin

Something is trying to install on boot, and failing.

MS publishes a tool called "Windows Installer Clean-up Utility" or similar, and I'm pretty sure it's purpose is to fix problems like this.

Check Event Viewer, it should say what it is that is trying to install on boot.

What's the last thing you tried to install ?

If it's in Add/Remove Programs, uninstall it, then reinstall after a reboot.

southerncross

Thanks for the fast reply, the below is the description of the event in the event properties box that ive found with errors on startup.






1.
The KmxSbx service failed to start due to the following error:
The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.

2.
The HIPS Configuration Interpreter service hung on starting.

3.
The HIPS Event Manager service depends on the HIPS Configuration Interpreter service which failed to start because of the following error:
After starting, the service hung in a start-pending state.

4.
The HIPS Policy Manager service depends on the HIPS Configuration Interpreter service which failed to start because of the following error:
After starting, the service hung in a start-pending state.

5.
The KmxCF service failed to start due to the following error:
The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.

6.
The IPSEC Services service terminated with the following error:
The authentication service is unknown.

7.
The following boot-start or system-start driver(s) failed to load:
KmxAgent
KmxFile
KmxFw


Seems its possibly related to an application from tiny software inc? A number of which ive installed and removed, and ive been trying out various anti virus, anti malware, spyware and even registry cleaners lately

In add/remove programs there does not seem to be anything out of order, nothing that stands out anyway, so perhaps just some leftover application that wont leave

I have installed windows installer cleanup utility and am ready to use that if advised

thanks

Fren Banklin

Hold off on the uninstaller utility. I've done it, and remember it's a bit dangerous. I'd feel better is someone more familiar & confident advocated you do that, and is willing to be available should you run into problems.

KmxSbx is either malware or part of something called "Tiny Firewall".

HIPS Configuration Interpreter service is associated with malware on several sites.

HIPS Event Manager is also associated on malware removal sites.

KmxCF is related to all of the above in some way

It seems all these errors are related. Might be Tiny Software, I can't find any confirmation one way or the other.

Before the Windows uninstaller, try the freeware Revo, and see if that can find Tiny Software thing and uninstall it.

Report results. See if the Windows Cleanup option is necessary.

southerncross

ok

ive installed revo uninstaller and i found this icon with a registry key only as its application name in the revo uninstaller window

i right clicked to open the registry key and it brings up 4 files, one of them is a QBReplace, and after lookin it up on google this looks a problem or at leats part of it

revo uninstaller cant uninstall this

should i just delete these from the registry?

spybot s&d reports no problems
malwarebytes anti-malware reports no problems

avast has found a virus, as follows:

malware name: Win32:Ups [Cryp]
malware type: Virus/Worm
vps version: 090107-0, 07/01/2009

i chose to move this to the virus chest

unsure what to do from here, the problem remains, do you think we begin heading down the combofix route...?

Fren Banklin

It's always best to have malwre removed by a TSF expert, rather than attempting to do it yourself, but the reality is that there is a long delay.

Forum rules restrict the level of assistance I (or anyone else) can offer here. There's a line, somewhere, and I need to make sure not to cross it.

I can tell you that it is recommended that Users have only one AV and one AS program, any more than that is unnecessarily redundant, a drain on system resources and can have conflicts. Also, Spybot's Tea Timer prevents legitimate reg changes and causes many Users problems as a result.

Autoruns is an extremely useful program for removing non-MS and illegitimate startup items, and is a true "must have" for anyone that wants to learn more about their computers and how to maintain them.

QBReplace appears to be related to Quickbooks. Is this still installed and being used ?

I'm not able to help you with combofix, in part to the statement I made above, and also because I've never used it.

Reg Seeker is an excellent tool for doing manual uninstallations. I've learned to never delete a reg key that has the word "Legacy" in it, and I have no idea why. It's just a bad idea.

That's the best I can do for you here, I think. You should seriously consider getting help with malware removal in the Securities sub-forum.

southerncross

cheers