Box appears before pc will shut down

Renee

Every time I log off a box comes up with the message...

McciAsyncEventMgrWnd

I downloaded a programme to make my internet connection faster but then uninstalled it. I think this is left over from that download.

Is there anyway I can get rid of it.

Help would be appreciated

superscaper

What program did you download? Most of those are really dodgy and it's questionable if they work anyway. You should start off going through the malware removal sticky just to clean up your system (certainly use ccleaner).

Renee

I can't remember what the programme was called.
I've used ccleaner and spybot but it still comes up.

I did a internet check speed & this was one of the things it said would help.

Thanks for your quick reply

Maps_2

You're not the only one seeing this...

http://www.tutorials-win.com/SupportXP/when-turning/

We just need to find out what program is causing the issue and remove it.

It's probably a good idea to check your Event Log at this stage, which can be found (in Win 2000/XP) by...

1. Click Start
2. Click Settings
3. Click Control Panel
4. Double Click on Administrative Tools
5. Double Click on Event Log

Then see if there are any errors (marked with a red cross) listed around the times you've seen the message. I imagine it will be in the "Application" or "System" log.

Please post back with the gyst of any errors you find.

ormus

http://technet.microsoft.com/en-gb/sysinternals/bb896653.aspx

this may help you to find out what it is and then remove it.

Renee

Just had a look at System Restore & the programme was called Active Speed.

I'll do a Google on it & look at my Event log.

Renee

I've found something in the Event log that is iffy.

Here's what it says.

Event Type: Warning
Event Source: WinDefend
Event Category: None
Event ID: 3004
Date: 12/01/2008
Time: 2:08:10 PM
User: N/A
Computer: *****
Description:
Windows Defender Real-Time Protection agent has detected changes. Microsoft recommends you analyze the software that made these changes for potential risks. You can use information about how these programs operate to choose whether to allow them to run or remove them from your computer. Allow changes only if you trust the program or the software publisher. Windows Defender can't undo changes that you allow.
For more information please see the following:
http://go.microsoft.com/fwlink/?linkid=74409
Scan ID: {F84B294C-95A9-4E22-B355-436201E64912}
User: *****
Name: Unknown
ID:
Severity: Not Yet Classified
Category: Not Yet Classified
Path Found: runkey:HKCU@S-1-5-21-839522115-1078081533-1801674531-1004\Software\Microsoft\Windows\CurrentVersion\Run\\Performance Center
Alert Type: Unclassified software
Detection Type:

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Warning
Event Source: WinDefend
Event Category: None
Event ID: 3004
Date: 12/01/2008
Time: 2:08:20 PM
User: N/A
Computer: *****
Description:
Windows Defender Real-Time Protection agent has detected changes. Microsoft recommends you analyze the software that made these changes for potential risks. You can use information about how these programs operate to choose whether to allow them to run or remove them from your computer. Allow changes only if you trust the program or the software publisher. Windows Defender can't undo changes that you allow.
For more information please see the following:
http://go.microsoft.com/fwlink/?linkid=74409
Scan ID: !!938A9557-3200-438C-BD73-9DDEE6D4D68B}
User: *****
Name: Unknown
ID:
Severity: Not Yet Classified
Category: Not Yet Classified
Path Found: regkey:HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\ActiveSpeed;runkey:HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\ActiveSpeed;file:C:\Program Files\Ascentive\ActiveSpeed\AS.exe
Alert Type: Unclassified software
Detection Type:

Maps_2

Hmm, well it seems there are questions about the company that developed that software...

http://www.siteadvisor.com/sites/ascentive.com

Your event log entry shows that the program (AS.exe) is starting up with Windows so it isn't uninstalled properly.

Is it still showing up in your "Add/Remove Programs" area of the Control Panel for removal? If so, try removing again.

If not, I will post some instructions for removing it manually tomorrow.

Renee

There's nothing in add/remove programmes.

Thanks Maps, I really appreciate your help.

Speak to you tomorrow

Maps_2

Ok, change of plan, rather than manually changing the registry which can be risky, let's try a program that will do it for you.

1. Download and install "Spybot - Search and Destroy" from http://www.download.com/Spybot-Search-Destroy/3000-8022_4-10743107.html?tag=lst-1. Do a quick Google search if you are worried and you'll see it's legit (and a decent program to have anyway).

2. When the Spybot loads, click ok or cancel on the inital startup options until you get into the main program Window.

3. Under the "Mode" menu at the top, select "Advanced Mode". This will give you extra options on the left side menu.

4. Under "Tools" on the left side menu, select "System Startup".

Basically, this option will show every program that tries to startup with Windows.

5. Locate the "Performance Centre" and "AS.exe" entries (as shown in your event log) and untick them. This won't uninstall the programs, but it will stop them starting up without any risk.

6. Reboot your computer. You may see the issue again as the program is already in memory, but after you reboot again, it should be gone!

Please let me know how you get on and if it has worked I will post further details for completely removing it.

Good luck!

Renee

I did what you suggested. I could only find the Performance Centre which I unticked.

I've done a couple of restarts & logging off & the pop up box hasn't appeared so it looks as though youv'e cured it.

Thanks very much Maps, it was much appreciated.

Renee