User Profile Hive Cleanup- Crashes system?

Downloaded User Profile Hive Cleanup (uphclean) from MajorGeeks last night and installed it on an XP sp2 PC. I did this because everytime I reboot, windows installer starts up and tries to install Easy Media Creator 8. (This is a used PC that I just got and there were several user profiles set up on it. But I always logon as administrator.) This cleanup tool seemed like a safe thing to try. I had already run a bunch of malware detectors and rootkit detectors on this PC.

As soon as I installed uphclean the PC started freezing up as soon as it boots up - or sometimes before windows fully boots. It even locks up in safe mode and when I try to boot with Ultimate Boot CD.

Somtimes it freezes and then it shuts itself down and starts up - but when it starts up I just get a blanks screen. I often here a beep at that point.

I wanted to uninstall User Profile Hive Cleanup because it seems to have caused all this. But I can't even get on long enough to get to add/remove programs. I had system restore turned off, but if I can ever get on long enough I would like to turn it on and look for an old restore point to return to.

Should I press F8 and try booting to last known good configuration?

Any help would be appreciated. Thanks

 

LKG isn't a bad idea, if it never made it to the welcome screen.

Always, always, always make a backup before installing this sort of software.

Because system restore was disabled, you are limited on your options.

http://forums.majorgeeks.com/showthread.php?t=145543 is your best bet.

Kind of late now, but your issue wasn't profile related.

 

I was able to get on long enough to uninstall User Profile Hive Cleanup and start up system restore. I was not able to find any restore points to restore to however. Then I rebooted and used LKG and got on for a while without a freezeup. Long enough to uninstall Roxio Easy Media Creator. I rebooted after and the windows installer finally is not trying to install it anymore. I then deleted one of the user profiles. A while later it froze again and shut itself down and then it seems to have powered up but the screen is blank.

I do not get the BSOD so I don't know which driver/service to disable from the Recovery console.

 

The service originally in question was thought to be the user profile """ service.

Now that its not the issue...does that blank screen happen in Safe Mode?

 

I just booted to safe mode and it asked me to click cancel if I want to stop the loading of sptd.sys. I didn't press cancel. Now I am waiting to see if I get locked up again. Just before the last freeze I noticed a few things in event viewer.

Application:
msiInstaller warnings included 1001, 1015, 1004 and 2 errors 11704 and 11706. Also I had 2 warnings for userenv - 1517 and 1524 and an error code 5 for symantec antivirus finding Adware.BDE.

System:
I noticed errors 7000, 7001 and 7026 for Service Control Manager and 23 for Print.

I didn't get the chance to even look at the details for these because it just locked up again. It did not shut down and reboot to the blank screen however this time. Don't know if thats because I'm in safe mode or what. (This freezes without a reboot when I boot to XP normally too.)

 

I went back in in safe mode but this time I did not load the SPDT.SYS driver and had had no lockups. I think I will remove this driver and reboot normally and see what happens. I just completed a full scan of my system with norton anti-virus and no problems. The event code 1517 and 1524 seem to have to do with user profiles not being unloaded properly. see http://www.microsoft.com/downloads/...6D-8912-4E18-B570-42470E2F3582&displaylang=en where it says

"The User Profile Hive Cleanup service helps to ensure user sessions are completely terminated when a user logs off. System processes and applications occasionally maintain connections to registry keys in the user profile after a user logs off. In those cases the user session is prevented from completely ending. This can result in problems when using Roaming User Profiles in a server environment or when using locked profiles as implemented through the Shared Computer Toolkit for Windows XP.

On Windows 2000 you can benefit from this service if the application event log shows event id 1000 where the message text indicates that the profile is not unloading and that the error is "Access is denied". On Windows XP and Windows Server 2003 either event ids 1517 and 1524 indicate the same profile unload problem.

To accomplish this the service monitors for logged off users that still have registry hives loaded. When that happens the service determines which application have handles opened to the hives and releases them. It logs the application name and what registry keys were left open. After this the system finishes unloading the profile."

So I still may try to rerun this thing but maybe I will download it strait from MS this time. It could be one of the users had been doing an install or repair of Roxio Easy Media Creator and it failed and his profile was not unloaded so that everytime I reboot this install keeps trying to complete.