Vista Welcome Screen and ctrl alt del boot to desktop

Just installed CIS and a reboot hangs on the Welcome screen until a alt-cntl-delete. I uninstalled CIS and the problem went away.

I have the Windows log entries but not sure how to go about this. I’ll copy some of the entries for a start.

The alt-cntl-delete was entered about 7:45.

7:45:30 The Network Connections service entered the running state.
7:45:30 DCOM started the service netman with arguments “” in order to run the server:
{BA126AD1-2166-11D1-B1D0-00805FC1270E}
7:45:30 The Function Discovery Provider Host service entered the running state.
7:45:29 DCOM started the service fdPHost with arguments “” in order to run the server:
{145B4335-FE2A-4927-A040-7C35AD3180EF}
7:45:23 The WinHTTP Web Proxy Auto-Discovery Service service entered the running state.
7:37:25 The Windows Update service entered the running state.
7:37:25 The Windows Media Center Service Launcher service entered the stopped state.
7:37:22 A compatible Trusted Platform Module (TPM) Security Device cannot be found on this computer. TBS could not be started.
7:37:23 The Security Center service entered the running state.
7:37:22 The TPM Base Services service entered the stopped state.
7:37:22 The KtmRm for Distributed Transaction Coordinator service entered the running state.
7:37:22 The Windows Media Center Service Launcher service entered the running state.
7:36:36 The Windows Modules Installer service entered the running state.
7:36:36 The Windows Search service entered the running state.

Forgot to mention this is a 32 bit Vista Home Premium.

From SteveW’s entry below, I already had the taskbar on top of other windows. But when I changed from auto-hide of the taskbar to locking it, the problem went away.

I was a bit premature. The system did boot once without problems after changing the taskbar, but has hung 3 times since then.

I installed version 3.12, is there any way to get a different version which may not have this problem?

What other security programs do you have installed that run in the background? What happens when you disable them?

Can you show a screenshot of the Defense + logs? They can be found under Defense + → Common Tasks → View Defense + alerts.

Regarding Windows logs look for events with a red icon under Applications and System around boot time. What programs or services are reported to malfunction?

I was running Zone Alarm free firewall and AVG 8.5 free anti-virus. They have both been de-installed.

There is nothing in the Defense logs since Saturday.

From System log:
Error 10/19/2009 5:40:52 AM DistributedCOM 10010 None
The server {E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E} did not register with DCOM within the required timeout.

Error 10/19/2009 5:42:09 AM R300 43015 DAL
I2c return failed

Error 10/19/2009 5:42:09 AM R300 43015 DAL
I2c return failed

Error 10/19/2009 5:43:46 AM Service Control Manager Eventlog Provider 7000 None
The MCSTRM service failed to start due to the following error:
The system cannot find the file specified.

No red icons in Applications log

Zonealarm may not be uninstalled properly.
Try this.
Zonealarm clean tool:

1.uninstall CIS
2.use zonealarm clean tool
3.reboot
4. go to here and read my replies(it’s for Windows 7 but works fine with Windows Vista):
https://forums.comodo.com/install_setup_configuration_help/windows7_unable_to_import_export_configuration-t45134.0.html
5.install CIS.

If it doesn’t work for you, tell me more details please.

Try the ZA uninstaller first and try the clean install.

Open regedit and look up E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E and see what program or file is being referred to.

Error 10/19/2009 5:42:09 AM R300 43015 DAL I2c return failed

Error 10/19/2009 5:42:09 AM R300 43015 DAL
I2c return failed

Error 10/19/2009 5:43:46 AM Service Control Manager Eventlog Provider 7000 None
The MCSTRM service failed to start due to the following error:
The system cannot find the file specified.

No red icons in Applications log

Check out http://real.lithium.com/real/board/message?board.id=InstallingRhapsody&thread.id=30807 .

Did the Zone Alarm cleanup. Didn’t solve the problem. It did get an errr message that vsutil.dll does not exist.

I’m not that experienced with regedit. I found a match “Profile Notification Host”

Have you tried reinstall Zone alarm?

1.reinstall Zone alarm.
2.use cleanup tool.

Did you find references to file (*.sys for example) in the Profile Notification Host key? There may be more than one. When you find a reference to a file look up the properties of the file and look at the discription or possible signature for clues what the program is and does.

Found the following matches with regedit:

Name Type Data

(Default) REG_SZ Profile Notification Host
DllSurrogate REG_SZ

(Default) REG_SZ SHACCT Profile Notification Handler
Appid REG_SZ E10F6 …

(Default) REG_SZ Recycle Bin
AppId REG_EXPAND_SZ E10F6 …
InfoTip REG_EXPAND_SZ @%SystemRoot%\System32\shell32.dll, -22915
LocalizedString REG_EXPAND_SZ @%SystemRoot%\System32/shell32.dll, -8964
SortOrderIndex REG_DWORD 0x00000078 (120)

(Default) REG_SZ ProfileNotifyHandler Class
AppId REG_SZ E10F6 …

(Default) REG_SZ Group Policy Service User Profile Notifiction
AppId REG_SZ E10F6 …

(Default) REG_SZ Sync Center User Profile Notification Handler
AppId REG_SZ E10F6 …

(Default) REG_SZ Windows Search Service Profile Notify Handler
AppId REG_SZ E10F6 …

(Default) REG_SZ PSEProfileNotify

(Default) REG_SZ IProfileNotify

Uninstalled CIS
restart
Installed Zone Alarm
restart
Ran cleanup tool
restart
Installed CIS

Still have the problem.

If you have any other security programs installed uninstall them to see if they play a role. When following the tutorial in the next paragraphs look for Zone Alarm left overs (look for Endpoint and Zone Alarm) and specifically for vsutil.dll and disable them.

We are gonna take a look to see if there are some old drivers of your previously uninstalled security programs are still around. Go to Device Manager → View → show hidden devices → now look under Non Plug and Play drivers → when you see a driver that belongs to your previous security programs click right → uninstall —> reboot your computer.

When the problem persists make sure there are no auto starts from your previous security programs. Download Autoruns and run it.

This program finds about all auto starts in Windows. This tool can therefore seriously damage Windows when not handled properly. After starting go to Options and choose to hide Windows and Microsoft entries, to include empty locations and then push F5 to refresh.

Now check all entries to see if there are references to your previous security program. When you find them untick them. After unticking reboot your computer and see what happens.

Haven’t done the latest yet. Just wanted to add that I have done 4 restarts (including the one as part of the CIS install) since doing the Zone Alarm cleanup and reinstall of CIS. The 1st amd 4th hung. The 2nd and 3rd went fine.

No biggie. Keep us posted. :-TU

No luck with either the Device Manager or Autoruns.

I uninstalled CIS and restarted. The Windows System log had the same warning and error entries as it did with CIS installed.

Alright.
Let’s check the other problem.

1.Did you follow this?
https://forums.comodo.com/install_setup_configuration_help/windows7_unable_to_import_export_configuration-t45134.0.html

2.What is your CIS mode?
try to change CIS mode to ‘Training’, when you reboot.

1.Did you follow this? https://forums.comodo.com/install_setup_configuration_help/windows7_unable_to_import_export_configuration-t45134.0.html

Mostly. Unsure of some of the details.

2.What is your CIS mode? try to change CIS mode to 'Training', when you reboot.

Mode was ‘Safe’. Changed Firewall and Defense+ mode to ‘Training’.

Like to add an “Amen”, I discovered Comodo several days ago after fighting Firefox and Zone Alarm. And of course I’ve got a Dell Inspiron 1501. And the Welcome screen hangup.

Be glad to do anything I can to help.

Do the Windows logs show it is waiting for something or something crashing? Do the Defense + logs show a block during boot time?

Also make sure “Block all unknown requests if the application is closed is” disabled. The setting can be found under Defense + → Advanced → Defense + settings.