Win OS Hangs in shutting down. I'm forced to power off.

[Guest]

XP Pro SP3.
For about a week, after invoking "shutdown" the process gets under way, then
stalls. I have gotten up in the middle of the night to see the same screen
as when I went to bed. I am forced to power off the computer, which I do not
want to do because this is not the way we are supposed to do it. This is an
intermittent problem, but lately seems to be more frequent than a normal
speed shutdown.

I run Kaspersky Internet Security quite regularly.

Very soon after invoking the shutdown via the software, whether thru Task
Manager or Windows Key - U - U, I naturally lose the Task Manager display.
Therefore of course, I cannot see which processes are running.

I have tried using the Verbose mode for start up and shut dowqn. I do not
find that this is enough information to pinpoint the cause of the hung
shutdowns and the extrememly long shutdowns.

I have just installed MPHCLEAN -- MS User Profile Hive Cleanup Service. I'm
hoping that this may help.

Anything else I should try? Is there a way to turn on some sort of trace
logging just before I invoke shutdown, so that when I reboot I can see what
happened?

 

[SC Tom]

XP Pro SP3.
For about a week, after invoking "shutdown" the process gets under way,
then stalls. I have gotten up in the middle of the night to see the same
screen as when I went to bed. I am forced to power off the computer, which
I do not want to do because this is not the way we are supposed to do it.
This is an intermittent problem, but lately seems to be more frequent than
a normal speed shutdown.

I run Kaspersky Internet Security quite regularly.

Very soon after invoking the shutdown via the software, whether thru Task
Manager or Windows Key - U - U, I naturally lose the Task Manager display.
Therefore of course, I cannot see which processes are running.

I have tried using the Verbose mode for start up and shut dowqn. I do not
find that this is enough information to pinpoint the cause of the hung
shutdowns and the extrememly long shutdowns.

I have just installed MPHCLEAN -- MS User Profile Hive Cleanup Service.
I'm hoping that this may help.

Anything else I should try? Is there a way to turn on some sort of trace
logging just before I invoke shutdown, so that when I reboot I can see
what happened?

Check the event log as soon as you boot up and look for messages from around
the time you shut down.

SC Tom

 

[Bernd]

-------- Original-Nachricht --------

XP Pro SP3.
For about a week, after invoking "shutdown" the process gets under way, then
stalls. I have gotten up in the middle of the night to see the same screen
as when I went to bed. I am forced to power off the computer, which I do not
want to do because this is not the way we are supposed to do it. This is an
intermittent problem, but lately seems to be more frequent than a normal
speed shutdown.

I run Kaspersky Internet Security quite regularly.

Very soon after invoking the shutdown via the software, whether thru Task
Manager or Windows Key - U - U, I naturally lose the Task Manager display.
Therefore of course, I cannot see which processes are running.

I have tried using the Verbose mode for start up and shut dowqn. I do not
find that this is enough information to pinpoint the cause of the hung
shutdowns and the extrememly long shutdowns.

I have just installed MPHCLEAN -- MS User Profile Hive Cleanup Service. I'm
hoping that this may help.

Anything else I should try? Is there a way to turn on some sort of trace
logging just before I invoke shutdown, so that when I reboot I can see what
happened?

Look here:

http://aumha.org/win5/a/shtdwnxp.htm

Bernd

 

[Guest]

Presume that I have had to power down the computer, because the screen kept
displaying "Windows is shutting down" for an hour. Then the next morning, I
power it up and the OS boots.

Now, what are the baby steps to bringing up this "event log?"

 

[Guest]

Thank you for the reference. I have XP Pro SP3, and therefore the
references to earlier SPs probably do not apply. I do not believe that I
have any of those potentially offending apps mentioned in the reference.
The reference seems to be from 2? years ago.

The apparent hang is not when the message is "Windows is saving your
settings" but "Windows is shutting down."

I am still seeking suggestions.

 

[SC Tom]

Presume that I have had to power down the computer, because the screen
kept displaying "Windows is shutting down" for an hour. Then the next
morning, I power it up and the OS boots.

Now, what are the baby steps to bringing up this "event log?"

Click on Start...Run... Type in eventvwr and press enter.
The open the Application, System, and Security categories and look for any
yellow or red iconed entries. Open it and see what the message is. Usually
there is a link to get info on each one.

If you want to post any of them here, open the event, then click on the icon
that looks like two pages. That will copy the info to the clipboard,
allowing you to right-click in the post and pick Paste.

SC Tom

 

[Richard]

Whenever you power off without completing the normal shutdown, there is a
possibility of file system corruption, and you should run Check Disk:

Click Start, click Run, type CMD and press Enter, for Command Prompt.
Type or paste next line and press Enter:
CHKDSK C:
(Assuming "C" is the volume there Windows is installed.)

That will activate Check Disk in "Read only mode". It will check for file
system errors, but not fix anything. When that completes, it may advise you
to run chkdsk with the /F switch. If so:
CHKDSK C: /F
Answer Yes to let it run at startup, close all open programs, click Start,
click LOG OFF, click Log Off. When you get to the Logon menu, click Turn
Off computer, and click Turn Off. Let the computer take a 20 minute break.

Autochk will run the Check Disk before loading Windows, which means it runs
entirely in RAM, without the benefit of the virtual memory page file, which
means it may be sluggish. (Less than 512MB RAM?) Each stage has its own
0 to 100% progress, which indicates tasks completed, not necessarily
elapsed time. Keep the computer and drive cool. See Event Viewer log:

Start> (all)Programs> Accessories> System Tools> Event Viewer
or Start> Run> eventvwr.msc

In Event Viewer, under Application, look for source: Winlogon

My last Check Disk report (earlier today) had this:
--->
Cleaning up minor inconsistencies on the drive.
Cleaning up 15 unused index entries from index $SII of file 0x9.
Cleaning up 15 unused index entries from index $SDH of file 0x9.
Cleaning up 15 unused security descriptors.
<---
Things like the above are nothing to be concerned about.

CAUTION: Once Check Disk has started, it should not be interrupted. Avoid
running Check Disk when there is possibility of power loss from storms.
Check Disk may appear to be hung. As long as there is drive activity,
something is happening. After 30 minutes or more of no activity, before
killing the power, try Ctrl+C to stop it first.

You did not say at what point the shutdown hangs.
Before or after saving personal settings?

Have you tried starting in Safe Mode, and shutting down from there?

HTH. (Hope This Helps.
--Richard

- - -

XP Pro SP3.
For about a week, after invoking "shutdown" the process gets under way,
then stalls. I have gotten up in the middle of the night to see the same
screen as when I went to bed. I am forced to power off the computer,
which I do not want to do because this is not the way we are supposed to
do it. This is an intermittent problem, but lately seems to be more
frequent than a normal speed shutdown.

I run Kaspersky Internet Security quite regularly.

Very soon after invoking the shutdown via the software, whether thru
Task Manager or Windows Key - U - U, I naturally lose the Task Manager
display. Therefore of course, I cannot see which processes are running.

I have tried using the Verbose mode for start up and shut dowqn. I do
not find that this is enough information to pinpoint the cause of the
hung shutdowns and the extrememly long shutdowns.

I have just installed MPHCLEAN -- MS User Profile Hive Cleanup Service.
I'm hoping that this may help.

Anything else I should try? Is there a way to turn on some sort of trace
logging just before I invoke shutdown, so that when I reboot I can see
what happened?

- - -

 

[Guest]

I have 3GB RAM.
I am using Verbose mode, and when the shutdown hangs, it is after the
message re: saving settings. The display is "Windows is shutting down."
Following Richard's suggestions, I got to eventvwr.

Under Applications, I sorted the SOURCE column, and found only two WINLOGON
listings; one back in March and one on 10/04/09. What should this tell me?
Of course, I have booted my computer hundreds of times this year, so why
only two listings?

Under System, I see three kinds of events: WARNING, ERROR, INFORMATION. I
see ERROR event codes, such as 7026. For an event "MrxSmb" there is a code
of 8003.

Please refer me to documentation that will tell me what the event codes
mean, and a description of the events such as MrxSmb.

 

[SC Tom]

I have 3GB RAM.
I am using Verbose mode, and when the shutdown hangs, it is after the
message re: saving settings. The display is "Windows is shutting down."
Following Richard's suggestions, I got to eventvwr.

Under Applications, I sorted the SOURCE column, and found only two
WINLOGON listings; one back in March and one on 10/04/09. What should
this tell me? Of course, I have booted my computer hundreds of times this
year, so why only two listings?

Under System, I see three kinds of events: WARNING, ERROR, INFORMATION. I
see ERROR event codes, such as 7026. For an event "MrxSmb" there is a code
of 8003.

Please refer me to documentation that will tell me what the event codes
mean, and a description of the events such as MrxSmb.

===========

Google works wonders for finding out event ID info, as in
http://www.google.com/search?hl=en&source=hp&q=event+7026&aq=f&oq=&aqi=g8g-m2
and
http://www.google.com/search?hl=en&q=event+8003&aq=f&oq=&aqi=g2g-s1g3g-m4
and is about the easiest resource. You can use it for any other error and
warning codes you are getting, also.

SC Tom

 

[Richard]

OK, with 3GB, you have plenty of RAM. In Event Viewer, while looking at the
list of events in the right window, double-click to view the report. While
looking at a report, under the two arrow buttons is another button that
looks like two pages. Click that to copy to clipboard, and paste a copy of
the report, (with winlogon source for 4 October 2009,) in a message here.

Your first message here was on the 12th, and you mentioned the problem
started about a week before, so look for other reports in the first two
weeks of October. It is possible that the October 4th Check Disk was run
automatically by the system, because of detected corruption. With other
forced power offs, there may be more problems. Have you run the CHKDSK
program yet that I mentioned in my first reply?

While you are viewing a report in Event Viewer, there is a line that says:

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

If you are connected to the internet when you click that hot link in the
report, it will connect to that site, and also send along information from
that report that the web site uses to provide more info, if any. Each
report has the same website link, but sends different information. Your
Help and Support Center program, (not IE,) will open and eventually
display the information. (It is very slow... wait for it.

Events and Errors Message Center Search
http://www.microsoft.com/technet/support/ee/ee_basic.aspx
http://www.microsoft.com/technet/support/ee/ee_advanced.aspx

Another Event information resource is:
http://www.eventid.net/search.asp

Event ID 1001 is used by other sources besides winlogon, like UPHClean.

Event 7026: Boot-start or system-start driver(s) failed to load.
(Oops. I got some of those events when messing around with Safe Mode.

Event 8003: ?? (See your Event log report and click the link.)

HTH. (Hope This Helps.
--Richard

- - -

I have 3GB RAM.
I am using Verbose mode, and when the shutdown hangs, it is after the
message re: saving settings. The display is "Windows is shutting down."
Following Richard's suggestions, I got to eventvwr.

Under Applications, I sorted the SOURCE column, and found only two
WINLOGON listings; one back in March and one on 10/04/09. What should
this tell me? Of course, I have booted my computer hundreds of times this
year, so why only two listings?

Under System, I see three kinds of events: WARNING, ERROR, INFORMATION.
I see ERROR event codes, such as 7026. For an event "MrxSmb" there is a
code of 8003.

Please refer me to documentation that will tell me what the event codes
mean, and a description of the events such as MrxSmb.

- - -- - -