I have to shut down twice, why?

[Guest]

I am running XP Pro, SP2 with all the latest updates. For some time now I
have not been able to shutdown, restart or log off at the first attempt, it
is only on the subsequent that operation works. Very occasionally, say 1 in
20 it will work but there does not seem to be a patern.

Does anyone know why?

Thanks

Briggers

 

[Guest]

What exactly happens when you try to do a normal shut down the first time?
Do you get any errors? Do you get any messages about programs freezing?

You may have a program thats running in the background thats not ending
normally when the system shuts down..

Reply with the details.. You can also run the following file and copy-paste
a report of the items you have at startup.. this will through some insight
into whats wrong...

http://www.spywareinfo.com/~merijn/files/startuplist.zip

Unzip and run..

Rgds
Prasad Addepalli

 

[Guest]

Hi Prasad,

Nothing happens! No error report, just the desktop. If I don't shut down
again I can carry on working.

Startup list:

StartupList report, 16/10/2005, 02:41:44
StartupList version: 1.52
Started from : C:\Documents and Settings\David\Local
Settings\Temp\StartupList.EXE
Detected: Windows XP SP2 (WinNT 5.01.2600)
Detected: Internet Explorer v6.00 SP2 (6.00.2900.2180)
* Using default options
==================================================

Running processes:

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\inetsrv\inetinfo.exe
c:\program files\mcafee.com\agent\mcdetect.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\No-IP\DUC20.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\tcpsvcs.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\mqsvc.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\soundman.exe
C:\Program Files\McAfee.com\VSO\mcvsshld.exe
C:\Program Files\NASDAK\OmniMouse Driver\4.0\MOUSE32A.EXE
C:\Program Files\McAfee.com\VSO\oasclnt.exe
C:\WINDOWS\vsnpstd.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\Program Files\Hewlett-Packard\hp business inkjet 1100
series\Toolbox\mpm.exe
C:\WINDOWS\System32\khooker.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\System32\mqtgsvc.exe
C:\Program Files\Skype\Phone\Skype.exe
c:\program files\mcafee.com\agent\mcagent.exe
C:\Program Files\Belkin\Belkin 802.11g Wireless Card Configuration
Utility\utility.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ad-aware 6\Ad-aware.exe
C:\Program Files\Ad-aware 6\Ad-watch.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\PROGRA~1\WINZIP\winzip32.exe
C:\Documents and Settings\David\Local Settings\Temp\StartupList.exe

--------------------------------------------------

Listing of startup folders:

Shell folders Common Startup:
[C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup]
Belkin 802.11g Wireless Card Utility.lnk = ?
BT Broadband Help.lnk = C:\Program Files\BT Broadband\Help\bin\matcli.exe

--------------------------------------------------

Checking Windows NT UserInit:

[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
UserInit = C:\WINDOWS\system32\userinit.exe,

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run

SynTPLpr = C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
SynTPEnh = C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
SoundMan = soundman.exe
VSOCheckTask = "C:\PROGRA~1\McAfee.com\VSO\mcmnhdlr.exe" /checktask
VirusScan Online = C:\Program Files\McAfee.com\VSO\mcvsshld.exe
MCAgentExe = c:\PROGRA~1\mcafee.com\agent\mcagent.exe
MCUpdateExe = c:\PROGRA~1\mcafee.com\agent\McUpdate.exe
MsmqIntCert = regsvr32 /s mqrt.dll
Ad-watch = C:\Program Files\Ad-aware 6\Ad-watch.exe
LWBMOUSE = C:\Program Files\NASDAK\OmniMouse Driver\4.0\MOUSE32A.EXE
OASClnt = C:\Program Files\McAfee.com\VSO\oasclnt.exe
snpstd = C:\WINDOWS\vsnpstd.exe
RemHelp = remhelp.exe
Synchronization Manager = %SystemRoot%\system32\mobsync.exe /logon
PinnacleDriverCheck = C:\WINDOWS\system32\PSDrvCheck.exe -CheckReg
HPWH myPrintMileage Agent = C:\Program Files\Hewlett-Packard\hp business
inkjet 1100 series\Toolbox\mpm.exe
SiS KHooker = C:\WINDOWS\System32\khooker.exe
PCMMRealtime = C:\Program Files\PC MightyMax\pcmm.exe /R
GSICONEXE = GSICON.EXE
Cmaudio = RunDll32 cmicnfg.cpl,CMICtrlWnd

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run

CTFMON.EXE = C:\WINDOWS\system32\ctfmon.exe
Skype = "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized

--------------------------------------------------

Shell & screensaver key from C:\WINDOWS\SYSTEM.INI:

Shell=*INI section not found*
SCRNSAVE.EXE=*INI section not found*
drivers=*INI section not found*

Shell & screensaver key from Registry:

Shell=Explorer.exe
SCRNSAVE.EXE=C:\WINDOWS\System32\PHOTOI~1.SCR
drivers=*Registry value not found*

Policies Shell key:

HKCU\..\Policies: Shell=*Registry key not found*
HKLM\..\Policies: Shell=*Registry value not found*

--------------------------------------------------


Enumerating Browser Helper Objects:

(no name) - C:\Program Files\Adobe\Acrobat
5.0\Acrobat\ActiveX\AcroIEHelper.ocx - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}

--------------------------------------------------

Enumerating Task Scheduler jobs:

McAfee.com Scan for Viruses - My Computer (DAVIDSLAPTOP-David).job

--------------------------------------------------

Enumerating Download Program Files:

[Windows Genuine Advantage Validation Tool]
InProcServer32 = C:\WINDOWS\system32\LegitCheckControl.DLL
CODEBASE = http://go.microsoft.com/fwlink/?linkid=39204

[{8AD9C840-044E-11D1-B3E9-00805F499D93}]

[{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}]
CODEBASE =
http://fpdownload.macromedia.com/get/shockwave/cabs/flash/ultrashim.cab

[{9F1C11AA-197B-4942-BA54-47A8489BB47F}]
CODEBASE =
http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37843.635474537

[{CAFEEFAC-0014-0000-0001-ABCDEFFEDCBA}]

--------------------------------------------------

Enumerating Winsock LSP files:

NameSpace #4: C:\WINDOWS\system32\pnrpnsp.dll
NameSpace #5: C:\WINDOWS\system32\pnrpnsp.dll

--------------------------------------------------

Enumerating ShellServiceObjectDelayLoad items:

PostBootReminder: C:\WINDOWS\system32\SHELL32.dll
CDBurn: C:\WINDOWS\system32\SHELL32.dll
WebCheck: C:\WINDOWS\System32\webcheck.dll
SysTray: C:\WINDOWS\System32\stobject.dll
UPnPMonitor: C:\WINDOWS\System32\upnpui.dll

--------------------------------------------------
End of report, 6,715 bytes
Report generated in 1.051 seconds

Command line options:
/verbose - to add additional info on each section
/complete - to include empty sections and unsuspicious data
/full - to include several rarely-important sections
/force9x - to include Win9x-only startups even if running on WinNT
/forcent - to include WinNT-only startups even if running on Win9x
/forceall - to include all Win9x and WinNT startups, regardless of platform
/history - to list version history only

 

[Leythos]

Nothing happens! No error report, just the desktop. If I don't shut down
again I can carry on working.

HiJack logs don't belong posted here - there are hundreds of online
sites where you can post them and get feedback about the changes needed.

Download one of the spyware removal tools, get a quality AV product, run
both in SAFE MODE.

 

[mem]

That is not a HJT log stupid.

HiJack logs don't belong posted here - there are hundreds of online
sites where you can post them and get feedback about the changes needed.

Download one of the spyware removal tools, get a quality AV product, run
both in SAFE MODE.

 

[Malke]

That is not a HJT log stupid.

Actually it *is* an HJT log. Note that I am carefully not calling you
names. I am *thinking* them, though. There was no reason for you to be
rude and you added nothing to help the OP.

To the OP: In addition to doing the normal checks for malware (see link
below for general malware removal steps), here is an excellent shutdown
troubleshooter to help focus your search for the culprit(s):
http://www.aumha.org/win5/a/shtdwnxp.htm

http://www.elephantboycomputers.com/page2.html#Removing_Malware

Malke

 

[Guest]

When you to have finished your debate, which is not at all helpfull and seems
to continue through most of the threads on this group, the first reply I got
ASKED ME to post the start up list.

I accept it is against the "Rules" and I won't do it again but it would be
have been more helpful of your comments were constructive and addressed the
issue.

Please don't was't our time by continuing your debate on our posts!

Briggers

 

[Lil' Dave]

You haven't done anything "against the rules". In fact the information may
be invaluble towards finding a solution.

In the future, post your reply to the previous replier you are replying to.
Believe you're responding to "Leythos".

Your reply only shows a reply to yourself. See below.

 

[Malke]

You haven't done anything "against the rules". In fact the
information may be invaluble towards finding a solution.

In the future, post your reply to the previous replier you are
replying to. Believe you're responding to "Leythos".

Your reply only shows a reply to yourself. See below.

A startup list is not a HijackThis log. However, it really doesn't
matter at this point. You've been given answers already. Scan for
malware and go through the shutdown troubleshooter. If this seems like
more work than you want to do - and there is no shame in admitting that
- take the machine to a professional computer repair shop (not your
local equivalent of BigStoreUSA).

For your convenience, here are the links I gave you in my previous post
for general malware removal and the shutdown troubleshooter:

http://www.elephantboycomputers.com/page2.html#Removing_Malware
http://www.aumha.org/win5/a/shtdwnxp.htm

Malke

 

[The Computer Lab of Zephyrhills]

If that was considered rude then someone is just a little too sensitive. I
see posters ask stupid questions all the time. Why? Because they don't
read the original question correctly. That's why things put in writing are
supposed to be easier to deal with than verbal over-the-phone issues, you
big dummy.


--
John Novikoff Jr
The Computer Lab of Zephyrhills
http://www.zcomputerlab.com
813-715-0444
Training, Repairs, and PC Sales

 

[Rock]

If that was considered rude then someone is just a little too sensitive. I
see posters ask stupid questions all the time. Why? Because they don't
read the original question correctly. That's why things put in writing are
supposed to be easier to deal with than verbal over-the-phone issues, you
big dummy.

Calling someone stupid if you disagree with their response certainly is
rude. Besides mem aka pcbutts has a personal issue with Leythos and was
intentionally trying to insult him. That is even more rude which is
consistent with his childish attitude.

 

[Guest]

CAN YOU PLEASE STOP BICKERING AMONGST YOURSELF ON MY POST, GO FIND ANOTHER
FORUM IF YOU WISH TO CONTINUE YOUR DEBATE.

If you have something constructive to contribute to the topic feel free to
reply.

Briggers

 

[Guest]

Hi Malke,

Sorry about the posting to myself - a slip of the mouse.

Just to let you know, I run Mcafee AV which is cntinually updated and I run
Adware 6.0. Scans in Safe Mode with these progs show no 'Malware'

I checked on the 'Startup problems' web page and although its very useful my
specific problem is not covered. I am not surprised as judging from the lack
of information on this forum, it would seem that I am the only one to suffer
from it.

I will get round to checking the 'workarounds' but this will take more time
than I have at the moment - much easier to just shut down twice.

Briggers

 

[Kelly]

Hi Prasad,

There are forums designed for posting start-up items such as log files, etc.
However, this isn't one of them. Either have them post these files to
yourself or find the appropriate forum. )

--

All the Best,
Kelly (MS-MVP/DTS&XP)

Troubleshooting Windows XP
http://www.kellys-korner-xp.com

In memory of those lost during Katrina &
Prayers and Hope for the remaining displaced.

 

[Kelly]

Hi,

This can be due to several reasons. Suggestion and checkpoints to consider:

Disable everything that reads 'Wake up' in the BIOS settings. Also, I have
seen this behavior if you have a CD/DVD in the drive during a shutdown.

Shutdown Event Tracker - Line 373:
http://www.kellys-korner-xp.com/xp_tweaks.htm

Power the Computer Off or Reboot After Shutdown

This edit controls whether Windows should automatically power down or reboot
your computer once it has finished the shutdown process.

Power Off or Reboot After Shutdown (Line 76)
http://www.kellys-korner-xp.com/xp_tweaks.htm

User Profile Hive Cleanup Service (Line 36) Right hand side
http://www.kellys-korner-xp.com/xp_tweaks.htm

This edit automatically ends tasks and timeouts that prevent programs from
shutting down and clears the Paging File on Exit.

Auto End Tasks to Enable a Proper Shutdown (Line 76)
http://www.kellys-korner-xp.com/xp_tweaks.htm

Shutdown.Exe - Andrej Budja (Line 52)
http://www.kellys-korner-xp.com/xp_tweaks.htm

--

All the Best,
Kelly (MS-MVP/DTS&XP)

Troubleshooting Windows XP
http://www.kellys-korner-xp.com

In memory of those lost during Katrina &
Prayers and Hope for the remaining displaced.

Hi Prasad,

Nothing happens! No error report, just the desktop. If I don't shut down
again I can carry on working.

Startup list:

StartupList report, 16/10/2005, 02:41:44
StartupList version: 1.52
Started from : C:\Documents and Settings\David\Local
Settings\Temp\StartupList.EXE
Detected: Windows XP SP2 (WinNT 5.01.2600)
Detected: Internet Explorer v6.00 SP2 (6.00.2900.2180)
* Using default options
==================================================

Running processes:

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\inetsrv\inetinfo.exe
c:\program files\mcafee.com\agent\mcdetect.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\No-IP\DUC20.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\tcpsvcs.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\mqsvc.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\soundman.exe
C:\Program Files\McAfee.com\VSO\mcvsshld.exe
C:\Program Files\NASDAK\OmniMouse Driver\4.0\MOUSE32A.EXE
C:\Program Files\McAfee.com\VSO\oasclnt.exe
C:\WINDOWS\vsnpstd.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\Program Files\Hewlett-Packard\hp business inkjet 1100
series\Toolbox\mpm.exe
C:\WINDOWS\System32\khooker.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\System32\mqtgsvc.exe
C:\Program Files\Skype\Phone\Skype.exe
c:\program files\mcafee.com\agent\mcagent.exe
C:\Program Files\Belkin\Belkin 802.11g Wireless Card Configuration
Utility\utility.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ad-aware 6\Ad-aware.exe
C:\Program Files\Ad-aware 6\Ad-watch.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\PROGRA~1\WINZIP\winzip32.exe
C:\Documents and Settings\David\Local Settings\Temp\StartupList.exe

--------------------------------------------------

Listing of startup folders:

Shell folders Common Startup:
[C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup]
Belkin 802.11g Wireless Card Utility.lnk = ?
BT Broadband Help.lnk = C:\Program Files\BT Broadband\Help\bin\matcli.exe

--------------------------------------------------

Checking Windows NT UserInit:

[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
UserInit = C:\WINDOWS\system32\userinit.exe,

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run

SynTPLpr = C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
SynTPEnh = C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
SoundMan = soundman.exe
VSOCheckTask = "C:\PROGRA~1\McAfee.com\VSO\mcmnhdlr.exe" /checktask
VirusScan Online = C:\Program Files\McAfee.com\VSO\mcvsshld.exe
MCAgentExe = c:\PROGRA~1\mcafee.com\agent\mcagent.exe
MCUpdateExe = c:\PROGRA~1\mcafee.com\agent\McUpdate.exe
MsmqIntCert = regsvr32 /s mqrt.dll
Ad-watch = C:\Program Files\Ad-aware 6\Ad-watch.exe
LWBMOUSE = C:\Program Files\NASDAK\OmniMouse Driver\4.0\MOUSE32A.EXE
OASClnt = C:\Program Files\McAfee.com\VSO\oasclnt.exe
snpstd = C:\WINDOWS\vsnpstd.exe
RemHelp = remhelp.exe
Synchronization Manager = %SystemRoot%\system32\mobsync.exe /logon
PinnacleDriverCheck = C:\WINDOWS\system32\PSDrvCheck.exe -CheckReg
HPWH myPrintMileage Agent = C:\Program Files\Hewlett-Packard\hp business
inkjet 1100 series\Toolbox\mpm.exe
SiS KHooker = C:\WINDOWS\System32\khooker.exe
PCMMRealtime = C:\Program Files\PC MightyMax\pcmm.exe /R
GSICONEXE = GSICON.EXE
Cmaudio = RunDll32 cmicnfg.cpl,CMICtrlWnd

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run

CTFMON.EXE = C:\WINDOWS\system32\ctfmon.exe
Skype = "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized

--------------------------------------------------

Shell & screensaver key from C:\WINDOWS\SYSTEM.INI:

Shell=*INI section not found*
SCRNSAVE.EXE=*INI section not found*
drivers=*INI section not found*

Shell & screensaver key from Registry:

Shell=Explorer.exe
SCRNSAVE.EXE=C:\WINDOWS\System32\PHOTOI~1.SCR
drivers=*Registry value not found*

Policies Shell key:

HKCU\..\Policies: Shell=*Registry key not found*
HKLM\..\Policies: Shell=*Registry value not found*

--------------------------------------------------


Enumerating Browser Helper Objects:

(no name) - C:\Program Files\Adobe\Acrobat
5.0\Acrobat\ActiveX\AcroIEHelper.ocx -
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}

--------------------------------------------------

Enumerating Task Scheduler jobs:

McAfee.com Scan for Viruses - My Computer (DAVIDSLAPTOP-David).job

--------------------------------------------------

Enumerating Download Program Files:

[Windows Genuine Advantage Validation Tool]
InProcServer32 = C:\WINDOWS\system32\LegitCheckControl.DLL
CODEBASE = http://go.microsoft.com/fwlink/?linkid=39204

[{8AD9C840-044E-11D1-B3E9-00805F499D93}]

[{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}]
CODEBASE =
http://fpdownload.macromedia.com/get/shockwave/cabs/flash/ultrashim.cab

[{9F1C11AA-197B-4942-BA54-47A8489BB47F}]
CODEBASE =
http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37843.635474537

[{CAFEEFAC-0014-0000-0001-ABCDEFFEDCBA}]

--------------------------------------------------

Enumerating Winsock LSP files:

NameSpace #4: C:\WINDOWS\system32\pnrpnsp.dll
NameSpace #5: C:\WINDOWS\system32\pnrpnsp.dll

--------------------------------------------------

Enumerating ShellServiceObjectDelayLoad items:

PostBootReminder: C:\WINDOWS\system32\SHELL32.dll
CDBurn: C:\WINDOWS\system32\SHELL32.dll
WebCheck: C:\WINDOWS\System32\webcheck.dll
SysTray: C:\WINDOWS\System32\stobject.dll
UPnPMonitor: C:\WINDOWS\System32\upnpui.dll

--------------------------------------------------
End of report, 6,715 bytes
Report generated in 1.051 seconds

Command line options:
/verbose - to add additional info on each section
/complete - to include empty sections and unsuspicious data
/full - to include several rarely-important sections
/force9x - to include Win9x-only startups even if running on WinNT
/forcent - to include WinNT-only startups even if running on Win9x
/forceall - to include all Win9x and WinNT startups, regardless of
platform
/history - to list version history only


--
Some things don't matter very much; most things don't matter at all

What exactly happens when you try to do a normal shut down the first
time?
Do you get any errors? Do you get any messages about programs freezing?

You may have a program thats running in the background thats not ending
normally when the system shuts down..

Reply with the details.. You can also run the following file and
copy-paste
a report of the items you have at startup.. this will through some
insight
into whats wrong...

http://www.spywareinfo.com/~merijn/files/startuplist.zip

Unzip and run..

Rgds
Prasad Addepalli

 

[Rock]

CAN YOU PLEASE STOP BICKERING AMONGST YOURSELF ON MY POST, GO FIND ANOTHER
FORUM IF YOU WISH TO CONTINUE YOUR DEBATE.

If you have something constructive to contribute to the topic feel free to
reply.

Briggers

You have received several good responses with ways you can proceed to
troubleshoot this issue. Note that this is usenet and a volunteer based
newsgroup with free support. People post what they feel like.

 

[Plato]

Please don't was't our time by continuing your debate on our posts!

Please learn what USEnet is all about.