Shutdown hangs

Hi Everyone,

I am working on a Dell 2.4Ghz ex-business machine that my friend is using for a home computer. He has installed a few games for the kids and the software for a new printer.

If you go the desktop then select shutdown it will shutdown correctly. If you do any sort of activity it will hang after the "Saving your settings" screen.

I've disabled the inbuilt LAN and now I'm going to remove the logon so that it is not trying to save any network information (it is stand alone).

Next areas are the games. One game was built for 95, but I doubt it is causing the problem. I will uninstall it anyway.

I am really starting to think it is the Canon printer software. Now I remember a problem I had getting very long shutdowns on a Win98 machine that I had installed Canon digital camera software on.

Anyone care to make a comment or seen something similar?

Matt

 

mattman--Several possibilities and solutions
http://www.google.com/search?source...GGLD:2004-31,GGLD:en&q=win2000+shutdown+hangs

If you mean you are reactivating a program by "do any sort of activity ", that could certainly be the cause of the problem. Windows shutdown means all programs have to also be shut down. An active program could certainly cause a hang as several of the articles in the above reference mention.

 

Hi Jim,

No, just boot straight to the desktop, then shutdown. Shutdown works. If I open any programs, shutdown hangs, doesn't matter what sort of program [I think...haven't tested everything]

Big sorry, the hang is after the "Windows is shutting down" screen and is a plain blue blank screen.

I will check that link, Windows knowledgebase does not seem to think Win 2k has shutdown problems

Thanx
Matt

 

mattman--Sorry I misunderstood.
It sounds like one of the programs running just before shutdown is hanging. But I understand you are not getting any message about a specific program needing to "End Task ". Correct?
Have a look in TaskManager right after startup and compare it to the list of running processes after activating a normal session's worth of programs but after you have CLOSED each such program. Are any of the programs you closed still active?

P.S. Perhaps some ideas here
http://support.microsoft.com/default.aspx?scid=kb;en-us;315409

 

You found the MS information, it must have been hiding when I searched .

I won't be able to run the tests for a few days.

I uninstalled the Canon program, no change

Matt

 

Not much luck.

It is not related to third party applications. If I use Windows applications or tools it also does it. ALSO does it in Safe Mode.

Is there a System File Checker for Win 2K?

I have reinstalled any flagged problems in Device Manager, everthing, including Hidden Devices, now apparently OK (although I might try updating or reinstalling the chipset drivers).

Next step seems to be a repair. Any advice on how to go about it?

Regards
Matt

 

mattman--Not clear if you tried what I suggested in post #4
"Have a look in TaskManager right after startup and compare it to the list of running processes after activating a normal session's worth of programs but after you have CLOSED each such program. Are any of the programs you closed still active?"
These could be either Windows or third party programs. What I am suggesting is an attempt to see what is actually not shutting down--even though you think you have closed the program-- and therefore causing the hanging. If we can find that, we can work on getting it to shut down.

To the best of my knowledge Win2000 does have System File Checker.
See
http://support.microsoft.com/default.aspx?scid=kb;en-us;329862
I believe you can skip step #3 since that is for the Add/Remove problem, which you do not have.
However, whether SFC will help your problem, I do not know. I guess it cannot hurt.

 

Jim, PARTIAL success! I am working on it when I can. I decided to review your suggestions and work on those for a little longer.

In Task Manager there are no Applications listed after they are closed. I went to a website that has information about changing Services settings. I have set a quite a few to manual and especially those that seem to be third party (networking) programs.

Partial success was that it did shut down correctly a few times after changing the Services settings, but seems to "revert ". I notice that even though some of the services I have set as manual are running (started) at boot (eg, Workstation). I think there is something that wants to connect to the (previous) network before shutdown. It also seemed to shutdown OK for a while when I reduced some of the security settings that seemed to be set.
Thought I had nailed it...for a little while It seems to just keep coming back.

Let me know if you might see something here.

Whether it is some sort of third party program or a corrupt Windows file I will try to determine (hope it's not a registry problem).

Matt

 

mattman--Workstation is definitely not a Service that should be disabled. It should be set at Automatic.
You can see what shutting Workstation down will affect here
http://www.theeldergeek.com/workstation.htm

What other Services did you change when you had better luck shutting down?

When you are in the Services window, right click on a Service|Properties. The General tab will show you what it does. But, more importantly, look at the Dependencies tab. That shows what other services must be running for the specific Service to work and conversely what other Services depend on the specific Service in order that they work.
In general I do not recommend monkeying with Services, unless you know what you are doing.
The following reference has many suggestions for advanced users, but you can see the warning in red in the second paragraph.
http://www.theeldergeek.com/services_guide.htm

Based on your first post, I understood that the shutdown problem does not occur if you log on Windows and then almost immediately log off. It occurs only after you have been using the PC for a while. That suggests the problem is being caused by a program not involved with start up. That is why I made the suggestion in Post #4. (These generally are not programs started from Services.)
One of the most common tasks running is svchost.exe. Actually it is helping other programs and processes to run, and these other processes may not show in Task Manager. If you are running WinXP Pro, you can see these other processes by opening a Command Prompt|type tasklist /svc|Enter. Under one or more of the listings for svchost.exe, you will see all the processes it is helping to run. Perhaps one of those is hanging the shutdown.

I wonder if Event Viewer might help you find the reason for the hang
http://support.microsoft.com/default.aspx?scid=kb;en-us;302542&sd=tech

And the last paragraph here may give you some ideas
http://www.windowsnetworking.com/articles_tutorials/Troubleshooting-Windows-Shutdown.html
Also
http://www.google.com/search?source...D:2004-31,GGLD:en&q=win+2000+shutdown+problem

Sorry for the shotgun approach, but the normal solutions do not seem to have worked.

 

Jim, he's running W2K.

Don't know if Taksklist.exe will run on that OS. If its not there:

Download from here http://www.computerhope.com/download/winxp.htm and move it to the \WINDOWS\System32 folder.

Regards - Charles

 

charlesvar--Thanks, I had forgotten.

A substitute for Tasklist is
http://ask-leo.com/what_is_tasklistexe_and_why_dont_i_have_it.html

 

Jim, I'm not disabling services, only going to manual, but some are being started at boot even then.

I checked what services were running for a good shutdown and a bad one, only an extra instance of Svchost.

I'll try the tasklist possibilities. I love these encounters with Windows, it tells me about it's inner workings. I usually bang my head on it until it cracks. Since XP is a product of both 2000 and 98, this will give me some insight into how XP works. Thanks for the help guys.

Matt

 

Hi jdc071301, I just checked, same number of processes for boot and for stalled shutdown (18). Gives me an idea though. When I started working on this machine, Windows Longon requested a password, it was a blank password. Now it boots through to the desktop automatically. Maybe it is a service or security setting I have changed, but maybe the problem relates to logon/logoff (I can see the logon box flash past at boot).

I'll try setting a password then setting it back to blank.

Matt

 

mattman--Do you have the file tlist.exe on your PC? If so, type tlist\tlist -s |Enter from a Command prompt. It will show you what processes are running under the svchost.exe that TaskManager indicates is still open.
P.S.--This is the same thing as the tasklist suggestions above. Just that if you already have tlist.exe on your PC you will not have to download anything else.

 

No tlist Jim. I got that download, will try it on the W/E.

I if can't find it with the tasklist, I am going to Ghost a copy of the HDD, then I'll start trying some "heavy duty" testing

Matt

 

Mattman:
Perhaps this will help you run it down too.

 

Hello Rockster, I will have a look.

Dis is one tough cookie

Have a look at this, my checkbox finger is itching :

Platform: Windows 2000 (WinNT 5.00.2195)
MSIE: Internet Explorer v5.00 (5.00.2920.0000)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\locator.exe
C:\WINNT\Explorer.exe
C:\WINNT\System32\ctfmon.exe
C:\Program Files\Hijack This\HijackThis.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [TCASUTIEXE] TCAUDIAG -off
O4 - HKLM\..\Run: [WinVNC] "C:\Program Files\ORL\VNC\WinVNC.exe" -servicehelper
O4 - HKCU\..\Run: [ctfmon.exe] ctfmon.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = XXXXXXX.ORG.AU
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = XXXXXXX.ORG.AU
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = XXXXXXX.ORG.AU
O20 - Winlogon Notify: NavLogon - C:\WINNT\System32\NavLogon.dll
O23 - Service: 3Com DMI Agent (3ComDMIService) - 3Com Corporation - C:\WINNT\System32\3Com_DMI\3CDMINIC.EXE
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: VNC Server (winvnc) - Unknown owner - C:\Program Files\ORL\VNC\WinVNC.exe" -service (file missing)

This is cloned drive, so I'm not worried if trying something may fail.
I X'd out the organisation's name.

Matt
Edit: I like (?) all those Canon entries, it has been uninstalled

 

I remember having aproblem with lsass.exe at one time. Usually it is part of windows logon, but sometimes it is an unwanted process.

Download security task manager here:

http://www.neuber.com/taskmanager

I hope this helps

JC

 

Matt:

If the Cannon is gone it may be adviseable to install RegCleaner and use it to wipe out all of the remaining registry entries and then delete the remaining cannon files and their folder. This or something like RegSeeker to search for remaining Cannon entries. Check out Common files under Program files - you might find more Cannon stuff in there too. I'm no pro re: reading HJT logs but I'd also investigate uninstalling My Own Backup, (responsible for that mobsync entry) and killing the VNC software which shows "file missing ". You also might be smart to PM Dave Fear and have him take a look at your log.