Resolved Long Windows Shutdown Time

Windows XP Home, Sp 3 with all updates.

If Windows is started and many programs are run, even simultaneously, operation is normal. If, in a short time, a few minutes for example, the machine is shut down, it takes only a few seconds to complete.

However, if the machine is left idle for some time, 15 to 30 minutes or so, and then shut down, it takes 5 minutes or so between the Start/shutdown command and the appearance of the shutdown selection window and then another 5 minutes or so before the machine actually shuts down. Rather than leave the machine idle, several programs can be opened and closed successfully with no change in the outcome. During this shutdown time, the hourglass is present and Task Manager is inoperative. Prior to giving the shutdown command, Task Manager shows little or no activity in the cpu or ram.

I use Avast and have run the system scan and the rootkit scan.

Msconfig, Startup Delayer, Codestuff Starter and Autoruns don’t seem to show anything unusual.

I have 3 computers with Win XP, so I can do comparisons. This particular machine has not always behaved this way, but I don’t recall when it started. It is an AMD Athlon 64 3500+, 2.20 Ghz with 1 GIG of RAM.

Can anyone suggest what the problem is and how to go about fixing it?

Thank you.

 

Hi sdculp, I found this: User Profile Cleanup Service. It's a MS Tool.
http://www.microsoft.com/en-us/download/details.aspx?displaylang=en&id=6676

Let's know if it works for you. Cheers Neil.

 

Thanks for the response. I installed the software, and I guess it’s running in the background although there’s no way to know. If you execute the software you get a black window which seems to be asking for something, but it doesn’t respond to keyboarding and disappears after a few seconds.

After the unspecified period, the computer takes about 110 seconds to get from the start/shutdown command to the little window which asks for logoff/restart/shutdown. After that, the actual shutdown time seems pretty normal. I'm not sure if there has been any improvement or not.

There doesn’t seem to be anything else wrong, except the engineer in me just doesn’t like it.

 

Have you opened Task Manager before you shut down to see whats running in Applications and Processes.
Have you tried the Shut down from Task Manager? Neil.

 

Further to previous Post I found the info relating to this a while back which I had put in Documents:
Open REGEDIT.
'HKEY_CURRENT_USER\Control Panel\Desktop\'
Highlight the 'WaitToKillAppTimeout' value.
Set it to '1000' (the default should be 20000).
Now highlight the 'HungAppTimeout' value. Set it to '1000' also.
The second part of this tip changes the same settings, this time for all users on the system.
Navigate to 'HKEY_USERS\.DEFAULT\Control Panel\Desktop'
Highlight the 'WaitToKillAppTimeout' value.
Set it to '1000' (the default should be 20000).
Now highlight the 'HungAppTimeout' value. Set it to '1000' also.
In the third part of this, will alter a second registry setting to decrease the amount of time Windows XP will wait before shutting down active services after receiving a shut down command.
Open REGEDIT and navigate to 'HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\'
Highlight the value 'WaitToKillServiceTimeout' Change this value to '1000.'
This should help to considerably speed up the time windows XP takes to shut itself down
Auto kill tasks on shutdown
To allow Windows XP to close non-responsive applications automatically upon shutdown:
Open REGEDIT and navigate to 'HKEY_CURRENT_USER\Control Panel\Desktop'
Highlight the value 'AutoEndTasks.' Change the value to '1'
Also 'HKEY_USERS\.DEFAULT\Control Panel\Desktop'
Highlight the value 'AutoEndTasks.' Change the value to '1'
Shutdown only took around 35 seconds.

I checked this on one of my XP SP3 comps and it worked a treat.
Don't forget - Backup before doing anything in the Registry.
And as always I won't accept responsibility for problems that may arise. Neil.

 

System restore wasn't the culprit. I'm really reluctant to change the registry, because that masks the problem rather than fixes it. The parameter in the registry which tells Windows to shut down regardless of who is hanging it up doesn't really fix anything.

I feel that it isn't a malware problem. Some of the more exotic malware search and fix software leaves the machine either in worse shape or inoperable. In 20 years of computing I've never had a malware problem.

Somehow I have to find out which software is taking so long to shut down. Nearly all the software is the same as that in the other two machines. Maybe looking for the odd ones and uninstalling them is one way to go about it, although one of the common ones might be corrupt.

Also, the fact that a period of time must elapse before the problem occurs might be a clue to something, like someone is looking for an update or some kind of periodic check.

I appreciate your ideas.

 

I am not doubting you on the malware statement. But I find this really hard to believe. We all get something at some time or another if you get on the web. Drivebys are a dime a dozen.

 

__________________________________________________________________
Thanks for your continuing support. I keep trying things.

I shut down System Restore. Don’t know why I had it on, anyway. It saved my bacon in Windows ME, but hasn’t seemed to help as it should in XP. I rely on triple redundant backups with Acronis, EaseUs To Do Backup Free and Macrium Reflect. Unfortunately my second hard drive, with backups, failed, so I lost all of them. I do have some old backups of this machine in an external hard drive now connected to another machine which I could move into the new drive. But I haven’t always experienced seamless operation with recoveries, so that will be a last resort, I guess. Anyway, stopping System Restore didn’t help.

I’ve not experienced Avast doing a scan during shutdown, but I shut it down just to see. No change. Actually, this problem doesn’t occur until the machine has been running for quite a while.

I ran Spybot Search and Destroy and was surprised to find trojan.sirefef. No thanks to Avast!! Removed it. No change.

I ran AdAware and found Trojan.WIN32.Generic!BT. No thanks to Avast and Spybot!! Removed it. No change. While researching this trojan, I found links and references to Combofix. I have had experience with Combofix and other more exotic fixes and have found that they create their own havoc which can result in the need for a complete wipe and reinstall, so I won’t be trying any of them again.

I tried a system shutdown from Task Manager, but that didn’t help.

I tried watching what processes were present during shutdown, but of course there are dozens. I keep looking through them to see if something is there which is suspect, but it is a daunting job. If I were to shut down, say half of them, to see what happened, would that damage the OS? Would they just start up again on reboot??

In doing a bit of research on this problem, I found some interesting discussion at http://www.aumha.org/win5/a/shtdwnxp.php which says I might not be alone, and that it can be common in XP, but nevertheless it is a new situation for me.

I stopped a couple of services in Control Panel | Administrative Tools | Services. No help.

There is an apparently simple way to fix the registry by modifying HKEY_CURRENT_USER\Control Panel\Desktop In the right pane find, "AutoEndTasks" (Create if not present). Set the Value of 0 or delete it. No reboot needed. But, again, this doesn’t fix anything—just masks it.

At this point, I’m continuing to work with Msconfig, Startup Delayer, Codestuff Starter and Autoruns to see if I can find anything. Also, uninstall programs that don’t really belong in a spare computer and were never used.

Finally, I could backup the existing OS and reinstall one of the old backups to see how it works. If it didn’t satisfy I can, in theory, go back to the existing one. But restoring backups has many times not worked very well.

 

Forgot to mention that I tried Malwarebytes. Found nothing. Didn't know about Superantispyware. Will look it up and try it.

 

In Codestuff Starter I disabled all items under the "Startups" tab. No change

 

Post a DDS log and let some of us look at it and see what is in there.
DDS Download
I know that you had problems with Malware before and Broni helped you out there. Could be you picked up something again. Maybe want to head back over there and start a new post with the problems you are having. Not saying you have Malware, but stranger things have happened.

 

I downloaded DDS.com. When I execute it, I get a flash of a black window on the screen which instantly disappears and nothing else happens. Tried it several times. No luck.

 

After running AdAware the bootup time for the computer went to a couple of minutes. Looking in Task Manager I found a Lavaware service running. Researching it I find that it is notorious for causing slow boots. Tried to eliminate it with options and gave up—finally removed it.

Ran Superspyware. Found10 or 15 items—mostly pertaining to adware. Removed them. No change.

 

No thanks to DDS, which doesn’t seem to work, I did a bit of sleuthing and a lot of learning. I went to Control Panel-Administrative Tools-Event Viewer-System and found some errors. In the Properties of one, it stated "The server……..did not register with DCOM within the required timeout. From there, I followed the link to the Micrososft Help and Support Center.

The MHSC talked about a program not replying within the timeout period of two minutes (Which, by the way, is the time between Start-Shutdown or Restart and the appearance of the selection window). It talks about the program vendor, which I don’t know, of course.

Then it gives the following instructions:
"To determine the program vendor
Using Regedit, navigate to the following registry value
HKCR\Clsid\clsid value\localserver32
The clsid value is the information displayed in the message.
In the right pane, double-click Default. The Edit String dialog box is displayed. Leave this dialog box open.
Click Start, and then click My Computer.
Using the information displayed in the Value data box of the Edit String dialog box, navigate to the program.
Right-click the program name, and then click Properties.
The Properties dialog box for the program is displayed.
To determine who the vendor is for this program, refer to the Version tab.â€

The problem here, is that HKCR\Clsid\clsid value\localserver32 cannot be found via a registry editor "find" activity.

Strange that the Microsoft instruction refers to something that isn’t there.

Someone is using memory and refuses to give it up. The issue is to find out who.

 

An unexpected solution!!!

I recently noticed that this computer had not updated since early this year. Control Panel-Automatic Updates was set to automatically check each AM at 9:00.

The WindowsUpdate.log seemed to say it had been unsuccessfully trying but failing, but I didn’t understand the terminology. I downloaded and ran Microsoft programs FixitCenter_Run.exe and MicrosoftFixit.wu.MATSKB.Run.exe programs. Both of these indicated that there were no problems with automatic update.

Then, while in Control Panel-Automatic Updates I clicked the Windows Update Web Site link. Although my default browser is Firefox, it took me to Microsoft Update-Windows Internet Explorer. It then gave me a message saying that Active X was needed and gave instructions as to how to install it. The instructions about right clicking one of the bars to install Active X didn’t offer the desired choice, but I was able to change the viewing bars to get the proper right click instruction.

After the Active X installation was complete the program checked for automatic updates and found over 40. Installation of these updates proceeded OK and the results checked out in the Add-Remove Programs list and in the WindowsUpdate.log.

Only time will tell if the AU problem has been fixed, however now the machine restarts and shuts down without delay regardless of how long it has been on. I can’t imagine how Active X could have had anything to do with the solution, so it must have been one of the Fixit programs.

 

I should have replied with the results by now, but "when things ain't broke" one tends to forget about them. The system updates regularly, now, and the slow shutdown problem has gone away. How the update feature could affect this, I don't know.

Problem solved.