PC will not ‘Turn Off’ but instantly re-boots

I normally keep my system running 24/7, but three days ago when I clicked on Start > Turn Off Computer and then selected Turn Off, my OS - XP Home (SP2) - went through the closing down routine but immediately re-booted instead of switching off the power. This restart was accompanied by a "˜thump’ from the speakers. Selecting Restart goes through the normal close down and re-boot but without any "˜thump’ from the speakers. To turn off the system I now have to press the rocker switch at the rear just at the moment it starts to re-boot.

This problem started when I wanted to turn off the system PRIOR TO: -
(a) replacing the case covers which had been off for some weeks
(b) resiting the system a few feet away in the same room
(c) connecting to a new Belkin UPS which replaced an existing UPS (whose surge suppression was damaged by lightning some months ago)
(d) connecting up a Iiyama TFT LCD monitor in place of a Iiyama CRT monitor
but the problem has continued AFTER these changes, so I think that rules out it being attributed to case temperature, loose cable connections, power supply or monitor problems.

I have re-booted the system a number of times, used the "˜Reset’ button and also attempted to power off by holding the "˜Start’ button in for four seconds, none of which has stopped the system from IMMEDIATELY re-booting instead of switching off the power. When using the "˜Reset’ button or holding the "˜Start’ button, the resultant reboot launches the disk checking program because the system was not properly closed down, but the system has proceeded to re-boot without problems.

Researching the problem on the Internet has directed me to the registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\Current Version\Winlogon and to set the value of PowerdownAfterShutdown to "˜1’ (without quotes). This was originally set to "˜0’ but the change has not solved the problem.

Another suggestion I came across was to navigate to Control Panel > System (Properties) > Advanced (Tab) > Startup and Recovery Settings and under "˜System Failure’ to de-select "˜Automatically restart’ in case a system error was causing the instant re-boot. This change should enable any error messages to be read, but it too has failed to solve the problem and no error messages have appeared.

On the Microsoft Knowledge Base http://support.microsoft.com/?kbid=810903 there are instructions to Enable Advanced Power Management. However although my motherboard (Matsonic MS8147C+) manual states "Supports both ACPI (Advanced Configuration and Power Interface) and legacy (APM) power management (Chipset VIA KT400A+8235)â€, and in Device Manager under "˜Computer’ it shows "˜ACPI Uniprocessor PC’, when I go to Control Panel > Power Options there is no APM Tab to enable me to select Enable Advanced Power Management Support (and I only have ONE monitor connected).

All suggestions for solving this problem will be gratefully welcomed.

 

1. It looks like you are already used to playing detective. One place I wonder if you have looked yet - your Event Logs.

Start, Run, eventvwr.msc

See if any log appears with greater detail around the time you tried to shutdown.

2. Turn of the automatic reboot so you can view the error message:

Right click My Computer, Properties, Advanced tab, Startup and Recovery -- Settings, and uncheck "automaticly restart the computer in case of error'

3. Some reading to add to your detective skills:

http://www.aumha.org/win5/a/shtdwnxp.htm
http://www.theeldergeek.com/shutdown_issues_in_xp.htm
http://support.microsoft.com/default.aspx?scid=kb;en-us;Q308029


.

 

Hi Bill

Thanks for your prompt response and links. I have already turned off the automatic reboot - see my penultimate paragraph - and I haven't seen any error messages. I had already visited the sites of your first two links, and it was from the 'aumha' site that I got the idea to turn off automatic reboot.

I had also already tried looking at Event Logs, but although I have never previously looked into these and don't know exactly what to look for, I couldn't see anything that looked to be a 'serious' problem report. On the Applications log around the time my problem first arose there are a couple of Warning logs stating: -

"Windows saved user PETERSPC\Peter registry while an application or service was still using the registry during log off. The memory used by the user's registry has not been freed. The registry will be unloaded when it is no longer in use.

This is often caused by services running as a user account, try configuring the services to run in either the LocalService or NetworkService account. "

The Security logs are all titled 'Success Audit' with one exception titled 'Failure Audit' stating : -

"IPSec Services: IPSec Services failed to get the complete list of network interfaces on the machine. This can be a potential security hazard to the machine since some of the network interfaces may not get the protection as desired by the applied IPSec filters. Please run IPSec monitor snap-in to further diagnose the problem. "

The System logs all have the title 'Information' with no sign of any errors.

The 'theeldergeek' link delves into the possibility of changing a HAL and gives a further link to a MS KB - http://support.microsoft.com/?kbid=309283 - but I would be in uncharted waters if I mess with that topic. I have searched my system for 'HAL*.dll' and it has found a total of 9 files. The first is HAL.DLL in C:\WINDOWS\system32, the second is hal.dll in C:\WINDOWS\$NtServicepackUninstall$ and the remaining seven - hal.dll, halaacpi.dll, halacpi.dll, halapic.dll, halmacpi.dll, halmps.dll and halsp.dll all appear in C:\WINDOWS\ServicePackFiles\i386. Do you have any suggestions as to whether my problem may relate to any of these files, and if so what needs to be done?

From your third link there is another link to http://support.microsoft.com/kb/311806/ but as this mentions problems with Roxio Easy CD Creator (which I don't have installed) and shows possible error messages (which I have not seen) I don't think the suggested Registry changes would be appropriate.

Any further ideas please?

 

Wonder if restarting in safe mode and then shutting down works normally. If it does, might indicate a problem driver that might be found by elimination.

 

What HAL was detected by XP during installation?

Use Device Manager and expand by clicking the "+" next to My Computer.

 

Tried Sparrow's idea to boot into Safe Mode and then Turn Off. That was no different, the PC went through the motions of closing down, but then 'thump' from the speakers and it immediately re-booted. Also tried disconnecting the power cable from the UPS to PC and plugged the PC direct into the wall socket, but again no joy.

When the + sign against Computer in Device Manager is clicked it shows 'ACPI Uniprocessor PC' and r/clicking on that and selecting Properties then the Driver tab then Driver Details button, displays three lines: -
C:\WINDOWS\system32\hal.dll
C:\WINDOWS\system32\ntkrnlpa.exe
C:\WINDOWS\system32\ntoskrnl.exe
(I have copied the text case exactly as displayed)

The failure to turn off properly has escalated from being an irritating annoyance to something that seems rather more serious. When I tried just to Restart the system (instead of Turn Off) it performed normally up to the point when XP started to re-boot and then went into the disk checking program as though the system had not been shut down properly. It did this about three times, but appeared to behave completely normally the last time I tried Restart.

At the same time as the above was happening the Belkin Plus Shutdown Software then started issuing a voice message "UPS disconnected. Cannot retrieve information from the UPS ", and the same message is displayed when the mouse is hovered over the icon in the Notification Area. This means if there is a power outage it will not shut down the PC in an orderly manner. I uninstalled this software and then re-installed it, and just as the re-install finished the same voice message was issued. I have double checked the cable connections between the PC and the UPS. Belkin give one the option of connecting by USB2 or serial port, and mine has always been by the latter.

On my system I run AVG Free Anti-virus (updated automatically and completely up to date) which is set to run a full scan every morning and it has always reported 'No virus found'. I also run Sygate Personal Firewall and was surprised when suddenly it began issuing requests for permission for certain programs to access the Internet. When I looked at the Applications list on Sygate I found only three instead of the normal twenty or so. In other words it seems as though the Sygate list has been 'wiped clean'. I just don't understand what is going on, and how the failure to power down is linked to alterations to the Belkin and Sygate software. As stated above I also bypassed the UPS and plugged the PC direct into the wall socket, but that did not solve the problem.

Please can someone put their finger on the cause of these problems?

 

I can't be any help with this one, but I really have to add that you are not alone. My girlfriends computer is doing exactly the same thing.

So I'll be watching this thread with great interest.

 

Your HAL entries are as they should be.

When you are through with your computer for the evening, run the "Full Service Scan" from the Microsoft Live Safety scan site: http://safety.live.com/site/en-us/default.htm

Do you have Defender or any anti-malware software installed, besides your antivirus?

If not, Tomorrow install Windows Defender: https://www.microsoft.com/athome/security/spyware/software/default.mspx

 

This can be caused by a setting in the BIOS. You would be looking for PowerOn by PCI card {set to Disable}, found in Power Management, under IRQ/Event Activity Detect.
If enabled, a modem or network card which has not powered down enough will trigger the restart.

 

Now for an update of the events of the past 15 hours or so. Sorry this thread and my posts are somewhat lengthy, but hopefully full disclosure of the various results will be of help to other readers who may experience similar problems.

I ran the MS 'Full Service Scan', but by the time it had finished it was about 1:30am here in the UK. I left the report on the screen, went to bed and continued with the 'fixes' today. The report stated: -

Protection No virus or spyware found
Performance 228 registry items found, 224 cleared, 4 errors, 0 skipped by user, 152.5MB of temporary files found
Defragment your hard disk Drive C:\ 11% fragmented, Drive E:\ 46%, Drive M:\ 8% OK, Drive N:\ 0% OK
Network Safety 0 Ports open

I haven't yet downloaded and run Windows Defender. Do you still recommend that I should do so in view of the relatively clean bill of health given by the Full Service Scan?

My main HDD is a WD 80GB on which I have created five partitions using Partition Magic. Their labels are - WXPMAIN, WXPTEST, W98SE, DATA PARTN (M:\) and XPIMAGES (N:\). One of the three OS partitions becomes C:\ and the other two are hidden according to which OS to boot into is selected from Boot Magic. Drive (E:\) is my original 10GB main HDD which I decided to re-install only two weeks ago as master on IDE Channel 2. After installing it I deleted all files and folders and then re-formatted it FAT32. Recently I installed Acronis True Image v9.0 Build 3677 and having made images of WXPMAIN and DATA PARTN I saved them onto a WD 80GB External USB HDD. I then restored an image of the OS to drive E: hoping to test booting from the restored image. That didn't work so I have to rethink what I need to do to test that the restore is OK, BUT I DELETED THE FILE FROM E: SO THE DISK WAS EMPTY (confirmed by Windows Explorer). Therefore I fail to understand how E: could have been 46% fragmented and why it took a very long time to defrag the drive.

None of the above had any effect on the failure to power down, and when it re-booted again the disk checking program ran. I then looked at markp62's suggestion and found that in my BIOS Power On by PCI Card was Enabled. (I only have one PCI card which provides me with 4 USB2 ports at the front of the PC case.) I disabled the BIOS setting, saved the change and allowed the bootup to complete. Then I selected Turn Off and as the closing down phase ended a voice message was issued by the Belkin software "UPS communication established ". This time the power was switched off!! However when I re-booted, the original Belkin software message "UPS disconnected. Cannot retrieve information from UPS" was issued. I have completely disconnected the cable between the PC Comm 1 port and the UPS, then reconnected and made sure both ends are properly secured in place. I then tried Turn Off twice more and it successfully turned off the power. I then tried a Restart which although successful was accompanied by the 'communication established' (closing down) and 'UPS disconnected' (bootup) messages from the Belkin software. However on each of the bootups the disk checking program has run as though the close down was not done properly.

In terms of possible spyware etc. I am uneasy about an entry in my Sygate log of Internet activity earlier this morning. It shows an outgoing TCP with a remote host of 'incredimailltd.112.207net [216.52.17.134]' and I am sure I didn't knowingly visit such a site today. A few days ago in the PC Advisor Help Forum I clicked on a link given by one of the posters in relation to a question about animated smileys. That link took me to www.incredimail.com, but when I 'pinged' that url although it timed out it gave the IP as 206.82.140.162 which is not the same as that quoted above from Sygate. Is there anything sinister about this or is there any connection between the two?

 

Roxio

There is a Roxio version 5.4 that does this, if you have this software go to the Roxio site and get 5.5.

Tom

 

You want a firewall, and an Antivirus program with active scanning capabilities, and an anti-malware program with active scanning.

If you do not have the last item, Windows Defender works well and is free.

.

 

Tom in Dallas
Thanks for the tip but I don't have Roxio on my system. I do have Nero 6 and the bits that go with it - Burning ROM and Express etc.

 

Bill Castner

I have AVG Free anti-virus which is always running in the background. I have been using it for about three or four years and so far it seems to have kept me well protected. It is set to scan my system every day and has always reported 'No virus found'. Grisoft (the program's authors) also frequently issue updates - sometimes more than once a day. I also have Sygate Personal Firewall which was free although no longer available since taken over by Symantec. Again it seems to have done a good job over the past few years. I will take your advice and install Windows Defender.

It seems that my basic problem of not powering down has been solved by disabling the BIOS Power on by PCI Card, but I don't really understand why it SUDDENLY needed to be changed as the default is 'Enabled' and I had never needed to alter it since installing the motherboard about 15 months ago. Do you have any views about it?

Do you have any further thoughts as to why the disk checking program is kicking in on bootup as though the system had not been shut down properly?

As regards the messages from Belkin's Bulldog Plus Shutdown Software, I have contacted Belkin's Support desk and they are puzzled by what I have experienced. They feel that it is a hardware problem, and have suggested trying Comm Port 2 and/or another cable - fortunately I do have one which I am going to try.

Finally do you have any thoughts about the final paragraph of my last post, and whether I have anything to worry about?

 

These are the issues that are puzzling:

1. Obviously the Belkin UPS software;

2. The Drive E question as to how an apparantly empty volume takes a long time to defragment.

3. The Disk checking question.


#1. I promise to research the Belkin issue, and its use of the Messenger and Alerter services. More later.

#2. May be normal one time. Defragment again.
If it takes a long time it is an issue of concern.

#3. Your firewall entry is not unusual. The site has multiple servers is all it appears to me to be.

#4. Disk checking.

Use the native chkntfs tool for detective work.

Start, Run, CMD

Is a Chkdsk scheduled on this volume?
chkntfs c: <<---- Edit for your hard drive letters
chkntfs e:
chkntfs f:

Was the drive marked as 'dirty'? Is a chkdsk the result of a dirty bit being set by the OS? Doublecheck:

Start, Run, CMD
fsutil dirty query C:

The result should be either:

Volume C: is not dirty
Volume C: is dirty

MS-MVP Wesley Vogel wrote: If a volume's dirty bit is set, this indicates that the file system may be in an inconsistent state. The dirty bit can be set because the volume is online and has outstanding changes, because changes were made to the volume and the computer shutdown before the changes were committed to disk, or because corruption was detected on the volume. If the dirty bit is set when the computer restarts, chkdsk/Autochk runs to verify the consistency of the volume.

Every time Windows XP starts, Autochk.exe is called by the Kernel to scan
all volumes to check if the volume dirty bit is set. If the dirty bit is
set, autochk performs an immediate chkdsk /f on that volume. Chkdsk /f
verifies file system integrity and attempts to fix any problems with the
volume.

Workaround if Drive is Dirty

Start, Run, CMD

chkntfs /x c: e: f: <<----- edit for your hard disk drive letters

This clears the 'dirty bit'.

Reboot and test.

If no joy, Go to line 82 "Disable or Enable Check Disk Upon Boot "
http://www.kellys-korner-xp.com/xp_tweaks.htm
Click on Disable to dowload a fix. Apply the fix.

Additional information:
Chkdsk.exe or Autochk.exe starts when you try to shut down or restart your
computer
http://support.microsoft.com/kb/831426

.

 

Hi Bill

Many thanks for your comments and suggestions. I tried defragging drive E and initially viewed the Analysis Report. This showed: -
Volume size 9.07GB
Cluster size 8KB
Used space 1.33GB
Free Space 7.74GB
Volume fragmentation: - Total fragmentation 18%, File fragmentation 37%, Free space fragmentation 0%
File fragmentation: - Total files = 139, Average files size 10MB, Total fragmented files = 1, Total excess fragments = 112, Average fragments per file = 1.80
Page file fragmentation: - Pagefile size = 0 bytes, Total fragments = 0
Folder fragmentation: - Total folders = 12, Fragmented folders = 1, Excess folder fragments = 0

The most fragmented files showed \HIBERFILE.SYS 512MB with 113 fragments. I clicked the Defrag button and the defrag was completed almost instantly, but the report showed exactly the same figures as above, but \HIBERFILE.SYS did not defragment. Googling for hiberfile led me to http://www.softwarepatch.com/tips/hiberfil-sys-xp.html with a good explanation about that file and how to get rid of it. Initially I thought it might have been a hangover from my original system OS W98SE, but since I had re-formatted that HDD I think the explanation for the file appearing on the E drive instead of the C drive is that the latter has only 446.5MB unused whereas I have 512MB of RAM and Hiberfile would need that much free space. Do you agree? As I am unlikely to use Hibernation I think, subject to any contrary advice you may give, I will disable hibernate support in the Power Options and that should automatically delete the file from E drive, after which I can again defrag that drive and it should then be completely empty.

I have run 'chkntfs' and 'fsutil' on both the C and E drives and both reported as 'NOT dirty'. The C drive does need to be defragged but I will have to increase the free space before I run defrag.

The failure to power down problem seems to be cured since the BIOS tweak,and I have powered down a number of times without trouble.

 

Your instincts are correct. To defrag hiberfil.sys, just disable Hibernation. Defragment the volume. Then turn it back on or leave it off. (Turning hibernation off deletes the hibernation files from all drives.)

A note. This cluster size bothers me:
Volume size 9.07GB
Cluster size 8KB

If you use CONVERT.EXE to use the ntfs filestore you will have 4kb clusters and use the drive more efficiently.

 

Hi Bill

Well I think my system is now firing on all cylinders!

When I disabled 'hibernate support' and re-booted, the HIBERFIL.sys file had not disappeared from the E drive, but the 'free' space on my C drive had increased. This makes me think there was another HYBERFIL on the C drive which was deleted when hibernate was disabled. When experimenting with the Acronis restore procedure I did restore an image of the C drive to the E drive and subsequently deleted it. Is it possible that a HIBERFIL from the restore was then left on the E drive and not deleted along with the rest of the image?

When I originally re-formatted the E drive I had overlooked the fact that the cluster (or allocation unit) size was set to 'default' which it seems is 8KB, but there is a drop down so I selected 4KB when I re-did the format, and that one is now sorted.

I have now moved and re-sized the C and M partitions and defragged each of them before making fresh images and saved then onto my external HDD, so the system should now be in tip-top condition.

Belkin Support gave me a download of updated software; they think the problem I had is possibly a fault on the serial socket on the UPS since it is now communicating via the USB connection. They are arranging to send me a replacement UPS.

 

Sounds like good news, Peter.

Best wishes.

 

Hi Bill

Yes it is good news. Also a great feeling of relief when things are working as they should, as opposed to the rather worrying time when one can't get to the bottom of a problem.

I would like to place on record my very grateful thanks to you and others for the patience you have shown and for the very helpful ideas and suggestions put forward.

Regards

Peter