Solved: XP won't shut down

[zendude]

Over the last two weeks, my XP started to take longer and longer to shut down. Now, it doesn't and I have to manually press the startup/shut down button.
XP is 2002 version; SP ;, 2.3 GHz CPU; 2.29 GHz and 0.99 GB RAM.

My virus/security suite is Zone Alarm.

I tried to use System Restore and though it does shut and restart the computer, system restore tells me it could not restore the computer.

What can I do?

 

[speed_hog]

Zendude welcome,
You may need an install disk or restore disc.
I hope you have your personal files backed.
Newer and bigger (more) RAM would help. (512mb) recommended for XP.

First try this;
CHKDSK
How to perform disk error checking in Windows XP
http://support.microsoft.com/kb/315265

**
1. Click Start, and then Run.
2. In Open, type cmd, and then press ENTER.
3. To repair errors, locate bad sectors, and recover readable information, at the command prompt, type chkdsk volume:/r, and then press ENTER.
Volume is the hard drive usually called local disk C:
**
Then try this;
System File Check
http://www.pchomecall.org.uk/support/sfc.htm
Make sure you read the whole tutorial first OK.

 

[golferbob]

here are 2 website that might help you.


http://www.aumha.org/win5/a/shtdwnxp.php

http://www.theeldergeek.com/shutdown_issues_in_xp.htm

 

[zendude]

Thanks Speed_Hog and GolferBob.
I could not implement your suggestions and the computer still hangs at shutdown.
1-At startup, Check Disk was not able to access my 'C' volume so it could not check the disk. No other message from it other it; this took a few seconds and then the computer started loading Windows. Maybe this is the same problem that is preventing me from using the System Restore function?
2-System File Checker asked for my install disk but, alas, I'm a road warrior and am approx. 10 days from home and my install disks. Can't do anything here.
3-Windows Knowledge Base Q307274 tells me there is a patch for the problem I'm having and it's in SP1 [and also SP3 which includes SP1 and SP2 patches]. My system is already running with SP3.
4-I went to User Accounts in control panel and then to change the way to log on/log off. I unchecked the Welcome screen option.

So, the problem persists and I will keep doing a hard shut down when the system hangs until I get home. I have no other problem with the computer [so far] and it has been dependable. The laptop has been my road accompanion for approximately 4+ years and this is the first problem so I consider myself lucky.

If there are other suggestions, I'll gladly follow them.

 

[zendude]

Hi, I do have 1 Gig Ram and I wa finally able to complete a shutdown, check disk (no problems found) and ran SFC (again no problems found).

My computer stills takes about 5 mins pr longer to shut down and I'm not able to get System Restore to work. It tells that that it was unable to restore the computer to the earlier point that I specified. I've tried this with a number of different times points.

Any other suggestions?
thanks,

Zendude welcome,
You may need an install disk or restore disc.
I hope you have your personal files backed.
Newer and bigger (more) RAM would help. (512mb) recommended for XP.

First try this;
CHKDSK
How to perform disk error checking in Windows XP
http://support.microsoft.com/kb/315265

**
1. Click Start, and then Run.
2. In Open, type cmd, and then press ENTER.
3. To repair errors, locate bad sectors, and recover readable information, at the command prompt, type chkdsk volume:/r, and then press ENTER.
Volume is the hard drive usually called local disk C:
**
Then try this;
System File Check
http://www.pchomecall.org.uk/support/sfc.htm
Make sure you read the whole tutorial first OK.

 

[KWGLY50]

I had the same problem with windows not shutting down. I turned off several programs that didn't need to run all the time and poof!! No more problem. Good luck...

 

[zendude]

which programs did you turn off?

 

[valis]

let's find out what you have running at startup.

CLICK HERE to download the HijackThis Installer:

1. Save HJTInstall.exe to your desktop.
2. Double-click on HJTInstall.exe to run the program.
3. By default it will install to C:\Program Files\Trend Micro\HijackThis.
4. Accept the license agreement by clicking the "I Accept" button.
5. Click on the "Do a system scan and save a log file" button. It will scan and then ask you to save the log.
6. Click "Save log" to save the log file and then the log will open in Notepad.
7. Click on "Edit -> Select All" then click on "Edit -> Copy" to copy the entire contents of the log.
8. Come back here to this thread and paste the log in your next reply, along with the smitfraudfix log.
9. Do NOT have HijackThis fix anything yet! Most of what it finds will be harmless or even required.

 

[zendude]

Here it is, Valis, hope it helps
Thanks

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 4:02:45 PM, on 10/12/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\ZONELA~1\ZONEAL~1\MAILFR~1\mantispm.exe
C:\Program Files\Outlook Express\msimn.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.dell.com/systemprofiler/SysPro.CAB
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.3.6.108.cab
O16 - DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} (DLM Control) - http://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.4.1.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.c...ls/en/x86/client/wuweb_site.cab?1102387240133
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {6F750202-1362-4815-A476-88533DE61D0C} (Kodak Gallery Easy Upload Manager Class) - http://www.kodakgallery.com/downloads/BUM/BUM_WIN_IE_2/axofupld.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{B709AF86-A12C-4416-BA44-AA8EFD728C6D}: NameServer = 192.168.2.1
O23 - Service: Sprint RcAppSvc (SprintRcAppSvc) - PCTEL - C:\Program Files\Sprint\Sprint SmartView\RcAppSvc.exe
O23 - Service: SupportSoft RemoteAssist - Unknown owner - C:\Program Files\Common Files\SupportSoft\bin\ssrc.exe (file missing)
O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Software Technologies LTD - C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe

--
End of file - 4290 bytes

 

[valis]

how come you have so few services running? Have you modified your msconfig file?

Next, try to turn off the pc manually, let it hang for about 5 minutes, and it doesn't shut down, hard reboot it. Then boot back up and go to start > run > eventvwr.msc. That will open an explorer like window with applications, security, and system in the left pane. Click on system and see if there are any exclamation points near to when it last froze; if so, double click on the item in the right pane, click on the two pieces of paper to copy it to your clipboard, and then come back here and paste the results. Then do the same for the applications folder; look for any exclamation marks that are near in time to when your pc is freezing.

thanks,

v

 

[zendude]

This is what I have.

Event Type: Error
Event Source: Dhcp
Event Category: None
Event ID: 1002
Date: 10/12/2008
Time: 8:47:54 PM
User: N/A
Computer: LAPTOP
Description:
The IP address lease 174.148.106.198 for the Network Card with network address 00A0D5FFFF85 has been denied by the DHCP server 68.241.134.253 (The DHCP Server sent a DHCPNACK message).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.



Event Type: Error
Event Source: SideBySide
Event Category: None
Event ID: 32
Date: 10/2/2008
Time: 10:20:34 PM
User: N/A
Computer: LAPTOP
Description:
Dependent Assembly Microsoft.VC80.MFCLOC could not be found and Last Error was The referenced assembly is not installed on your system.


For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Warning
Event Source: Userenv
Event Category: None
Event ID: 1517
Date: 10/9/2008
Time: 10:48:35 PM
User: NT AUTHORITY\SYSTEM
Computer: LAPTOP
Description:
Windows saved user LAPTOP\Paul Ajzenman registry while an application or service was still using the registry during log off. The memory used by the user's registry has not been freed. The registry will be unloaded when it is no longer in use.

This is often caused by services running as a user account, try configuring the services to run in either the LocalService or NetworkService account.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.


Thanks for checking this out.

 

[valis]

try d/l the user profile hive cleanup and installing it....sounds like you just have some junk laying around.

http://www.microsoft.com/downloads/...6d-8912-4e18-b570-42470e2f3582&displaylang=en

another thing you can do is download ntregopt; this is a little app from Mark Russinovich that compresses the registry, but doesn't touch any keys in there, so it's about the only registry tool I recommend. Any compression over 4-5% is pretty significant, and will both assist in the boot up and boot down times.

thanks,

v

 

[zendude]

Hi Valis,
NTREGOPT compressed the registry by15%!
I also used the user profile hive service and did not notice anything. The command prompt screen came on but no command prompt nor any other activity. I guess it worked in the background. I closed the screen because nothing was happening.


I had a Sprint wireless card from Sierra Wireless. I removed the software and reinstalled it-to see if it was causing the hang at save settings and shutdown-but no change.

Dang, the problem persists.
Thanks for your help

 

[valis]

well, the machine should be booting up a bit faster now, at least.

The UPHC is a service that runs in the background; you don't see it, sort of like a maid with a vacuum cleaning up behind you.

go to start > run > eventvwr.msc. That will open an explorer like window with applications, security, and system in the left pane. Click on system and see if there are any exclamation points near to when it last froze; if so, double click on the item in the right pane, click on the two pieces of paper to copy it to your clipboard, and then come back here and paste the results. Then do the same for the applications folder; look for any exclamation marks that are near in time to when your pc is freezing.

thanks,

v

 

[KWGLY50]

I turned off most of the programs that show icons at the bottom of the desktop. Most of these are not needed all the time, and are easy and safe to turn off by right clicking.