computer wont shut off...

Discussion in 'Software' started by toshkerr, Aug 13, 2007.

  1. toshkerr

    toshkerr Private E-2

    little problem...can anyone help?


    have just started using user accounts on windows XP pro (as in two accounts instead of one). both set up as admin accouts but the problem is the new account is really bugging me as it will not shut down or log off. i have to switch to my other account (or the welcome screen) when i want to shut down and everytime i do this it give me a warning that the other account is not logged off and i might lose stuff. It does shut down fine, but curious as to why new account will not log off/shutdown. when i click the shut down/log off button nothing happens at all...at least nothing seems to happen.

    any ideas anyone?

    thanks JK
     
  2. Turcoloco

    Turcoloco MajorGeek

    What do the power configuration shows (Start > Run > powercfg.cpl > OK)? These settings are normally machine based not user (much like the BIOS settings) but you might have a setting that is not working well under that troubled user account?

    Also that user might have some file corruption pertaining to the user related registry data. One other possibility is a malware infection.

    Does that problematic user account have any different programs or services running compared to the profile that shutsdown fine?

    Another good place to look for answers would be to examine EventViewer Log files (Start > Run > Eventvwr.msc > OK ) Mainly 2 hives to examine: Application and System, when viewing make the list shorter by View > Filter > uncheck all but 'Error').

    Hope this provides some help.
     
  3. toshkerr

    toshkerr Private E-2

    Hi checked power setting, dont really see problem there.(Start > Run > powercfg.cpl > OK)

    just tried setting up another user account...all i did was open thunderbird and import some mail. but when tried to log off it didnt work. all settings as normal.

    anything else i can check? will try a brand new user account and see if i can log off before i change anthing at all.

    new account has a few differrent programs/things running but just the basic stuff that i dont run in my account.

    did however look in EventViewer Log files (Start > Run > Eventvwr.msc > OK )
    and noticed whenever i tried to log off/shut down in dodgy account i get warnings under sytem, source: user32. not sure what that means.

    ******* Just deleted bad account, made new one and new one works fine. for some reason my good account will not shut down/log off any more and i get the same warning as descibed above in the event viewer. dont know whats going on. ran ad aware/spy bot no problems. *********
     
    Last edited: Aug 13, 2007
  4. toshkerr

    toshkerr Private E-2

    keep getting error 1073. it sucks anyone know why?
     
  5. Turcoloco

    Turcoloco MajorGeek

    When are you getting this error message exactly?

    Also when you delete the accounts, how do you do it?
    The best and also the easiest way would be to:
    Start > Run > sysdm.cpl > OK > Advanced > Settings button under User Profiles in the middle > Delete button on the new window after selecting the profile.

    I am not sure what is going on but there is definitely something wrong within the OS, quite likely in the registry, I still wouldn't rule out the malware infection possibility. Ad-aware and Spybot are quite ineffective against some of the Trojan and Rootkit type infections so I would run some of the online AV scanners...

    Another thing for you to try, when you log in as one of the problematic users, open Task Manager and kill all processes under current user name, then kill all other system processes that allows you to, skip the following ones only:
    Taskmgr.exe, svchost.exe (all instances), smss.exe, System, System Idle Process, csrss.exe, winlogon.exe, services.exe, lsass.exe, explorer.exe
    and see if you can shutdown or not.
     
  6. toshkerr

    toshkerr Private E-2

    i dont actually get the message popping up on screen (error 1073) i can just see it come up as a warning in the eventviewer files everytime i try to shut down/loff off.

    i delete the user profiles by logging in as another user, and giong through control panel, user accounts, delete and so on. i will try your way next time.

    i have run my avast home and did a thorough scan. came up with a trojan (deleted and forgot to get name). restarted and comp still does the same thing. i will run bit defenders online scan in a moment and see what that comes up with.

    Opened task manager as you said and killed all processes under the corrupt user (while logged in as corrupt user). then tried to restart, no success. so i killed all system processes except the ones you said and computer DID shut off correctly. Should i systematically kill one of the system processes at a time and see which one is stopping shut down/log off?

    thanks for you help so far.

    jk

    *** sytem process 'wuauclt.exe' seems to be the problem. it is one of the last ones to load when i start the computer, and if i leave everything else, but kill that process the computer works fine***
     
    Last edited: Aug 16, 2007
  7. w0ts0n

    w0ts0n Private E-2

    I had a similar problem once, it turned out peergardian proccess wearnt killing when I was shutting down this didn't allow my computer to shut down.. Try close all programs in your task bar and shutdown, if that works then you will know it's a program stopping it.
     
  8. Turcoloco

    Turcoloco MajorGeek

    Too generic to comment on it accurately so for now, better to ignore this.

    The way I mentioned, removes the SID, user profile and the user profile folder under Documents and Settings, a much complete and proper way.

    Not a good sign, you might still have the reminants of the previous infection or a possible collateral damage!

    Windows Automatic Update service, hmm this is strange and definitely not a good sign since it is a system based service. You do not have to have it on, you could do the updates manually but it is generally recommended to leave it on automatic. I normally install all critical and other desired updates then disable this service until I am ready to update again. Somehow this could still be related to a malware infection so I strongly recommend you pay a visit to the Spyware section and get confirmation that your system is clean before doing anything else.
     
  9. toshkerr

    toshkerr Private E-2

    hi, back again. abri over in the malware section has checked my machine and all logs are now clean. i don't think there was any major problems. (see thread 'computer wont shut down' in malware for further details)

    unfortunately for me i am still having trouble shutting down. i have deleted the other profile so i am now back to my original user profile and this is the only one. is there anything i can try to see what is blocking my computer from shutting down a lot of the time?

    (also this one should be easy for you, but i just intalled sygate personal firewall and turned off my windows one, i'm not sure if i should allow PCAUSA NDIS 5 Protocol Driver...(Pcandis5.sys). it certainly wants to be allowed...

    any help at all would be appreciated.
    tosh
     
  10. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Here is a little something to try:
     
  11. toshkerr

    toshkerr Private E-2

    thanks for the tricks. i will one day use them..my computer still wont respond to them though. only way i can shut her down is by holding the power button on my base unit...it sucks. cant be good for the machine either. :(

    initially i though it had something to do with the wuauclt process as when i killed this in task manager it worked, but now even with that process not running she wont close.

    tosh.
     
  12. Turcoloco

    Turcoloco MajorGeek

    If TimW's simple workaround resolves the problem then you can ignore this post but if not, read on...

    This is Windows Automatic Update service as I mentioned before and since your system is not infected according to the Spyware guys, then I won't expect a backdoor Trojan to be disguised as the same process but you should not have to kill this process every time you need to shutdown.
    My assumption is something else conflicting with this service, 2 likely suspects are: a misbehaving AV scanner or Firewall utility. Try shutting down your Firewall utility (also check Service control panel to make sure all firewall related services are indeed stopped), then try shutting down without killing the 'wuauclt.exe' process and see if it works or not.

    I also have this registry patch that may actually help you with your problem, if not the changes it makes will at least improve your PC's performance a bit.
    It will not cause any problems but for any reason you want to undo it, let me know. Save the zip file anywhere on your machine then unzip and run the PatchXP.exe file in it.

    Also, I'd like you to take a look at this link, there is a ton of related info there, if all else fails to provide a pratical solution, go through the workarounds that may help you.

    PS. Another little self-extractor I have been using creates the 3 different version of shutdown options as a separate shortcut on the desktop, the difference is after you run the above patch combined with the 'force' parameter in the Restart and Shutdown shortcuts (Shutdown also has a 3-second countdown), the system will have the proper time and privilege to do its best to close all apps properly regardless of app behaving or misbehaving... ;)
     

    Attached Files:

  13. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Run Process Explorer 10.21

    Look for any non-MS processes and that aren't verified.
    Tell us what you find (bad stuff will be in red ...but wait till they are verified).
     
  14. toshkerr

    toshkerr Private E-2

    ran patch xp turcololo...didn't do an aweful lot when i clicked it but a black window did pop up for a millisecond and close so maybe thats just how long it took to patch.

    the other little self extractor, that made restart shut down log off shortcuts, works a treat so at least my system will shut down when i tell it too. thanks.

    timW, not quite sure what i'm looknig for when i run process explorer.
    everything is either white, blue or pink. everything under services.exe is a pinkish colour, and everything under explorer.exe (7 processes) is blue.

    dont see any red. unless you mean the pink?
     
  15. Turcoloco

    Turcoloco MajorGeek

    Yeah, it silently modifies a few registry keys to minimize the wait time of shutting down apps, it also lessens the amount of time the system will wait to kill a hung process, etc. The default is 20 seconds across the board, I usually make it 3 seconds which is plenty, in your case it was 2 seconds. Also by default system prompts you to see if you want to kill a hung process, now it'll do it automatically, etc.

    You are welcome, I use them on all my machines, especially in the Quick Launch bar the corresponding action will be a single click to execute!

    You problem is definitely a corrupt or misbehaving process, service based or otherwise.

    If you haven't already tried it, running sfc/ scannow might help too.
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds