I would be inclined to put this down to Windows XP or some
app/hardware that will not close down.
All versions of Windows seem to have trouble at some point or other
when it comes to shutting down.
Did you install any new software or hardware at the time this started
happening?
Did XP install any updates?
Did you update any drivers?
Have you tried system restore?
Do you have a known good back up of your XP partition/drive that you
can restore?
Also look here:
http://tinyurl.com/3n692
http://tinyurl.com/44pnj
Thanks to all for your replies and advice. I waited to reply back until I
had tried everything suggested.
Nothing - either hardware of software install - was directly linked to my
shutdown problems. I.e. one day, I could no longer get the machine to
actually power down or reboot.
Prior to this happening, about two days prior, I went through a series of
BIOS updates. To make a long story short, I am using two DiamondMax10
drives in a RAID1 config, and the Nvidia RAID BIOS is very buggy. BIOS
versions 1005 and 1006 will _not_ recognize both drives. I upgraded from
1003 to 1006, and after about three reboots, one of my DiamondMax10 drives
would no longer show up at POST. This previously had happened when I tried
to update to 1005, a few weeks prior. Due to this previous experience, I
knew the way out. My only way to get the DiamondMax10's both to be
recognized again was to go back to BIOS 1002, then update to BIOS 1003.
(Going back to BIOS 1003 directly does not fix the problem.) I cleared
CMOS with the jumper at each BIOS change. This situation royally ticks me
off, but that's another story...
Anyway, I had been through this BIOS routine about two days prior to my
shutdown problems. Therefore, it's not clear that it's related or not.
I did full virus scans with Norton Internet Security 2005 and found
nothing.
I ran Adaware Pro 1.5, and found nothing.
I looked at all the suggested web sites, found lots of suggestions, which I
considered thoroughly, and none worked.
The Microsoft KB really mentions only a USB driver issue, but the suspect
registry settings were already correct, so that isn't the problem.
Note again that my system makes it all the way, quickly, to the "Windows is
shutting down..." screen - i.e. logoff is complete. When that message
appears, I hear the sound card turn off (i.e. the muffled snap through my
speakers of the sound card powering down, or so it seems), and I see a bit
of hard disk activity, and then the system just seems to stall. I have
noticed that after about 10 seconds, the hard disk activity light will
continue to flash about once per second. The duration of the activity
light is so short that I can barely detect that it's lighting at all. This
seems to go on indefinately, but if I leave the system like this for
several hours, when I come back the light is no longer blinking (it's
steady off) and my monitor is asleep and won't wake up.
The happens whether I am trying to turn of the computer, or reboot.
In search for the program or service that might be hanging up my shutdown,
I tried shutting down from Safe Mode, and got the same problem above.
I also tried running MSConfig, disabling literally everything, and I still
had the same thing above happen.
This is very frustrating, as, if it's really a program or service keeping
me from shutting down, shouldn't disabling all of these allow me to
shutdown?
Now, a few weeks ago, I started receiving some registry complaints, and
determined that something was keeping my registry from being released
during my logoff. The following would be in the event log:
"
Windows saved user SILVERSTONE\Brad registry while an application or
service was still using the registry during log off. The memory used by the
user's registry has not been freed. The registry will be unloaded when it
is no longer in use.
This is often caused by services running as a user account, try
configuring the services to run in either the LocalService or
NetworkService account.
"
Microsoft has a utility called "UPHClean" which runs as a service and
forces the registry to close during logoff to avoid this problem. Every
time I log off, I receive the following entry in the Event Log, from
UPHClean:
"
The following handles in user profile hive SILVERSTONE\Brad (S-1-5-21-
329068152-1770027372-682003330-1003) have been closed because they were
preventing the profile from unloading successfully:
svchost.exe (952)
HKCU (0x348)
"
Since it's blaming "svchost.exe", it doesn't really give me too much help
on figuring out what this is.
I noticed that immediately _after_ (in time) the above event, I would
receive two events listed in the Event Log:
"wuauclt (368) The database engine 5.01.2600.2180 started."
followed by:
"wuaueng.dll (368) SUS20ClientDataStore: The database engine started a new
instance (0)."
The next entry in the Event Log would state that the Event Log service was
shutting down.
Thinking that the Windows Update files might be screwing things up, I did
everything suggested in the MSKB, and now I don't see those two events
listed anymore after the UPHClean event during logoff. However, I still
can't get the machine to complete shutdown or reboot.
Not satisfied with the info from UPHClean, I installed the WinXP symbol
files, which allowed me to get more info from the Event Viewer.
Now when I try to shutdown or reboot I get the following event from
UPHClean:
"
The following handles in user profile hive SILVERSTONE\Brad (S-1-5-21-
329068152-1770027372-682003330-1003) have been closed because they were
preventing the profile from unloading successfully:
svchost.exe (952)
HKCU (0x318)
0x77e3b4b7 ADVAPI32!<no symbol>
0x77e072b1 ADVAPI32!IsTextUnicode+0x9cb4
0x77dd6b20 ADVAPI32!RegOpenKeyExW+0xa8
0x77dd773e ADVAPI32!RegOpenKeyW+0x2f
0x77ddb2dc ADVAPI32!SaferComputeTokenFromLevel+0x587
0x77ddb296 ADVAPI32!SaferComputeTokenFromLevel+0x541
0x77dd9e9e ADVAPI32!IdentifyCodeAuthzLevelW+0xd9
0x7c819653 kernel32!BasepCheckWinSaferRestrictions+0x17e
0x7c818d2c kernel32!GetNlsSectionName+0x10cb
0x77df7838 ADVAPI32!CreateProcessAsUserW+0xc3
0x76a93abd rpcss!<no symbol>
0x76a93839 rpcss!<no symbol>
0x77e79dc9 RPCRT4!CheckVerificationTrailer+0x75
0x77ef321a RPCRT4!NdrStubCall2+0x215
0x77ef36ee RPCRT4!NdrServerCall2+0x19
0x77e7988c RPCRT4!NdrGetTypeFlags+0x1c9
0x77e797f1 RPCRT4!NdrGetTypeFlags+0x12e
0x77e7971d RPCRT4!NdrGetTypeFlags+0x5a
0x77e7bd0d RPCRT4!NdrConformantArrayFree+0x42e
0x77e7bb6a RPCRT4!NdrConformantArrayFree+0x28b
0x77e76784 RPCRT4!I_RpcBCacheFree+0x14c
0x77e76c22 RPCRT4!I_RpcBCacheFree+0x5ea
0x77e76a3b RPCRT4!I_RpcBCacheFree+0x403
0x77e76c0a RPCRT4!I_RpcBCacheFree+0x5d2
0x7c80b50b kernel32!GetModuleFileNameA+0x1b4
"
This is the last entry in the Event Log before the entry (10 seconds later)
saying that the Event Log is shutting down.
I have no idea what the above indicates may not be cleanly shutting down.
Note that the above issue with registry release, while it is a real
problem, may _not_ be related at all to my shutdown problems...
Please, HELP!