Windows Not Shutting Down

ally_uk

Hi I'm having problems with machines which are refusing to shutdown

First Windows XP box i click shutdown and it wont turn off

I booted up a Live Cd of Ubuntu and it sent the Kill signal and the shutdown process went smoothly

I have encountered this problem on a few Windows XP machines where they simply refuse to shutdown. Does ACPI Play a role in the shutdown process of a machine if so it could indicate a problem with the BIOS?

Many Thanks

Ally

Silver Bullet

It is most likely an application that is hanging up the shut down process.

Is there any hard drive activity while it is trying to shutdown?

Can you access task manager when this occurs?

Are there any clues in the application log of the event viewer?

Is your anti-virus running a scan at shutdown?

When you say "Machines", are you referring to all of the XP machines on the network?

malcybood

I've had a problem like this it was to do with the paging file. We were audited by an external security auditor and when the core XP build was reviewed, we were advised to ensure the paging file was dumped on shut down as it was a "security threat" if it wasn't.....(bit extreme if you ask me)

When we changed this we had several machines hanging and taking well over 10 minutes to shut down.

We eventually changed it so that the paging file did not **** and was set to system managed. This resolved the issue.......

How many machines have the problem? Do they have anything in common i.e. recently upgraded software, drivers etc? When did the problem start?

JDMurray

Windows XP is actually very good about terminating applications which are hung at shutdown. I would suspect a kernel-mode (ring 0) device driver is not unloading properly and that's what XP is waiting for at shutdown. This happens either because of a damaged or buggy driver, or a problem with the hardware associated with the driver. Try starting the system with the bare minimum peripherals and see if it shuts down properly. Also, try updating all of your drivers, including those for the motherboard, and flash the latest BIOS if yours is rather old.

Depending on what the computer is used for, there is also a possibility that it is infected with buggy Spyware or a rootkit that is causing the shutdown problem. This is very unlikely; however, if nothing else fixes the problem, this is an opportunity to familiarize yourself with the half-dozen or so free rootkit scanners that are available.

malcybood

jdmurray wrote:

This is very unlikely; however, if nothing else fixes the problem, this is an opportunity to familiarize yourself with the half-dozen or so free rootkit scanners that are available.

Is this just another name for a anti-spy/malware tool such as AwAware? I'm familiar with these but just never heard the term rootkit scanner

If not what's the difference?

Cheers

ally_uk

Cheers guys

explanation of Rootkit

http://en.wikipedia.org/wiki/Rootkit

JDMurray

Under Windows, a "rootkit" is software that is capable of installing itself at a much lower level in an operating system than a program or application. Windows rootkits more resemble device drivers than programs in their attachment to the operating system. Many rootkits are also stealthy by their design and are not detected by conventional A/V and Spyware scanners, hence the need for special rootkit scanner.

The Wikipedia entry for rootkit is quite informative, as is the Security Now! podcat on the same subject (http://www.grc.com/sn/SN-012.htm).

Kaminsky

malcybood wrote:

We were audited by an external security auditor and when the core XP build was reviewed, we were advised to ensure the paging file was dumped on shut down as it was a "security threat" if it wasn't.....(bit extreme if you ask me)

These guys really get my blood boiling. They have a little manual they have got from somewhere and follow it to the letter without actually knowing anything about the consequences.

Long ago we got audited on a vax file server (very long ago) and this guy ordered that certain acls were put in place even though we stated that if that was done, nobody would be able to log in.

Came down from on high that we had to make all the changes this guy recomended so we shrugged and made them. Less than 5 minutes later the phones were ringing off the hook and we said "sorry we were told to". Eventually a much harrassed it director came running in asking us to undo all the changes this numpty recomended.