Windows Vista shutdown problem?

[wrayx1]

I installed Spyware Doctor with Antivirus 2010 trial version this morning.

Of 3 shutdowns today, Windows Vista has refused to shutdown twice. It hits the Shutting Down message with the circling arrow icon and you suddenly see disk activity stop and thats the way it sits forever (well as long as I let it). Now you know the CPU is not hung, because the circling icon requires the processor.

I'm not blaming SD with AV 2010, but it is way too big of a coincidence, being that in the past other malware detector software has been implicated in a good percentage of these problems by ignoring api defined system requests to shut down their services.

I will be uninstalling it if the next few shutdowns fail as well, and let you know if that cures it (statistically).

Too bad, this looked like a good product, but it has two serious consequences for me. First, it's taken me years to train the family to shutdown the computer after use (now they have an excuse not to). But more importantly, it causes my 2 mirror disk arrays to think that they have become corrupted and the 12 hour recovery (if I let it continue) slows down the computer dramatically.

I did a search but I didn't see anyone else reporting the same problem...

[c_edge]

Is anything else shutting down alongside SD?
Maybe its worth a try to disable the other programs and leave SD by itself and see if it hangs on shutdown.

c_edge

[wrayx1]

There are obviously many things shutting down besides SD w/ AV, but nothing visual. All programs on the desktop were closed before shutting down.

This morning after a few more faulty shutdowns and the accidental discovery of a symptom that proves Vista is still active, it has been deinstalled.

Guess what? Shutdowns work... (no surprise there) :(



The symptom that proved Vista is still active waiting for something, was that I discovered that my mouse cursor was still active on the right display of my dual displays. It cannot be seen on the left "Shutting Down" screen, but it moves on the blackness of the right screen. Since Vista was running the driver for this, Vista was still active.

This is one thing that cannot be blamed on Microsoft. This is a programming issue for the services for SD. At the very least something like a poll every 10 seconds or less could have been done to see if the system shutdown flag was on. But the best thing would be for the program services to respond to requests to shut themselves down. And probably there is a way to verify that the request came from the system and not some virus program (strong names, digital signatures and the like...).

Here is more info on shutdowns (and I'm sure there's lots more):
http://msdn.microsoft.com/en-us/library/ms700677(VS.85).aspx


For now: Auf Wiedersehen (Heidi Klum)

[AChen]

We will need to attempt to set up something similar to this and give this a test and see what we find.

[silvertones]

V 7.0 here with Win XP
I tried shutting down SD and got an error message saying it timed out and couldn't be shut down. I rebooted the computer and found that it had shut down. It asked to do a smart update and I said OK. Much to my dismay the update was 59+ Meg!! It had wiped out all of the updates. With dial up I continually save a copy of the latest avdb folder & the def file:mad:

[JimMurphy]

I installed Spyware Doctor with Antivirus 2010 trial version this morning.

Of 3 shutdowns today, Windows Vista has refused to shutdown twice. It hits the Shutting Down message with the circling arrow icon and you suddenly see disk activity stop and thats the way it sits forever (well as long as I let it). Now you know the CPU is not hung, because the circling icon requires the processor.

I'm not blaming SD with AV 2010, but it is way too big of a coincidence, being that in the past other malware detector software has been implicated in a good percentage of these problems by ignoring api defined system requests to shut down their services.

I will be uninstalling it if the next few shutdowns fail as well, and let you know if that cures it (statistically).

Too bad, this looked like a good product, but it has two serious consequences for me. First, it's taken me years to train the family to shutdown the computer after use (now they have an excuse not to). But more importantly, it causes my 2 mirror disk arrays to think that they have become corrupted and the 12 hour recovery (if I let it continue) slows down the computer dramatically.

I did a search but I didn't see anyone else reporting the same problem...
I installed 2010 Internet Security and have the exact same symtoms as you described in your first post. I'm using Vista Ultimate 32 with RAID 5 array, and yes I have been verifying after a failed shutdown. I'll probably deinstall and try to find a 2009 version. This morning after an all-night array rebuild, I momentarily mashed the PC Power button, and the system shuty down normally. This may be a workaround.

[haapy]

Check your event logs, application and system, for errors

[JimMurphy]

I see application errors in the event log:
Log Name: Application
Source: Microsoft-Windows-Search
Date: 11/6/2009 6:36:42 AM
Event ID: 3013
Task Category: Gatherer
Level: Error
Keywords: Classic
User: N/A
Computer: Goliath
Description:
The entry <C:\WINDOWS\INF\WMIAPRPL\WMIAPRPL.H> in the hash map cannot be updated.

Context: Application, SystemIndex Catalog

Details:
A device attached to the system is not functioning. (0x8007001f)

Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Search" Guid="{CA4E628D-8567-4896-AB6B-835B221F373F}" EventSourceName="Windows Search Service" />
<EventID Qualifiers="49152">3013</EventID>
<Version>0</Version>
<Level>2</Level>
<Task>3</Task>
<Opcode>0</Opcode>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2009-11-06T11:36:42.000Z" />
<EventRecordID>28705</EventRecordID>
<Correlation />
<Execution ProcessID="0" ThreadID="0" />
<Channel>Application</Channel>
<Computer>Goliath</Computer>
<Security />
</System>
<EventData>
<Data Name="ExtraInfo">

Context: Application, SystemIndex Catalog

Details:
A device attached to the system is not functioning. (0x8007001f)
</Data>
<Data Name="Entry">C:\WINDOWS\INF\WMIAPRPL\WMIAPRPL.H</Data>
</EventData>
</Event>

and tonight:
Log Name: Application
Source: Microsoft-Windows-WMI
Date: 11/6/2009 7:48:11 PM
Event ID: 10
Task Category: None
Level: Error
Keywords: Classic
User: N/A
Computer: Goliath
Description:
Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-WMI" Guid="{1edeee53-0afe-4609-b846-d8c0b2075b1f}" EventSourceName="WinMgmt" />
<EventID Qualifiers="49152">10</EventID>
<Version>0</Version>
<Level>2</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2009-11-07T00:48:11.000Z" />
<EventRecordID>28733</EventRecordID>
<Correlation />
<Execution ProcessID="0" ThreadID="0" />
<Channel>Application</Channel>
<Computer>Goliath</Computer>
<Security />
</System>
<EventData>
<Data>//./root/CIMV2</Data>
<Data>SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage &gt; 99</Data>
<Data>0x80041003</Data>
</EventData>
</Event>