I have a windows 7 laptop that won't shut down. It gets to the shutdown screen and then hangs. It will shutdown properly from Safe Mode but won't after a clean boot. I did a sfc /verifyonly and it found nothing. Malwarebytes and Kaspersky virus scanner have found nothing. I have made 2 attempts at a System Restore but when the system reboots I get a restore has failed message. Any other ideas would be appreciated.
Windows 7 won't shut down
Posted 12 May 2016 - 11:11 PM
Posted 13 May 2016 - 06:12 PM
I have created the 2 Event Viewer and first Process Explorer logs as requested. They are attached.
I will work on the Process Explorer comparison next.
Posted 13 May 2016 - 07:15 PM
Log: 'System' Date/Time: 13/05/2016 11:37:03 PMType: Error Category: 0Event: 7011 Source: Service Control ManagerA timeout (30000 milliseconds) was reached while waiting for a transaction response from the Winmgmt service.
This might be the culprit.
2) Open an elevated command prompt. (Start, All Programs, Accessories, right click on Command Prompt and Run as Administrator, )
3) Verify the WMI repository is not corrupt by running the following command:
If the repository is not corrupted, a “WMI Repository is consistent” message will be returned. If you get something else, go to step 4.
4) Run the following commands:
If the repository salvage fails to work, then run the following command to see if it resolves the issue:
After the last command, there should be a “WMI Repository has been reset” message returned.
Posted 13 May 2016 - 09:03 PM
You might try right clicking on
Posted 13 May 2016 - 09:37 PM
The only other error I see is from Kaspersky and winlogon
Log: 'Application' Date/Time: 13/05/2016 11:36:30 PMType: Warning Category: 0Event: 1530 Source: Microsoft-Windows-User Profiles ServiceWindows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards. DETAIL - 2 user registry handles leaked from \Registry\User\S-1-5-21-2888657257-1247738880-630884131-1001:Process 1980 (\Device\HarddiskVolume2\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe) has opened key \REGISTRY\USER\S-1-5-21-2888657257-1247738880-630884131-1001Process 888 (\Device\HarddiskVolume2\Windows\System32\winlogon.exe) has opened key \REGISTRY\USER\S-1-5-21-2888657257-1247738880-630884131-1001
Posted 13 May 2016 - 10:33 PM
I was thinking avp might be the problem. It isn't in safe mode but is in the clean boot. Tried to stop it in msconfig but it kept coming back on. Tried to kill it from Process Explorer and it wouldn't let me. Decided to uninstall it and the uninstall crashed. When I got the computer booted back up, the program still loaded but the uninstaller said wasn't there. When I tried to stop the program, windows crashed. Started the computer back up. Decided to re-install the antivirus program hoping I could then try the uninstall again but the reinstall crashed too.
When I got the computer started again the antivirus program didn't load up. It is still listed as a program but the uninstaller will open up now. Cancelled out of the uninstaller and decided to try a Shut Down. It actually worked. The computer shut down just like it should.
Not sure what to do next. Guess I really need to try the uninstaller again before loading a new antivirus program. Will try it tomorrow.
Thanks for all the help.
Posted 14 May 2016 - 08:07 PM
Sometimes reinstalling a program will allow you to remove it but if you need help removing Kaspersky we can move this to the malware forum and use FRST to remove it.
Posted 15 May 2016 - 07:26 PM
0 user(s) are reading this topic
0 members, 0 guests, 0 anonymous users