XP Shut-Down Problems

T4i

Been given a PC to fix and I would be prepared to look into it more but I've spent all weekend builing/fixing p.c's and I feel abit guilty that i've not spent anytime with her....

So i'm hoping someone can give me some quick ideas about this problem.

---

XP Pro, suddenly having problems shutting down.

When clicking shutdown the following happens (same everytime)

End Program - Explorer.exe, this box comes up 3 times very quickly then the desktop icons go, then another 2 end program - explorer.exe, then the taskbar goes, then another 1 end program - explorer.exe. Then I get just the wallpaper picture which takes about 10 seconds for it to goto logging off, saving settings, shutting down. Takes about 1min to shutdown all together.

Other strange things happening, sometimes on fresh boot if I want to go straight into control panel the taskbar locks up, still lets me click desktop icons, desktop properties, my computer etc but anything within the taskbar does not respond. Restarting explorer fixes this.

Another strange one is I can't disable the LAN on it, I get 'Error Disabling Connection - This connection may be using one or more protocols that does not support plug and play. This happens with nothing plugged into the LAN on fresh boot.

Looked in Event Viewer and these are there at the times of trying to shutdown

- App popup; machine check regs (5 entries all same)
- nvatabus; device identified (3 entries all same)

I've uninstalled AV, Firewall, iTunes (was told this was the last thing to be installed when problems occured)

Also can see netdde.exe in the process list which I'm not farmiliar with ???? Could this be something to do with nmap which is installed???

Checked for spyware, virus, trojans, SP2 /w all updates in. Ran ccleaner, defragged.......etc etc

Computer is speedy and doesnt seem to be affected in any other way than the above details.

Anyone have any views?

hijackthis log

Logfile of HijackThis v1.99.1
Scan saved at 13:11:18, on 11/09/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\netdde.exe
C:\WINDOWS\system32\clipsrv.exe
C:\WINDOWS\System32\dllhost.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\GlobalSCAPE\CuteFTP 7 Professional\cuteftppro.exe
C:\Program Files\GlobalSCAPE\CuteFTP 7 Professional\ftpte.exe
\others\Usefuls\hijackthis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
O2 - BHO: SpywareGuard Download Protection - !!4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O9 - Extra button: Research - !!92780B25-18CC-41C8-B9BE-3C9C571A8263} - \PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL
O16 - DPF: !!917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://150.134.221.65/activex/AxisCamControl.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\!!0AF92601-C604-4F7C-A829-592393B12229}: NameServer = 192.168.0.1
O18 - Protocol: livecall - !!828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - !!828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

Thx!! :beer:

Browntoa

looks ok to me

not used Spyware guard myself, you tried taking that off ??

do you know what this is ??

O17 - HKLM\System\CCS\Services\Tcpip\..\!!0AF92601-C604-4F7C-A829-592393B12229}: NameServer = 192.168.0.1

T4i

Browntoa wrote:

looks ok to me

not used Spyware guard myself, you tried taking that off ??

do you know what this is ??

O17 - HKLM\System\CCS\Services\Tcpip\..\!!0AF92601-C604-4F7C-A829-592393B12229}: NameServer = 192.168.0.1

I use spywareguard myself, and never had any troubles with it. Will try take it off tonight and see. Hope it isn't spwareguard as I suggested that to the bloke

The NameServer 192.168.0.1 is my router IP, hooked it up so I could check for updates etc.

pchelpman

Hi T4i

Spywareguard is not a problem. Quite the reverse. It's an excellent program which I use and always advise others to use so you have no need to worry on that score.

That said, I suppose it could be going wrong and interacting badly with another program. Won't do any harm to uninstall it and see if the situation improves.

Actually you could do this with anything else on the PC to try and pin down what's causing the problems.


That netdde.exe file should also be OK. Process Library describes it as follows ...

netdde.exe is the Network Dynamic Data Exchange server for Microsoft Windows. It is used to facilitate the exchange of data over a network. This program is a non-essential system process, but should not be terminated unless suspected to be causing problems.


This site has lots of useful tips about shutdown issues ... about half way down the page is a heading about shutdown being really slow. Maybe something there rings a bell.

http://www.aumha.org/win5/a/shtdwnxp.php

I'll carry on thinking. In the meantine let us know how you get on.

PCH

T4i

T4i wrote:

Another strange one is I can't disable the LAN on it, I get 'Error Disabling Connection - This connection may be using one or more protocols that does not support plug and play. This happens with nothing plugged into the LAN on fresh boot.

Really not sure what was the cause of the above but whatever was running to not let me disable onboard LAN was causing the shutdown errors.

Disabled LAN in BIOS and shutdown happened within 2 seconds everytime. Reinstalled the Nvidia chipset drivers and now it lets me disable it in XP and shutdown works fine.....

Just wish I knew what was hogging LAN.

Anyhoooow,

pchelpman

I haven't read everything on that site lately but I believe there are some mentions of Nvidia & BIOS troubles in the aumha.org link in my previous post. Maybe have a look ... see what's there. May give you some clues.

PCH

T4i

Cheers pchelpman.

I can't see anything obvious regarding Nvidia vs BIOS. And as the problem only came recently it don't think it was anything to do with nvidia. He has had the same BIOS version and Nvidia card for over a year now without any problems.

I'm led to believe it was something to do with Nmap which automatically installs something called ethereal to monitor local adaptors, maybe it was this that was hogging the LAN.

pchelpman

You may be right. Judging by what I can find out about this it would seem to be a likely candidate for resource hogging. If you're interesed in getting more information on Nmap and ethereal may help as a starting point ....

http://www.onlamp.com/pub/a/onlamp/2001/11/15/scanning.htm

Best of luck.

PCH