Windows 7 Shutdown Delay

[dwwalker]

I purchased a Lenovo W700 notebook computer a couple of years ago and had it configured from the factory with Windows XP. Recently, I installed a larger hard drive and installed Windows 7 32 Professional with a clean install. Lenovo had Windows 7 32 drivers for all devices for model W700 on their website, and I have installed all the latest drivers, including the latest BIOS. Later, in the course of trying to troubleshoot the shutdown delay problem, I upgraded to Windows 7 Ultimate, but it didn't make any difference with respect to the shutdown problem. The problem I'm having is that, intermittently, the computer sits at the Shutting Down... screen for about 8 minutes before the computer shuts off.

Following information in this forum and elsewhere on the web, I have done the following steps:

1. I shut down all startups and non-Microsoft services (except for Norton AntiVirus, which I could not shut off), essentially a clean boot, but the problem still occurred. I subsequently uninstalled Norton AntiVirus and installed AVG Anti-Virus, thinking maybe that Norton AntiVirus was causing the problem, but the problem still occured.

2. I've done a number of xbootmgr traces; the shutdown duration always is in the 16-17 seconds range, even when the computer sits at the Shutting Down... screen for 8 minutes.

3. I've enabled verbose event logging; all programs and services seem to shut down in a timely manner, even when the computer sits at the Shutting Down... screen for 8 minutes.

4. I've looked at the Event Logs; even in the cases when the computer sits at the Shutting Down... screen for 8 minutes, the duration between the Event ID 1074 (initiation of shutdown) and Event ID 13 (operating system shutting down) is approximately 15 seconds. When shutdown is delayed, it is happening after logging Event ID 13 when event logging has already terminated.

When I loaded Windows 7, I had a Blu-ray drive in one of the serial-ATA bays. Subsequent to the installation, I inserted a serial-ATA hard drive in the bay, so during bootup, I get an error message that the cdrom drivers failed to load. I also get an error on bootup that the HP CUE discovery service hung on startup.

I am normally running the computer in a dock with external devices, but the problem still occurs when I run the computer outside the dock with nothing external connected to the computer. I sweep the computer every week for malware and viruses and delete files in the temp folder and temporary internet files every time I shut down the computer (at least once a day).

There is one other strange thing happening. I also have a MacBook Pro running Windows 7 32 using Bootcamp. When I look at the c:\users\dwwalker\AppData\Local folder, there is always a subfolder with an alphanumeric name, e.g., {914702C8-CD5D-4970-BEB8-451429C61959} that appears to be empty, but there is always just a single folder of that type. However, on the Lenovo W700 computer, there are multiple folders of that nature that accummulate over time, all of which seem to be empty.

Please let me know what further information would be helpful. At this point, I don't know what else to try.

Thanks.

David

[MagicAndre1981]

can you share the xbootmgr trace file (zip the ETL and upload the zip to mediafire.com)?

[dwwalker]

I uploaded the file "David Walker etl.zip" to MediaFire and sent you a message about where and how to access the file.

I did this particular trace this morning. I initiated this particular shutdown at 1:28:18 am and the Shutting down... screen didn't clear until approximately 1:36:06 am, even though the trace indicates approximately a 17 second shutdown.

Thanks.

David

[MagicAndre1981]

Hi David,

the trace you gave me shows that Windows takes 17s to shutdown.

It takes 5s to notify all programs that the shutdown occurs, 2.8s to stop all running programs, 4.5s to stop all running services (the services.exe which manages all services takes 4s to stop) and the rest is to stop the Windows kernel.

I can see that the AVG service creates some higher CPU usage and dirver delays. So tryo to update AVG to the latest version or remove it and use a different tool. Also the EvtEng.EXE ( Intel Wireless Utility - version 13. 4. 0. 6) causes some 100% Disk IO.

[dwwalker]

As you will note from my last post above, I knew that the trace indicated that the computer shut down in 17 seconds. However, for the particular shutdown during which this trace was made, I initiated the shutdown at 1:28:18 am and the "Shutting down..." screen stayed up from 1:28:18 am until 1:36:06 am, or approximately 8 minutes. Why would that screen stay up for almost 8 minutes after the kernel shuts down?

Thanks.

David

[MagicAndre1981]

I can't see this from the trace. the trace shows 17s. Remove AVG and try again.

[dwwalker]

Okay, but I originally had Norton AntiVirus on the computer and I had the same problem then before I uninstalled Norton AntiVirus and installed AVG. All traces that I have done have shown 16-17 seconds, no matter whether the "Shutting down..." screen shuts down in 20 seconds or 8 minutes or some time interval in between. Do you have any suggestions for another antivirus program, since I've already been down the Norton AntiVirus path, and going back to Norton AntiVirus just takes me back to where I started from?

Thanks.

David

[Kelsenellenelvian]

MS essentials and malwarebytes is a good combination...

[MagicAndre1981]

do the old approach to eliminate 3rd party tools as cause with a clean boot:

support.microsoft.com/kb/929135

Does it make a difference?

[dwwalker]

I noted in the orignal post of this thread above that I had already tried the clean boot, and no, it didn't make any difference.

Pursuant to your suggestion, I uninstalled AVG Anti-Virus; I also shut down the service opened by EvtEng.exe, as you had indicated above that that might have caused a problem. I installed MS Security Essentials as the new antivirus program pursuant to the suggestion by Kelsenellenelvian above.

I just uploaded another trace to http://www.mediafire.com/?s5x4fsfr5s15sjx with the new antivirus (MS Security Essentials) installed and the EvtEng.exe service disabled. What you will see from that trace is that the shutdown time was about 16 seconds. For that particular shutdown, Event ID 1074 occurred at 1:11:51 am EDT and Event ID 13 occurred at 1:12:06 am EDT, which conforms to a shutdown interval of about 16 seconds shown by the trace. However, for this particular shutdown, the Shutting down... screen stayed up until 1:19:42 am EDT or approximately 8 minutes from the Event ID 13 event.

I still don't understand how the Shutting down... screen can stay up for almost 8 minutes after xbootmgr stops its shutdown trace and the kernel has stopped operating.

Do you have any other suggestions of what to try?

Thanks.

David

[dwwalker]

In thinking through my last post, I guess I never did a completely clean boot. I did the boot I described in the original post above with Norton AntiVirus as the only third party software running because I couldn't shut it off. Then I uninstalled Norton AntiVirus and installed AVG Anti-Virus and the problem still occurred, so I concluded that it was not 3rd-party software.

I will try a clean boot with no third party software.

Thanks.

David

[MagicAndre1981]

which motherboard do you use? Do you use the latest BIOS? If Windows thinks the shutdown is done, it may be a BIOS (ACPI) related issue.

[tikal01]

hi