XP Pro Shutdown Hangs when On-Access Protection active

Avast Free Antivirus / Premium Security
1

OS - XP Pro Sp2
Firewall - Zonealarm version:5.5.062.004
Avast version 4.5.549

If On-Access Protection is running when I shutdown the computer, system appears to hang at “Saving your settings” and I have to shut the power off.

If On-Access Protection is disabled, shutdown is normal.

Any ideas.

2

What else is running? (background) processes, applications?

What happens if you shutdown ZA manually before shutting down the system?
What have you tried sofar to solve it?
Already tried a repair of Avast?

3

Processes running:
alg.exe
crss.exe
ctfmon.exe
EasyShare.exe - Kodak Easyshare for camera dock
explorer.exe
iexplore.exe
inetinfo.exe
KBD.exe - HP multimedia keyboard service
KodakCCS.exe - Kodak Easyshare for camera dock
lsass.exe
mdm.exe
msimn.exe
PSFree.exe - Popup Stopper
services.exe
smss.exe
spoolsv.exe
svchost.exe
system idle process
taskmgr.exe
vsmon.exe
winlogon.exe
wscntfy.exe
zlclient.exe

Steps taken sofar:

  1. Shutdown without ZoneAlarm, after disconnecting from internet, still hung at Saving your settings screen
  2. Shutdown without Kodak software running, still hung at Saving your settings screen
  3. Shutdown without ZoneAlarm and Kodak software running, Still hung
  4. #3 and left “Saving your settings” window up for 24 hours. (wanted to make sure I wasn’t just being impatient).
  5. Google search on XP shutdown hangs. Checked variety of hits to no avail.
  6. Disabled on-access protection, after disconnecting from internet, and shutdown works as expected.
  7. Perform boot scan. Nothing found.
  8. Ran AdAware & SpyBot, Nothing found
  9. Perform avast repair. Still hangs
4

I am having the same issue. Nothing has changed on the machine except the avast update.

My configuration:

OS - XP Pro Sp2
Firewall - Sygate Personal Firewall 5.5
Avast version 4.5.549

5

Tntemge, disable Sygate adn try to shutdown…
Can you post the results?

6

Figured out my problem,

Had Sql Server database files which were being scanned by avast while the service was trying to shutdown.

Resolution:

  1. Exclude these files from avast scans
  2. Manually shutdown Sql Server services.
7

I’m note quite sure what you mean by that. I looked at my Sygate options but I could fing anything relating to shutdown…

Only if I disable the avast on-access protection can I shutdown all the way. However, as soon as I do that Windows itself start complaining that I am not protected any longer…

8

Sorry, I explained bad.
I asked you to try to do the contrary you have done:

  1. Let avast protection enabled
  2. Disable Sygate firewall (Windows could alert you’re not protected any longer…)
  3. Shutdown
9

No, unfortunately that doesn’t help. If I disabled the firewall but I am still getting stuck at the message “Saving settings…” at the shutdown screen.

On a side note, as a mere mortal user I don’t even have the access permissions to tinker with firewall service.

Is there a way for me to track if the avast software is doing something during the shutdown time? I’ve tried setting the logging level down (to very, very verbose) but I didn’t see any traces in those log files or in the event log.

Any more ideas?

10

Are you talking about the logoff window (blue) and the Windows message of ‘saving settings’?
If so, take a look: Startup > Administrative Tools > Events
See what error do you get while downloading.
Maybe it’s the Registry that cannot be saved and, most of times, this is not avast related.
Can you post if you have alert events (yellow) on Applications tab with number 1517?

11

Yes, that’s the screen. The event log doesn’t contain any error messages. Just the usual message of stopping instances. I don’t see anything unusal or unexpected.

The only reason I am suspecting avast is because it is the only component on my machine that has changed in the last two months. And if I disable avast before shutting down Windows I can complete the shutdown routine. So those are two good reasons to suspect avast but again there might be other reasons…since I am not trapping any other error I have to start troubleshooting somewhere.

Thanks for your help.

12

Well, not error messages but alert (yellow) ones.

Oh, I never say it’s not avast :wink:
Only that could be a conflict with the firewall while shutting down.
If you disable the firewall, does the error occur?

13

Yes, the error still occurs with the firewall disabled.

I can see neither error nor warnings - only blue information statements in the event logs.

14

I asked for help to Alwil team as I reach the end of my knowleage…
I can’t figure out what is happening :-[

Can you see if there is anything important into avast log viewer?

15

Set Avast’s log options to “show all” and shutdown. It may tell us more.

16

Yes, I found a working scenario.

All the logging didn’t really help. At least, I was logging lots of events but nothing out of the ordinary. Lots of services were started and stopped, and checked and verified but no major error message was jumping out at me.

So I decided to take a look at all the settings again (for the 59th time) and then I changed the ‘resident protection’ from ‘high’ (yes, you can call me paranoid) down to ‘standard’. And since I have done that, Windows is shutdown all the way. Hurray :smiley:

Thanks for all your help and patience.

Thomas

17

Looks like Avast is still scanning something when you are shutting down.