McAfee Enterprise causes slow shutdown?

[CraigHappy]

Hi

I am running Mcafee Enterprse and I've found it is causing my system to have a very slow shutdown.
If I uninstall McAfee, my system shutsdown straight away.
I'm running the latest version and dat updates.

Any ideas how to speed up the shutdown?

Many thanks

Craig.

 

[karlisi]

Any errors in eventlog?

===
Karlis
ECDL; MCSA

 

[CraigHappy]

Hi

I've checked the application error logs and there are two that show up -

Event Type: Warning
Event Source: Userenv
Event Category: None
Event ID: 1517
Date: 24/09/2007
Time: 12:56:18
User: NT AUTHORITY\SYSTEM
Computer: SWIFT
Description:
Windows saved user SWIFT\Craig registry while an application or service was still using the registry during log off. The memory used by the user's registry has not been freed. The registry will be unloaded when it is no longer in use.

This is often caused by services running as a user account, try configuring the services to run in either the LocalService or NetworkService account.

For more information, see Help and Support Center at

http://go.microsoft.com/fwlink/events.asp.

AND

Event Type: Error
Event Source: McLogEvent
Event Category: None
Event ID: 1008
Date: 24/09/2007
Time: 13:00:47
User: N/A
Computer: SWIFT
Description:
The McShield service terminated unexpectedly.
Please review event 5019 or 5051 for details. The McShield service will be restarted in 5 seconds;


I couldn't find an event 5019, but there was one for 5051, but that was on 13/09/2007. (see below)

Event Type: Error
Event Source: McLogEvent
Event Category: None
Event ID: 5051
Date: 13/09/2007
Time: 16:15:58
User: NT AUTHORITY\SYSTEM
Computer: SWIFT
Description:
A thread in process D:\Program Files\Network Associates\VirusScan\Mcshield.exe took longer than 90000 ms to complete a request.
The process will be terminated. Thread id : 1020 (0x3fc)
Thread address : 0x7C90EB94
Thread message :

Build Aug 20 2004 04:46:11 / 5200.2160
Object being scanned = Process 1832
by McShield.exe
20039(62)(0)
20038(62)(32)
20039(62)(0)
20038(62)(32)
20039(47)(0)
20038(47)(7)
20039(47)(0)
120031(47)(0)


So these do seem to point to an issue with Mcafee.

Any ideas how to correct the problem?

Many thanks

Craig.

 

[karlisi]

Not connected with McAfee. This is known bug in Windows XP. Microsoft have User Profile Hive Cleanup Service, which eliminates this problem. Download it here (long URL)

https://www.microsoft.com/downloads...6D-8912-4E18-B570-42470E2F3582&displaylang=en

===
Karlis
ECDL; MCSA

 

[CraigHappy]

Hi again Karlis

Many thanks for your help, it seems to have fixed the Application Event error log problems, but the system is still taking a pretty long time (over 3 mins) to shutdown.

In the System Event error log we have another error showing, not sure if this shows the reason why shutdown it taking so long? -

Event Type: Error
Event Source: Srv
Event Category: None
Event ID: 2000
Date: 25/09/2007
Time: 21:55:55
User: N/A
Computer: SWIFT
Description:
The server's call to a system service failed unexpectedly.

For more information, see Help and Support Center at

http://go.microsoft.com/fwlink/events.asp.

Data:
0000: 00 00 04 00 01 00 54 00 ......T.
0008: 00 00 00 00 d0 07 00 c0 ....Ð..À
0010: 00 00 00 00 0d 00 00 c0 .......À
0018: 00 00 00 00 00 00 00 00 ........
0020: 00 00 00 00 00 00 00 00 ........
0028: 2c 03 fa 00 ,.ú.


Many thanks

Craig.

 

[karlisi]

This error can be connected with long shutdown, perhaps some problems with network protocols. Read this

http://www.eventid.net/display.asp?eventid=2000&eventno=1067&source=Srv&phase=1

Have no personal experience on this problem, sorry.

===
Karlis
ECDL; MCSA

 

[CraigHappy]

Thanks again.

I have seemed to fix the shutdown speed (down to about 40 seconds), but still get the same System Error Event ID: 2000 "The server's call to a system service failed unexpectedly."

How I fixed the shutdown speed was to go to regedit -

HKEY_LOCAL_MACHINE > System > CurrentControlSet > Services > LanmanWorkstation > Parameters
and change the IRPStackSize Decimal value to 21

The System Error doesn't seem to affect anything with running the system, but if anyone knows of a solution to stop them, I'll give it a go.

Many thanks again.

Craig.

 

[CraigHappy]

I spoke to soon !!! That hasn't fixed it !!!

It only shutdown quick a couple of times.

Back to 3 minute shutdowns again. :-(

Oh well, back to the drawing board.

 

[mizzy]

Remove the scan floppy on shutdown.
I had a floppy-less laptop and this was the problem.