System locks up, hard reboot required after 30-40 sec from startup

kbell01 · Sep 4, 2012

Hello,

I upgraded my system to Windows 8 32bit from Windows 7. Prior to the upgrade my computer had issues where it would occasionally lock up completely (not responding to any keys even Ctrl-Alt-Del and unable to move the mouse) and a hard Shut Down (i.e. holding the Power Button down for a few seconds) was required in order to bring it back to life.

It wasn't a huge problem before as it only happened once a week or so, but for some reason it now locks up within 30-40 seconds of booting every time I power up the laptop following a Proper Shut Down procedure ever since upgrading to Win8. The odd thing is that it's okay following the power off hard shutdown but does it again after another proper shut down (either by closing the lid or clicking on Settings/Power/Shut Down)

Any help would be greatly appreciated.

System specs:
OS Name Microsoft Windows 8 Pro
Version 6.2.9200 Build 9200
System Manufacturer Acer
System Model Extensa 4420
System Type X86-based PC
System SKU
Processor AMD Athlon(tm) 64 X2 Dual-Core Processor TK-57, 1900 Mhz, 2 Core(s), 2 Logical Processor(s)
BIOS Version/Date Phoenix Technologies LTD V1.17, 3/25/2008
SMBIOS Version 2.4
Embedded Controller Version 255.255
BIOS Mode Legacy
BaseBoard Manufacturer Acer
Platform Role Mobile
Secure Boot State Unsupported
PCR7 Configuration Binding Not Possible
Boot Device \Device\HarddiskVolume2
Locale United States
Hardware Abstraction Layer Version = "6.2.9200.16384"
Installed Physical Memory (RAM) 2.00 GB
Total Physical Memory 1.75 GB
Available Physical Memory 709 MB
Total Virtual Memory 3.50 GB
Available Virtual Memory 2.10 GB
Page File Space 1.75 GB
Page File C:\pagefile.sys
Hyper-V - VM Monitor Mode Extensions Yes
Hyper-V - Second Level Address Translation Extensions No
Hyper-V - Virtualization Enabled in Firmware Yes
Hyper-V - Data Execution Protection Yes

I've attached the BSOD utility files for your review.

If I've missed something, please let me know! Thanks.

Ken Bell

Dave76 · Sep 9, 2012

Welcome to Eight Forums kbell01.

There are no BSoD dump file in your zip folder, can you check your settings?
Dump Files - Configure Windows to Create on BSOD

After checking all the settings, upload any new crash dump files along with the complete SF_Diagnostic_Tool files.

From you information it is probably a hardware issue.

D/L and run the HGST Drive Fitness Test

Test the RAM with memtest86+, leave all RAM cards installed, run for a full 7 passes - best to run overnight.
If you get any errors your can stop the test.
RAM - Test with Memtest86+

kekin · Sep 10, 2012

Have you tried this, man? Workaround for Windows 8 freezing issues Within Windows

kbell01 · Sep 11, 2012

Hi Dave76

Thanks so much for your help. I did what you suggested but still have the problem. After I turned on Mini Dump I followed the same sequence as before (twice) to get additional SF Tool dumps. I've attached the sequence I followed to duplicate the problem (with the time I performed the action) and the two subsequent dumps.

I ran the HGST Drive Fitness test 3 times (advanced) and had no errors. The only strange thing was that I had to reboot between each test to get the test to tun again.

I ran Memtest86+ overnight as you suggested also with no errors. It completed 13 passes.

Thanks again for your help.

Ken

kbell01 · Sep 11, 2012

Hi Kekin,

Thanks for your suggestion. I followed the workaround but it didn't help. I'll leave it in for a while just to make sure. I've attached the results of the DOS command

Microsoft Windows [Version 6.2.9200]
(c) 2012 Microsoft Corporation. All rights reserved.

C:\WINDOWS\system32>bcdedit

Windows Boot Manager
--------------------
identifier {bootmgr}
device partition=C:
description Windows Boot Manager
locale en-US
inherit {globalsettings}
integrityservices Enable
default {current}
resumeobject {3634893a-1185-11e0-849c-f0717e9d5a68}
displayorder {current}
toolsdisplayorder {memdiag}
timeout 0

Windows Boot Loader
-------------------
identifier {current}
device partition=C:
path \WINDOWS\system32\winload.exe
description Windows 8
locale en-US
inherit {bootloadersettings}
recoverysequence {3634893c-1185-11e0-849c-f0717e9d5a68}
integrityservices Enable
recoveryenabled Yes
allowedinmemorysettings 0x15000075
osdevice partition=C:
systemroot \WINDOWS
resumeobject {3634893a-1185-11e0-849c-f0717e9d5a68}
nx OptIn
bootmenupolicy Standard
disabledynamictick Yes

C:\WINDOWS\system32>

Thanks again!

Ken

kbell01 · Sep 11, 2012

Hi Dave76 and kekin

I've found that this only happens when I do a shut down (i.e. click on Settings/Power/Shut Down) and then power the computer back on. It does not happen when I perform a Restart (i.e. click on Settings/Power/Restart) or Sleep (i.e. click on Settings/Power/Sleep)

Dave76 · Sep 12, 2012

Did you do an upgrade install with this version of Win8?
What anti virus are you using?

No dump files in either zip folder.
The system event logs from both zip folders are identical.
Was looking for an event entry for the UI shut down, but none.

System Event Logs are not recent.
from Date: 2011-07-25T18:56:31.229
to Date: 2012-04-11T16:17:11.469

App Event Logs have the correct dates.
This appears to be the first shutdown from your Timeline of Lockup file.
The System Events Logs would be a better reference, but this time segment is missing.

Code:

Event[39940]:
  Log Name: Application
  Source: ESENT
  Date: 2012-09-10T12:29:28.000
  Event ID: 327
  Task: General
  Level: Information
  Opcode: Info
  Keyword: Classic
  User: N/A
  User Name: N/A
  Computer: Ken-Acer
  Description: 
msiexec (1948) Instance: The database engine detached a database (1, C:\ProgramData\Microsoft\Windows\AppRepository\PackageRepository.edb). (Time=0 seconds) 
 
Internal Timing Sequence: [1] 0.000, [2] 0.000, [3] 0.000, [4] 0.000, [5] 0.000, [6] 0.015, [7] 0.000, [8] 0.000, [9] 0.000, [10] 0.031, [11] 0.032, [12] 0.000. 
Revived Cache: 0

Event[39941]:
  Log Name: Application
  Source: ESENT
  Date: 2012-09-10T12:29:28.000
  Event ID: 103
  Task: General
  Level: Information
  Opcode: Info
  Keyword: Classic
  User: N/A
  User Name: N/A
  Computer: Ken-Acer
  Description: 
msiexec (1948) Instance: The database engine stopped the instance (0). 
 
Dirty Shutdown: 0 
 
Internal Timing Sequence: [1] 0.000, [2] 0.000, [3] 0.000, [4] 0.000, [5] 0.000, [6] 0.000, [7] 0.000, [8] 0.000, [9] 0.000, [10] 0.015, [11] 0.000, [12] 0.000, [13] 0.000, [14] 0.000, [15] 0.000.

Event[39942]:
  Log Name: Application
  Source: Microsoft-Windows-User Profiles Service
  Date: 2012-09-10T12:32:24.633
  Event ID: 1530
  Task: N/A
  Level: Warning
  Opcode: Info
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: Ken-Acer
  Description: 
Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards.  

 DETAIL - 
 3 user registry handles leaked from \Registry\User\S-1-5-21-2171769479-1788307511-2445753593-1001:
Process 972 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2171769479-1788307511-2445753593-1001
Process 972 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2171769479-1788307511-2445753593-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Process 952 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2171769479-1788307511-2445753593-1001\Software\Microsoft\Windows\CurrentVersion\Uninstall


Event[39943]:
  Log Name: Application
  Source: Desktop Window Manager
  Date: 2012-09-10T12:32:29.000
  Event ID: 9009
  Task: N/A
  Level: Information
  Opcode: N/A
  Keyword: Classic
  User: N/A
  User Name: N/A
  Computer: Ken-Acer
  Description: 
The Desktop Window Manager has exited with code (0xd00002fe)

You have an app hanging during shutdown, looks like something connected to the internet.
Open resource Monitor > Overview tab and look for LiveComm.exe
Tell me if it is 'Suspended' and if not how much resources it's using.

The last entry in the log.

Code:

Event[40094]:
  Log Name: Application
  Source: iPod Service
  Date: 2012-09-10T13:41:09.000
  Event ID: 0
  Task: None
  Level: Information
  Opcode: Info
  Keyword: Classic
  User: N/A
  User Name: N/A
  Computer: Ken-Acer
  Description: 
N/A

Are you closing all programs before shutting down?

Uninstall iTunes and any other iPod app, for testing.

kbell01 · Sep 12, 2012

Hi Dave,

In answer to your questions;
I upgraded from Windows 7 Pro
With Win 7 I used Microsoft Essentials and now with Win8 only Windows Defender
LiveComm.exe is suspended
Usually I close all apps before the shutdown but sometimes not
I removed the following programs:
iTunes
Apple Application Support
Apple Mobile device
Apple software updater
Bonjour
I'll leave everything uninstalled for now.
No change. Still locks up. Do you need another log dump with a timeline?

Any thoughts on getting the System Events log working again if you think that might help?

Ken

kbell01 · Sep 12, 2012

Hi Dave,

I disabled the "Turn on Fast Startup" option in the "Control Panel - Hardware and Sound - Power Options - Choose what the Power Buttons do" under the Shutdown Settings section and that stopped the lockups. So if we don't resolve the root cause, at least we'll have a work around.

Thanks again for your help!

Ken

Dave76 · Sep 13, 2012

Good to hear you found a work around.

We can look a bit further if you want.

To check the System Event Log settings.
1. Start Event Viewer.
2. In the console tree, expand Windows Logs and select System.
3. On the Action menu, click Properties.
4. In the General Tab, ensure 'Enable logging' is checked.
Maximum log size should be 20480
Under 'When maximum event log size is reached': select 'Overwite events as needed (oldest events first)'
Click OK.

If you are still not getting new System Event Logs, you can 'Clear Log' on the same page.

After completing the above, if System Event Logs are recording, you can upload another another log dump with a timeline.

Run the System File Checker: SFC /SCANNOW Command - Run in Windows 8
Use Option Two: To Run the SFC /SCANNOW Command in Windows 8
If it finds anything or says it can't fix something, run it a minimum of three times with re-boot after each run.

Fast sta[/URL]rtup is a setting that helps your PC start up faster after shutdown. Windows does this by saving system info to a file upon shutdown. When you start your PC again, Windows uses that system info to resume your PC instead of restarting it.

•The fast startup setting doesn’t apply to Restart. You need to shut down and then start your PC again for fast startup to take effect.

One of your programs that is running or a startup program might be causing the lockup when you use normal shut down, as indicated by no lockup during a restart.
You can test this by making sure every program is closed before using the normal shutdown, check for the lockup.

If that doesn't resolve it go to Task Manager > Startup tab and disable everything except your AV, test for the lockup.

kbell01 · Sep 13, 2012

Hi Dave,

I followed the procedure for checking the event log and it was already set up as you described. I pressed the OK button and tried the Shutdown again and still no log. I cleared the event log as you suggested and then it starting working. I performed two shutdown procedures (with Fast Start up enabled) and logged the results (attached).

I don't have to Win8 disk with me so I'll do the ScanNow procedure tomorrow evening and send you the results.

Thanks for sticking with this!

Ken

kbell01 · Sep 13, 2012

Hi Dave,

I forgot to mention that I disabled all of the tart up programs using task manager and used msconfig to disable all of the non Microsoft services. I did this a few weeks ago and again 2 days ago. I still had the lock up problem with both start up and services disabled.

Ken

kbell01 · Sep 14, 2012

Hi Dave,

I ran the ScanNow program (option 2) and it was clean.

Ken

Dave76 · Sep 15, 2012

All the hardware seems to be good, OS passed the SFC scan.

This is what happens when you shutdown normally.

Event[39916]:
Log Name: Application
Source: Microsoft-Windows-User Profiles Service
Date: 2012-09-13T20:40:40.987
Event ID: 1530
Task: N/A
Level: Warning
Opcode: Info
Keyword: N/A
User: S-1-5-18
User Name: NT AUTHORITY\SYSTEM
Computer: Ken-Acer
Description:
Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards.

Code:

DETAIL - 
 32 user registry handles leaked from \Registry\User\S-1-5-21-2171769479-1788307511-2445753593-1001:
Process 608 (\Device\HarddiskVolume2\Windows\System32\lsass.exe) has opened key \REGISTRY\USER\S-1-5-21-2171769479-1788307511-2445753593-1001
Process 608 (\Device\HarddiskVolume2\Windows\System32\lsass.exe) has opened key \REGISTRY\USER\S-1-5-21-2171769479-1788307511-2445753593-1001
Process 608 (\Device\HarddiskVolume2\Windows\System32\lsass.exe) has opened key \REGISTRY\USER\S-1-5-21-2171769479-1788307511-2445753593-1001
Process 608 (\Device\HarddiskVolume2\Windows\System32\lsass.exe) has opened key \REGISTRY\USER\S-1-5-21-2171769479-1788307511-2445753593-1001
Process 980 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2171769479-1788307511-2445753593-1001
Process 980 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2171769479-1788307511-2445753593-1001
Process 980 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2171769479-1788307511-2445753593-1001
Process 980 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2171769479-1788307511-2445753593-1001
Process 980 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2171769479-1788307511-2445753593-1001
Process 980 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2171769479-1788307511-2445753593-1001
Process 608 (\Device\HarddiskVolume2\Windows\System32\lsass.exe) has opened key \REGISTRY\USER\S-1-5-21-2171769479-1788307511-2445753593-1001\Software\Microsoft\SystemCertificates\TrustedPeople
Process 980 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2171769479-1788307511-2445753593-1001\Software\Microsoft\SystemCertificates\TrustedPeople
Process 608 (\Device\HarddiskVolume2\Windows\System32\lsass.exe) has opened key \REGISTRY\USER\S-1-5-21-2171769479-1788307511-2445753593-1001\Software\Microsoft\SystemCertificates\Disallowed
Process 980 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2171769479-1788307511-2445753593-1001\Software\Microsoft\SystemCertificates\Disallowed
Process 980 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2171769479-1788307511-2445753593-1001\Software\Policies\Microsoft\SystemCertificates
Process 980 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2171769479-1788307511-2445753593-1001\Software\Policies\Microsoft\SystemCertificates
Process 980 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2171769479-1788307511-2445753593-1001\Software\Policies\Microsoft\SystemCertificates
Process 980 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2171769479-1788307511-2445753593-1001\Software\Policies\Microsoft\SystemCertificates
Process 608 (\Device\HarddiskVolume2\Windows\System32\lsass.exe) has opened key \REGISTRY\USER\S-1-5-21-2171769479-1788307511-2445753593-1001\Software\Policies\Microsoft\SystemCertificates
Process 608 (\Device\HarddiskVolume2\Windows\System32\lsass.exe) has opened key \REGISTRY\USER\S-1-5-21-2171769479-1788307511-2445753593-1001\Software\Policies\Microsoft\SystemCertificates
Process 608 (\Device\HarddiskVolume2\Windows\System32\lsass.exe) has opened key \REGISTRY\USER\S-1-5-21-2171769479-1788307511-2445753593-1001\Software\Policies\Microsoft\SystemCertificates
Process 608 (\Device\HarddiskVolume2\Windows\System32\lsass.exe) has opened key \REGISTRY\USER\S-1-5-21-2171769479-1788307511-2445753593-1001\Software\Policies\Microsoft\SystemCertificates
Process 608 (\Device\HarddiskVolume2\Windows\System32\lsass.exe) has opened key \REGISTRY\USER\S-1-5-21-2171769479-1788307511-2445753593-1001\Software\Microsoft\SystemCertificates\trust
Process 980 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2171769479-1788307511-2445753593-1001\Software\Microsoft\SystemCertificates\trust
Process 980 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2171769479-1788307511-2445753593-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Process 960 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2171769479-1788307511-2445753593-1001\Software\Microsoft\Windows\CurrentVersion\Uninstall
Process 608 (\Device\HarddiskVolume2\Windows\System32\lsass.exe) has opened key \REGISTRY\USER\S-1-5-21-2171769479-1788307511-2445753593-1001\Software\Microsoft\SystemCertificates\Root
Process 980 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2171769479-1788307511-2445753593-1001\Software\Microsoft\SystemCertificates\Root
Process 608 (\Device\HarddiskVolume2\Windows\System32\lsass.exe) has opened key \REGISTRY\USER\S-1-5-21-2171769479-1788307511-2445753593-1001\Software\Microsoft\SystemCertificates\CA
Process 980 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2171769479-1788307511-2445753593-1001\Software\Microsoft\SystemCertificates\CA
Process 608 (\Device\HarddiskVolume2\Windows\System32\lsass.exe) has opened key \REGISTRY\USER\S-1-5-21-2171769479-1788307511-2445753593-1001\Software\Microsoft\SystemCertificates\SmartCardRoot
Process 980 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2171769479-1788307511-2445753593-1001\Software\Microsoft\SystemCertificates\SmartCardRoot

These are what's causing your lockups after normal shutdowns.
These are getting corrupted before they are saved to be used to start up the system.

(\Device\HarddiskVolume2\Windows\System32\lsass.exe)
"The process lsass.exe is the Local Security Authority Subsystem Service by Microsoft, Inc. It is responsible for the enforcement of security policies within Microsoft's Operating Systems. This process checks whether a user’s supplied identification is valid or not whenever he or she tries to access the computer system.
With the execution of the file lsass.exe, the system acquires security by preventing the access of unwanted users to any personal information. The process lsass.exe also handles the password modifications done by the user."

(\Device\HarddiskVolume2\Windows\System32\svchost.exe)
"Svchost.exe is a Windows system file. It is the Generic Host Process for Win32 Services. Svchost.exe manages 32-bit DLLs as well as other services. Microsoft runs a lot of software functionality from DLL (dynamic link library) interface. On startup, svchost.exe checks the services in the Registry and makes a list of services it has to load."

Return from sleep, which is what this type of shutdown is, has always been very difficult to diagnose, this is a known Windows issue for years.
Only way I know to fix this is to re-install the OS, clean install is recommended.

kbell01 · Sep 15, 2012

Hi Dave,

I was afraid that was going to be the ultimate answer but I really do appreciate your effort in trying to avoid it. I also learned a great deal from you. I'll probably run a few more days with Fast Start Up disabled until I can work up enough enthusiasm to do a clean install.

Thank you VERY much for working with me on this!

Ken

Dave76 · Sep 16, 2012

Your welcome.

Glad to help, good to check everything you can but, sometimes it's inevitable.

Let me know if you have any issues or questions.

System locks up, hard reboot required after 30-40 sec from startup

Member

My Computer

Team Member

My Computer

Member

My Computer

Member

My Computer

Member

My Computer

Member

My Computer

Team Member

My Computer

Member

My Computer

Member

My Computer

Team Member

My Computer

Member

My Computer

Member

My Computer

Member

My Computer

Team Member

My Computer

Member

My Computer

Team Member

My Computer