Slow shutdown in XP, It is IMON. Help

Hello

I have just installed XP pro from scratch. Updated everything using Windows Update (except Media Player 9 stuff, CD writer stuff, wireless fix that I don't need and Jurnal Viewer). I have installed NOD32 2 but my system takes more time than normal in the "Windows is shuting down" message when restarting for example. The system doesn't hang, but it is deffinitly been affected in some way by something. The only resident program that I have is NOD32. I am on the default options. I can see the diskette scanning when closing windows, but this must not produce a slowdown problem no?

Have you noticed something like this? Any help is apreciated.apreciated

 

Re:Slow shuttdown in XP, It is IMON. Help

The problem resides in IMON. I have done several tests and I can confirm that when I disable IMON the problem disapears.
Have tested with IMON disabled and AMON enabled and the problem doesn't show. It is only when IMON is enabled (with or without AMON)

I am installing NOD32 V2 XP downloaded directly from www.nod32.com servers, I have downloaded the file yesterday then I asume that this one has all the updates of any previous fix allready.

When IMON is enabled the "Windows is shutting down" messages takes 15 seconds to disapear and restart the machine. With IMON disabled the same message takes only 2 seconds. We are speaking about big difference here. It is very annoying to me due that I am restarting the machine quite often, specially now that I am installing all the software.

I am a new customer of NOD32. I have migrated from NAV2004 in search for a good light AV that didn't interfere with the performance of my machine. This is definitly a dark spot that I was not expecting to find. Even NAV 2004 that is a resource eater has never slow down my XP shuttdon process.

My setup:

Asus P4C800 Deluxe (Canterwood)
P4 3Ghx Hypherthreading enabled.
1GB DDR400 RAM
ATI 9800PRO with Catalyst 3.10
Sound Blaster Audigy 2 only with drivers.
Network card: 3Com Gigabit LOM 3C940 (integrated in the motherboard).
Other network cards:
3Com Etherlink 10/100 3C905C-TX (disabled)
Sun JAVA plugin.
XP Pro SP1a just installed.
The only software that is running beside NOD32 is:
Executive Software Undelete Professional 4.0.096
ATI Control Center (installed by the official Cat. drivers)
Nothing else.

Please give me a hand here. I really apreciate it. Thank you very much.

 

Re:Slow shuttdown in XP, It is IMON. Help

My XP home system also takes a while to shut down, and infact has never shut down in 2 secs even before I put Nod on (which is in the last week).

I have to say I find XP very frustrating like that, but I know its XP as my system runs with very little extra running in the background.
Nod definately has made no difference to the shutdown speed of my pc even with the Imon and Amon allowed.

Cheers

 

Re:Slow shuttdown in XP, It is IMON. Help

When you shut down Windows XP, the OS tries its best to make sure that all
services (they help run things like graphics, printers etc) are shut down.
But there are times when they don't close, thus Windows XP tries to give
it the chance to shut down itself. This amount of time that windows waits
for the service to close is stored in the system registry.
If you modify this setting, then windows will shut down the service earlier. To modify the setting, follow the directions below:
Start Regedit.
Navigate to HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control.
Click on the "Control" Folder.
Select "WaitToKillServiceTimeout"
Right click on it and select Modify.
Set it to a value lower than 2000, say 1000 as a test.

 

Re:Slow shuttdown in XP, It is IMON. Help

I don't know for sure but was guessing it is part of NOD's shutdown protection. In my case, IMON stopped responding alltogether so shutting it down earlier won't hurt.
Windows give it X amount of time and if it isn't responding in that amount of time, will shut it down anyway.
Not sure when this issue will be fixed.

con

 

Re:Slow shuttdown in XP, It is IMON. Help

IMON is very horrible.... Now my PC is too slow on shutdown, start and navigated web pages... I hope that the problem is fixed soon... or for me isn't possible to use NOD on my PC...

 

Re:Slow shuttdown in XP, It is IMON. Help

I am using KAv 5.0 Beta till it gets cleared up lol


con

 

When I speak about 2 seconds, it is after the message "Windows is shutting down" appears, this is the last stage of the shut down process on XP. Before this you can read other messages in the same screen like "saving your settings", "logging off" and I don't remember if any other. My system can take up to 10 seconds to shut down in normal circumstances when IMON is disabled, counting from the pushing of the "restart" or "shut down" button in the "Turn off Computer" screen. Having IMON enabled adds around 15 seconds to this process.

@controler:
Shutting IMON down earlier is not an elegant option. From all the AV programs that I have evaluated before buying NOD32 none of them were needing this kind of trick for having a fast XP shutdown process (KAV and NAV 2004)

@Guest:
I have had this kind of tweak before enabled, via "Cacheman" tweaks. I have not enabled this yet (I am just installing all programs again). Maybe this will work, but making windows kill IMON doesn't seem to me like a nice option either. IMON should manage the shut down process OK without you needing to force the service termination with this kind of tweak.

As there is several people having the same issue, giving a positive confirmation of the problem I think ESET should give us some kind of answer about the situation and helping us with a fix for it. I have already emailed them with the report, and I expect to see an answer tomorrow in this forum. My experience with ESET is that they have always been very responsive about NOD32 problems before. I don't expect that to change.

 

Re:Slow shuttdown in XP, It is IMON. Help

 

Re:Slow shuttdown in XP, It is IMON. Help

Nope, I have a Radeon 9800 PRO with last Catalyst 3.10 (as written in my 2nd. post up), and after all the tests that I have done there is no doubt that IMON is the culprit here.
I still think that IMON should not produce such delay in shutdown. As I said before, the other AV programs that I tried didn't produce such delays with all their scanners enabled.

 

Re:Slow shuttdown in XP, It is IMON. Help

coz in writting areply I only see the 3 last posts.
so, I'm sorry for not reading closely
my system iis very close to yours but not HT
for me shutting down is normal with or without IMON
I suggeat you post hijack this log here
http://www.wilderssecurity.com/index.php?board=17

 

Re:Slow shuttdown in XP, It is IMON. Help

I will update this thread: Updating to last engine 2.000.9 doesn't solve the problem. I am in the process of finding the cause still. It can be maybe another program that is conflicting with NOD32.
I will post the hijack logs in the forum, but I have checked them and they look normall to me. No extrange spyware or other things here.

 

Re:Slow shuttdown in XP, It is IMON. Help

My system (XP) was also running slow until I deleted this "Update". I deleted and did not re-install Q811493 and have not had any problems since and my system is running as fast as ever.

Hope this helps!

 

Re:Slow shuttdown in XP, It is IMON. Help

Microsoft released a patch for Q811493 on May 23, 2003. You can find more info on it here http://support.microsoft.com/default.aspx?scid=kb;en-us;819634&Product=winxp

url tags added to the link - paul

I don't have the slow shutdown on my computer and I have the newer Q811493 installed.

 

Re:Slow shuttdown in XP, It is IMON. Help

This is exactly my point. Microsoft did release a revised Q811493 but if Thorz has the older version it may be slowing down performance.

 

This is what I have done:

I have installed Windows XP again and right after installing it I made a Ghost image.

1. I have installed NOD32 without installing absolutely anything else. NOD32 was the 1st. thing installed in the machine. I rebooted and let NOD32 update itself. Result: The same 15-20 seconds in the "windows is shutting down" message. Turned off IMON: Normal time (3-5 seconds) on "windows is shutting down"

2. I restored from the Ghost image and having Windows clean I installed all the drivers and all the Windows updates but these that I don't need:
- Windows Media Player 9 Series (Windows XP)
- Media Player 9 codecs (KB810243)
- Microsoft Windows Journal Viewer (Windows XP)
- Update for Windows XP HighMAT Support in CD Writing Wizard
- Wi-Fi Protected Access (WPA)

I have installed everything else (I suppose that Microsoft has all the updates corrected in its database already and there is no need to worry about installing old updates that were flawed (like Q811493).
After having all this loaded I installed NOD32 again. Same result here.

3. I installed NOD32 (V.2.0 off course) in my laptop that was reinstalled from scratch some days ago. And the same situation was present there also!

I don't know m8s, this is very strange. How can the program present the same problem in 2 machines totally different and having tested with Windows totally clean? I have to say that NOD32 DOESN'T make Windows slow at all. All the activity inside Windows is perfectly fine. It is the shut down process I repeat. It has to be a problem with IMON itself. Do you like to know what convinced me about this? I loaded the clean Ghost image one more time and installed NAV 2004 pro that I own too, and surprise yourselves: No delays at all in the shutdown process.

I don't have an AMD machine for testing. I have seen that there is people that has reported normal shut down times here. I don't know if they are on Intel or AMD machines. This are the configurations of the 2 machines where I have tested and that have presented the problem:

Desktop:
Asus P4C800 Deluxe latest BIOS (Canterwood)
Intel P4 3Ghz not overclocked. HT ON.
1GB RAM (Corsair DDR400)
ATI 9800 PRO
File system: NTFS
Sound Blaster Audigy 2
Network card: 3Com Gigabit LOM (integrated)

Laptop:
Acer Travelmate 630. SIS Chipset
Intel P4 1.6Ghz. No HT.
256MB RAM (SDR 133)
NVidia Geforce2 GO 100
File system: NTFS
Integrated SIS sound card
Network card: Realtek (integrated)

I have been in contact all the time with ESET support and I am sending some special IMON logs to them. If you like to help make this small test:

0. I assume that you are in XP, not 9x, and that you have not placed any tweaks for killing services in shut down (like the one described in this thread, Cacheman tweak or other).
1. Take a stopwatch
2. Check that all your NOD32 components are enabled (check IMON)
3. Restart (or turn off) your machine
4. Wait until you see the message "Windows is shutting down". (There are other messages before this but to be accurate in the test discard them).
5. Immediately after you see this message start the watch.
6. Stop the watch when your machine is totally off or when it restarts.

Take note of this time.

7. Go to NOD32 control panel and disable IMON totally (stop it and take out the check mark from "Load IMON at startup).
8. Reboot (it is needed because IMON is still active.
9. Let Windows load again and after it is completely loaded with IMON disabled proceed to Restart or Turn off the machine.
10. Follow the procedure up again and take note of the time. This time it must be much lower than the first time.

This are my results, verified several times:

With IMON: 15-20 seconds (consistent)
Without IMON: 3-5 seconds (consistent)

Note: For you that are using tweaks for killing slow services on shut down, take a look at your Event Viewer. In my case when i had this tweak ON my event viewer was populated of yellow warnings. One for every shut down after the tweak was in place. I am pretty sure that they were coming from IMON that was been killed before it could finish normally.

I thank in advance to the ones that like to help running the tests.

 

I don't know if this will work, but why not try unchecking "scan boot sectors on shutdown" in the AMON setup and see if that has any affect?

http://vuejade.net/Temp/AMON.jpg​

 

@Vuejade: As I have told before, the problem is IMON. Disabling IMON erases also the problem. The status of AMON is not an issue here. I have tested with IMON enabled and AMON totally disabled and the problem was still present. Thanks for the advice anyway m8.

@ronjor: Thanks my friend. As I was already suspecting it means that the problem is not from my side and there are other machines experimenting it also. Can you be so kind and post your system information for the thread? It is possible that we can find the common points if there are others that post the info here.
The problem maybe doesn't sound too bad, but believe me, 10-15 seconds of delay difference every time that you turn off or restart your machine becomes really annoying after many times.

Thank you.

 

It looks that we are not the only ones. Here is another thread about the slow down on shut down. This one is very populated:

http://www.wilderssecurity.com/showthread.php?t=10605;start=0

I just hope that ESET can give us a solution to this problem. NOD32 is superb IMO, but I feel really sad that it is causing this situation. I have just payed a one year licence and I am going to have to uninstall the program until a fix is in place, that is a shame

 

Thanks for the info ronjor. I agree with you that NOD32 is the best AV engine. I love it also. But the shut down problems sucks man. I am also behind a router here (SMC) but not firewall has been enabled yet. I see that you are on AMD, then this is not hardware related as I have tested it in 2 very different chipsets (Intek, SIS) and you have VIA+AMD.
I really like to see a comment from ESET about this. This is a real issue here.

 

I have to report sadly that after several days of have sent the IMON logs that I was asked to ESET I have not received any answer, or even see any comments from support in this thread.
Well, support was very responsive until now. It appear that they are clueless about this situation.

 

Hi Thorz,

I agree with your diagnosis of IMON causing the slow shutdown problem as I am having exactly the same problem on my pc, shutdown times comparable to yours.

As if that isn't enough, I can really put the icing on the cake...after I disable IMON and restart the machine the following message is displayed at the XP logon screen.

The instruction at "0x78001841" referenced memory at "0x783a4468". The memory could not be "read".

Click on OK to terminate the program.
Click on CAncel to debut the program.

Then for extra fun, after pressing OK...

The system cannot log you on due to the following error.
The handle is invalid.

If on the off chance I do succeed and make it to the desktop, there's more: Check out the error message pics attached.

PC specs:

NOD32 Antivirus System information
Virus signature database version:   1.615 (20040202)
Dated:   Monday, 2 February 2004
Virus signature database build:   4196

Information on other scanner support parts
Advanced heuristics module version:   1.005 (20031222)
Advanced heuristics module build:   1047
Internet filter version:   1.001 (20031104)
Internet filter build:   1012
Archive support module version:   1.011 (2004012
Archive support module build version:   1083

Information on installed components
NOD32 For Windows NT/2000/XP/2003 - Base
Version:   2.000.9
NOD32 For Windows NT/2000/XP/2003 - Internet support
Version:   2.000.8
NOD32 for Windows NT/2000/XP/2003 - Standard component
Version:   2.000.9

Operating system information
Platform:   Windows XP
Version:   5.1.2600 Service Pack 1
Version of common control components:   5.82.2800
RAM:   512 MB
Processor:   Intel(R) Pentium(R) 4 CPU 2.80GHz (2800 MHz)

As if this isn't enough, the NT Authority system then proceeds to shut the pc down...no, it's not a virus because after I disable IMON and restart the pc it runs perfect...no crashes, no error messages, runs for days without a restart. I reenable IMON and all the problems are back after restart, instantly! There is no doubt this is IMON related.

This is a clean install of XP, with all the latest Windows updates loaded.

Would any of the Eset mods care to shed some light on this?
Anyone else with similar errors?

Just on a side note, I won't be switching AVs, NOD is still the best...for the moment I'll just run it without enabling IMON, but please Eset how about a fix!

Rgds

Buster