Windows Won't Shut Down

When I try to shut down Windows, it hangs at the "Saving Settings" screen. Why can't Windows even handle a simple shutdown?

Every time you shut down your PC, Windows attempts to close all running applications, stop all active services, and unload all drivers in memory. If just one of these components stops responding, Windows will wait until it can be closed successfully. As you can probably guess, all it takes is one crashed program or one stubborn driver to prevent Windows from shutting down.

The most common culprit is a power management bug found in many PCs. If you ever put your PC to "sleep" by pressing the power switch or closing the laptop lid, Windows may not be able to complete a formal shutdown thereafter. Unfortunately, there's not much you can do about this, other than checking your PC manufacturer's web site for a BIOS update.

If you never hibernate or sleep your PC, the problem may be spyware which can be adequately described as "stubborn"that refuses to be unloaded.

If an antispyware scan doesn't solve the problem, the errant program is likely a legitimate software component, and it may take a bit of sleuthing to track it down. Close all open applications, and then right-click an empty area of the Windows Taskbar. From the menu that appears, select Task Manager. Then choose the Processes tab to see a list all the programs running on your PC, including those running in the background; click the Image Name column header to sort the list alphabetically (see Figure).

Note: For an alternative to the Task Manager that allows you to see the full paths of the processes in memory, fire up the System Information tool (go to Start --> Run and type msinfo32.exe), expand the Software Environment branch on the tree, and select Running Tasks.

Your goal: find the programs that are causing your shutdown problem. Although the Task Manager won't give you this information directly, it will let you close almost any running program, one by one. Any program that you close with the End Process button in the Task Manager won't be running when you shut down, and thus can't prevent Windows from shutting down properly.

(This isn't foolproof, but it works pretty well most of the time.) Most of the programs listed in the Task Manager's Processes tab are Windows components necessary for the operating system to function (e.g., csrss.exe, inetinfo.exe, rundll32.exe, svchost.exe, winlogon.exe, etc.); the rest are either applications you've started or malware (viruses, spyware, etc.). A few processes will be self-explanatory, such as explorer.exe and firefox.exe, but odds are that you'll recognize very few others. So how do you tell the difference between the good processes and the bad?

The best way to research a particular process is to look up the filename in an online database of "known" processes, such as Windows process and task list. If you need more information, search for the filename with Google. However, there are two big complications that make identifying your running processes more difficult.

First, some forms of malware use the same filenames as common Windows components to disguise themselves. For instance, csrss.exe is the main executable for the Microsoft Client/Server Runtime Server Subsystem, a Windows component, but it also can be a virus (the W32.Netsky.AB@mm worm or the W32.Webus Trojan, specifically). The good news is that such
ambiguities are almost always chronicled in the online process databases.

Note: Rather than trying to painstakingly distinguish valid processes from Trojan horses, just scan your system with trusted antivirus and antispyware utilities. If the shutdown problem persists once that's out of the way, odds are that the culprit is nothing more than a valid yet misbehaving driver or application.

The other complication is that some entries in the Task Manager's Processes list are simply loader programs for background processes. Case in point: each instance of svchost.exe corresponds to a running service, but the Task Manager won't tell you which ones are which; all you'll see are multiple entries labeled svchost.exe. To see which services are running, and to stop, restart, or configure any services on your system, go to Start --> Run, type services.msc, and click OK.

When you've closed a handful of suspect programs, go ahead and shut down (or restart) Windows. If Windows shuts down normally, one of the programs you just closed was indeed the cause of the problem. Try updating or uninstalling the offending program or driver, and your shutdown problems should vanish.