Vista Hangs on Logoff

Just started having a new problem with my Vista machine, and it's
slowly driving me mad!

It seems that whenever my computer is on for a long period of time and
I go to log off a standard user account, Vista hangs on either the
"logoff" dialog or on a black screen.

I'm pretty sure I don't have any spyware or viruses, but I have just
recently installed Windows Powershell 1.0 and Spyware Dr. Starter
Edition (Google Pack).

Anyone seen this before? Anyone have any tips on troubleshooting?

Thanks,

-- Munchie

Are there any beeping sounds? Have you checked the Event Viewer to see if
there are any logged messages relating to hardware failure or error. Also,
are you using an updated device driver with your Video card?
--
Andre
Blog: http://adacosta.spaces.live.com
My Vista Quickstart Guide:
http://adacosta.spaces.live.com/blog...3DB!9709.entry
"munchie" <> wrote in message
news: oups.com...
> Just started having a new problem with my Vista machine, and it's
> slowly driving me mad!
>
> It seems that whenever my computer is on for a long period of time and
> I go to log off a standard user account, Vista hangs on either the
> "logoff" dialog or on a black screen.
>
> I'm pretty sure I don't have any spyware or viruses, but I have just
> recently installed Windows Powershell 1.0 and Spyware Dr. Starter
> Edition (Google Pack).
>
> Anyone seen this before? Anyone have any tips on troubleshooting?
>
> Thanks,
>
> -- Munchie
>

On Oct 18, 4:51 am, "Andre Da Costa[ActiveWin]" <andre...@hotmail.com>
wrote:
> Are there any beeping sounds? Have you checked the Event Viewer to see if
> there are any logged messages relating to hardware failure or error. Also,
> are you using an updated device driver with your Video card?
> --
> Andre
> Blog:http://adacosta.spaces.live.com
> My Vista Quickstart Guide:http://adacosta.spaces.live.com/blog/cns!E8E5CC039D51E3DB!9709.entry"munchie" <mrn...@gmail.com> wrote in message
>
> news: oups.com...
>

To answer your questions:
- There are no beeping sounds
- I have the latest graphics driver from nVidia

When I checked out Event Viewer, I did find some interesting stuff
though. For one thing, I was getting tons of errors about "Volume
Shadow Copy" being turned off--and people say this isn't needed! From
what I can tell, it was keeping me from creating restore points. The
real meat of the problem must be caused by this though. I need some
help interpreting:

Log Name: Application
Source: Microsoft-Windows-User Profiles Service
Date: 10/17/2007 7:52:25 PM
Event ID: 1530
Task Category: None
Level: Warning
Keywords: Classic
User: SYSTEM
Description:
Windows detected your registry file is still in use by other
applications or services. The file will be unloaded now. The
applications or services that hold your registry file may not function
properly afterwards.

DETAIL -
1 user registry handles leaked from \Registry\User
\S-1-5-21-1780669324-296816734-5956962-1001_Classes:
Process 900 (\Device\HarddiskVolume1\Windows\System32\svchost. exe) has
opened key \REGISTRY\USER
\S-1-5-21-1780669324-296816734-5956962-1001_CLASSES

Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-User Profiles Service"
Guid="{89B1E9F0-5AFF-44A6-9B44-0A07A7CE5845}"
EventSourceName="profsvc" />
<EventID Qualifiers="32768">1530</EventID>
<Version>0</Version>
<Level>3</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2007-10-17T23:52:25.000Z" />
<EventRecordID>2555</EventRecordID>
<Correlation />
<Execution ProcessID="0" ThreadID="0" />
<Channel>Application</Channel>
<Computer>root-PC</Computer>
<Security UserID="S-1-5-18" />
</System>
<EventData Name="EVENT_HIVE_LEAK">
<Data Name="Detail">1 user registry handles leaked from \Registry
\User\S-1-5-21-1780669324-296816734-5956962-1001_Classes:
Process 900 (\Device\HarddiskVolume1\Windows\System32\svchost. exe) has
opened key \REGISTRY\USER
\S-1-5-21-1780669324-296816734-5956962-1001_CLASSES
</Data>
</EventData>
</Event>

I believe the Volume Shadow Copy Services is utilized by the Previous
Versions, file versioning feature of Windows Vista which System Restore also
ties into. I would try doing a System Restore to an earlier point in time
before you started experiencing this problem and see if it fixes it.
--
Andre
Blog: http://adacosta.spaces.live.com
My Vista Quickstart Guide:
http://adacosta.spaces.live.com/blog...3DB!9709.entry
"munchie" <> wrote in message
news: oups.com...
> On Oct 18, 4:51 am, "Andre Da Costa[ActiveWin]" <andre...@hotmail.com>
> wrote:
>> Are there any beeping sounds? Have you checked the Event Viewer to see if
>> there are any logged messages relating to hardware failure or error.
>> Also,
>> are you using an updated device driver with your Video card?
>> --
>> Andre
>> Blog:http://adacosta.spaces.live.com
>> My Vista Quickstart
>> Guide:http://adacosta.spaces.live.com/blog/cns!E8E5CC039D51E3DB!9709.entry"munchie"
>> <mrn...@gmail.com> wrote in message
>>
>> news: oups.com...
>>
>
> To answer your questions:
> - There are no beeping sounds
> - I have the latest graphics driver from nVidia
>
> When I checked out Event Viewer, I did find some interesting stuff
> though. For one thing, I was getting tons of errors about "Volume
> Shadow Copy" being turned off--and people say this isn't needed! From
> what I can tell, it was keeping me from creating restore points. The
> real meat of the problem must be caused by this though. I need some
> help interpreting:
>
> Log Name: Application
> Source: Microsoft-Windows-User Profiles Service
> Date: 10/17/2007 7:52:25 PM
> Event ID: 1530
> Task Category: None
> Level: Warning
> Keywords: Classic
> User: SYSTEM
> Description:
> Windows detected your registry file is still in use by other
> applications or services. The file will be unloaded now. The
> applications or services that hold your registry file may not function
> properly afterwards.
>
> DETAIL -
> 1 user registry handles leaked from \Registry\User
> \S-1-5-21-1780669324-296816734-5956962-1001_Classes:
> Process 900 (\Device\HarddiskVolume1\Windows\System32\svchost. exe) has
> opened key \REGISTRY\USER
> \S-1-5-21-1780669324-296816734-5956962-1001_CLASSES
>
> Event Xml:
> <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
> <System>
> <Provider Name="Microsoft-Windows-User Profiles Service"
> Guid="{89B1E9F0-5AFF-44A6-9B44-0A07A7CE5845}"
> EventSourceName="profsvc" />
> <EventID Qualifiers="32768">1530</EventID>
> <Version>0</Version>
> <Level>3</Level>
> <Task>0</Task>
> <Opcode>0</Opcode>
> <Keywords>0x80000000000000</Keywords>
> <TimeCreated SystemTime="2007-10-17T23:52:25.000Z" />
> <EventRecordID>2555</EventRecordID>
> <Correlation />
> <Execution ProcessID="0" ThreadID="0" />
> <Channel>Application</Channel>
> <Computer>root-PC</Computer>
> <Security UserID="S-1-5-18" />
> </System>
> <EventData Name="EVENT_HIVE_LEAK">
> <Data Name="Detail">1 user registry handles leaked from \Registry
> \User\S-1-5-21-1780669324-296816734-5956962-1001_Classes:
> Process 900 (\Device\HarddiskVolume1\Windows\System32\svchost. exe) has
> opened key \REGISTRY\USER
> \S-1-5-21-1780669324-296816734-5956962-1001_CLASSES
> </Data>
> </EventData>
> </Event>
>
>

Is it possible that one of the services that depends on VSS is still running?
If so, that service would likely "hang" because it couldn't access the
service. Sorry, but I've got no clue about what services depend on it
(although http://www.blackviper.com might be a place to start).

- John

"munchie" wrote:

> Just started having a new problem with my Vista machine, and it's
> slowly driving me mad!
>
> It seems that whenever my computer is on for a long period of time and
> I go to log off a standard user account, Vista hangs on either the
> "logoff" dialog or on a black screen.
>
> I'm pretty sure I don't have any spyware or viruses, but I have just
> recently installed Windows Powershell 1.0 and Spyware Dr. Starter
> Edition (Google Pack).
>
> Anyone seen this before? Anyone have any tips on troubleshooting?
>
> Thanks,
>
> -- Munchie
>
>

Try turning VSS back on and see if it fixes the problem.

--
Kerry Brown
Microsoft MVP - Shell/User
http://www.vistahelp.ca


"munchie" <> wrote in message
news: oups.com...
> On Oct 18, 4:51 am, "Andre Da Costa[ActiveWin]" <andre...@hotmail.com>
> wrote:
>> Are there any beeping sounds? Have you checked the Event Viewer to see if
>> there are any logged messages relating to hardware failure or error.
>> Also,
>> are you using an updated device driver with your Video card?
>> --
>> Andre
>> Blog:http://adacosta.spaces.live.com
>> My Vista Quickstart
>> Guide:http://adacosta.spaces.live.com/blog/cns!E8E5CC039D51E3DB!9709.entry"munchie"
>> <mrn...@gmail.com> wrote in message
>>
>> news: oups.com...
>>
>
> To answer your questions:
> - There are no beeping sounds
> - I have the latest graphics driver from nVidia
>
> When I checked out Event Viewer, I did find some interesting stuff
> though. For one thing, I was getting tons of errors about "Volume
> Shadow Copy" being turned off--and people say this isn't needed! From
> what I can tell, it was keeping me from creating restore points. The
> real meat of the problem must be caused by this though. I need some
> help interpreting:
>
> Log Name: Application
> Source: Microsoft-Windows-User Profiles Service
> Date: 10/17/2007 7:52:25 PM
> Event ID: 1530
> Task Category: None
> Level: Warning
> Keywords: Classic
> User: SYSTEM
> Description:
> Windows detected your registry file is still in use by other
> applications or services. The file will be unloaded now. The
> applications or services that hold your registry file may not function
> properly afterwards.
>
> DETAIL -
> 1 user registry handles leaked from \Registry\User
> \S-1-5-21-1780669324-296816734-5956962-1001_Classes:
> Process 900 (\Device\HarddiskVolume1\Windows\System32\svchost. exe) has
> opened key \REGISTRY\USER
> \S-1-5-21-1780669324-296816734-5956962-1001_CLASSES
>
> Event Xml:
> <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
> <System>
> <Provider Name="Microsoft-Windows-User Profiles Service"
> Guid="{89B1E9F0-5AFF-44A6-9B44-0A07A7CE5845}"
> EventSourceName="profsvc" />
> <EventID Qualifiers="32768">1530</EventID>
> <Version>0</Version>
> <Level>3</Level>
> <Task>0</Task>
> <Opcode>0</Opcode>
> <Keywords>0x80000000000000</Keywords>
> <TimeCreated SystemTime="2007-10-17T23:52:25.000Z" />
> <EventRecordID>2555</EventRecordID>
> <Correlation />
> <Execution ProcessID="0" ThreadID="0" />
> <Channel>Application</Channel>
> <Computer>root-PC</Computer>
> <Security UserID="S-1-5-18" />
> </System>
> <EventData Name="EVENT_HIVE_LEAK">
> <Data Name="Detail">1 user registry handles leaked from \Registry
> \User\S-1-5-21-1780669324-296816734-5956962-1001_Classes:
> Process 900 (\Device\HarddiskVolume1\Windows\System32\svchost. exe) has
> opened key \REGISTRY\USER
> \S-1-5-21-1780669324-296816734-5956962-1001_CLASSES
> </Data>
> </EventData>
> </Event>
>
>

Hi,

I have same problem ,

::Log Name: Application::
::Source: Microsoft-Windows-User Profiles Service::
:ate: 27/05/2008 00:12:34::
::Event ID: 1530::
::Task Category: None::
::Level: Warning::
::Keywords: Classic::
:escription:::
::Windows detected your registry file is still in use by other
applications or services. The file will be unloaded now. The
applications or services that hold your registry file may not function
properly afterwards. ::
:: ::
Does anyone have a clue how to prevent this happening?
Thanks


--
kammbo