First shutdown trace: NetTcpPortSharing, SMSvcHost.exe(2064) stand out

**cluberti** · 04 May 2013

They're there for apps (only - Windows itself doesn't use them). If a dev needs to use them to do network port activation and sharing, then they need to be enabled. Your interesting tidbits with the android apps might be using them, possibly. Would be interested in seeing if what you're using still works after messing with them.

TrunkMonkey · 04 May 2013

cluberti said:

It does appear AVP is slowing down shutdown of services (in general) for almost 12 seconds from when winlogon gets the shutdown notification, so that's a problem. Then, there are the other issues I've found so far:

Network shutdown takes a while, and NetGear Genie is apparently part of the problem (it makes an inordinate number of diskIO requests during shutdown, during the 0-9 seconds window from notification, and that cannot be helping as A/V unloads and superfetch is flushing it's cache
Note as part of this delay, there's a delay in audiodg.exe hashing out the driver for "\Device\HarddiskVolume2\Windows\System32\ViaKaraokeApo.dll", which delays playing the shutdown sound, which actually delays shutdown for a little over 1.5 seconds or so. Not critical, but probably a crap driver.
After almost 9 seconds, Winlogon can finally unload the user and is likely to have placed you at the logonui screen (rather than the desktop). Windows Update stops here, approximately .67 seconds, then the rest of the services are allowed to stop. If we exclude the IIS services (why are these here???), AVP, and NetTCP port sharing, it's just over a second to stop services.
However, if we add back IIS, AVP, and the NetTCP Port Sharing, it's an additional 6.57 seconds AFTER THAT to shut down (which gives the ultimate time of around 20 seconds).

I'd update your driver set in general, but especially your network drivers. Second, remove any unnecessary pieces of networking software (like that NetGear Genie package, at the very least - I'd even attack IIS and your antivirus too and see if something else can accomplish what that is doing), and look at disabling services like NetTCP Port Sharing, NetPipe and NetTCPActivator, PolicyAgent, and things like Secunia.

Only once you've gotten things stable (even if that means removing certain things) can you consider putting things back (carefully, and with thorough perf traces to gauge impact) to get back to a state you might need.

The thing you have to remember is, if you really *do* need all that stuff you have installed, you might have to accept slower shutdown times (although this bad seems excessive, it's not totally uncommon).

Pretty certain this is all my doing since it's happened without changes to the basic hardware/software config on the PC

Any ideas for things to check on AVP? It's a rather strange interface for settings, and things seem kinda vague to me, but I'm getting used to it.

Netgenie was a recent addition, and also a startup for GA311 PCI adapter was in the mix until just a few hours ago. It seemed redundant (net usage graph and info box) so I updated it and there's no more tray icon, must have been a change to the software. I could do without the Genie for sure. In fact I don't think I've looked at it :)

Note as part of this delay, there's a delay in audiodg.exe hashing out the driver for "\Device\HarddiskVolume2\Windows\System32\ViaKaraokeApo.dll", which delays playing the shutdown sound, which actually delays shutdown for a little over 1.5 seconds or so. Not critical, but probably a crap driver.

Yep it's crap alright. My logon sound plays about 20 seconds after I'm logged in and using the PC. I never get to hear the logoff sound and yes I'm relegated to the logon screen almost immediately and most of shut down delay happens there. What are my other options for the VIA chipset? Or maybe a clean install of the latest version?

Which one is PolicyAgent?

Recommend doing away with Secunia or modifying settings? I had no idea it was doing anything unless I ran a scan! I don't use it often.

Another random memory is that I merged an entire stock set of Win7 services from blackviper. This was several weeks back and my weak attempt to shore up the mess I made in win services. Thoughts on a major Services reset? Does that exist? Sounds too easy.

TrunkMonkey · 05 May 2013

cluberti said:

It does appear AVP is slowing down shutdown of services (in general) for almost 12 seconds from when winlogon gets the shutdown notification, so that's a problem. Then, there are the other issues I've found so far:

Network shutdown takes a while, and NetGear Genie is apparently part of the problem (it makes an inordinate number of diskIO requests during shutdown, during the 0-9 seconds window from notification, and that cannot be helping as A/V unloads and superfetch is flushing it's cache
Note as part of this delay, there's a delay in audiodg.exe hashing out the driver for "\Device\HarddiskVolume2\Windows\System32\ViaKaraokeApo.dll", which delays playing the shutdown sound, which actually delays shutdown for a little over 1.5 seconds or so. Not critical, but probably a crap driver.
After almost 9 seconds, Winlogon can finally unload the user and is likely to have placed you at the logonui screen (rather than the desktop). Windows Update stops here, approximately .67 seconds, then the rest of the services are allowed to stop. If we exclude the IIS services (why are these here???), AVP, and NetTCP port sharing, it's just over a second to stop services.
However, if we add back IIS, AVP, and the NetTCP Port Sharing, it's an additional 6.57 seconds AFTER THAT to shut down (which gives the ultimate time of around 20 seconds).

I'd update your driver set in general, but especially your network drivers. Second, remove any unnecessary pieces of networking software (like that NetGear Genie package, at the very least - I'd even attack IIS and your antivirus too and see if something else can accomplish what that is doing), and look at disabling services like NetTCP Port Sharing, NetPipe and NetTCPActivator, PolicyAgent, and things like Secunia.

Only once you've gotten things stable (even if that means removing certain things) can you consider putting things back (carefully, and with thorough perf traces to gauge impact) to get back to a state you might need.

The thing you have to remember is, if you really *do* need all that stuff you have installed, you might have to accept slower shutdown times (although this bad seems excessive, it's not totally uncommon).

cluberti said:

They're there for apps (only - Windows itself doesn't use them). If a dev needs to use them to do network port activation and sharing, then they need to be enabled. Your interesting tidbits with the android apps might be using them, possibly. Would be interested in seeing if what you're using still works after messing with them.

They talk to TCP for emulation of any kind of button, computer or keyboard, and UDP for the mouse. Not sure if they are responsible for starting those manual services. One is a WMC plugin called "emote" and nothing boots at start up, and the other is WinRemote which doesn't start up at boot. Interesting fact Kaspersky HATES WinRemote, but I couldn't find anything definitive on Google about incidences. I finally figured out how to exclude it but AVP probably deleted that .exe at least 20 times. It's in the Play Store and a lot of people have paid money for it. But ya never know when something might get jacked. AVP never found a virus but considered it a critical vulnerability. Shoot, maybe it knew more than I thought and it has been compromised... nope not going down that path

of paranoia. No signs of any other system performance issues.

Hey thanks for the insight and I'll get back to the thread soon with results.

TrunkMonkey · 05 May 2013

I just did a reboot at 131 seconds, so definite improvement after a thorough service review using blackviper's site. My windows service settings now match his "safe" set of listings. Apparently "TWEAKED" would have issues with WMC and this machine is a part time HTPC. But I think it helped and several I was able to just trash. I also removed VIA software, and did a big CClean. Just reset all AVP settings to OEM, and now I'm going to try another trace to compare those specific numbers. I think netgear genie will be sacrificed first though. Firmware and drivers for both router and adapter are current. More soon...

**cluberti** · 05 May 2013

Good to hear :)

TrunkMonkey · 07 May 2013

https://www.dropbox.com/s/96vib4j9h0...REGISTRY_1.zip

Ok here is the same trace after hours and hours of digging and tweaking and researching. I'd be curious for your analysis on what the biggest improvements/changes were according to the Performance Kit data.

I was using a simple .vbs timer for desktop-to-desktop reboot times, and before I came here and started this journey I was seeing around 165 sec. The last one I did was 64 sec which is very nice.

Thanks.

TrunkMonkey · 11 May 2013

Wipe pagefile on shutdown was the biggest issue after all this. shaved about 15 seconds. I wonder when/how it got flipped on again?!