Troubleshooting Mac OS X Hang on Shutdown

My MacBook Pro was not shutting down properly, and it took a fair amount of time to locate the cause of the problem. Google search results for “Mac OS X hangs on shutdown” were abundant, but none of the suggested resolutions fixed the problem my system was experiencing. I eventually found the cause of the problem, and I feel it’s worth sharing here. Hopefully the information in this article with be helpful to others.

The Problem

When I would shutdown or restart my Mac, the system would hang with the spinning grey beach ball on the display. Eventually I would have to use the power button to power off my Mac. This was happening under both Snow Leopard and Lion.

Troubleshooting the Problem

After months of dealing with this problem, it because apparent that the problem was related Parallels Desktop 7. I came to this conclusion because the problem only occurred after running a Parallels virtual machine for a few hours. As a quick resolution I uninstalled Parallels, installed VMware Fusion 4, and converted my Parallels virtual machines for use with Fusion. Everything was working great under Fusion 4—the shutdown problem was resolved, and I was happy with the performance of Fusion. However, after using Fusion for a while, I started noticing strange behavior with my CentOS virtual machines. For example, the Vim editor would hang occasionally, and at one point my ethernet bridge to the local system was going up and down repeatedly. The problem with the Ethernet connectivity and rumors of often corrupted Fusion virtual machines was enough to convince me to uninstall Fusion and switch back to Parallels. Of course after switching back to Parallels, my shutdown problems came back to haunt me.

As a developer who often works in a virtual machine environment, I don’t want to waste time troubleshooting an unstable virtual environment (Fusion). I also can’t risk losing hours of work. Parallels has always been a very stable solution, and I’ve never experienced any problems with any of my virtual machines.

The Solution

I eventually found that Kaspersky Anti-Virus 2011 was the cause of my problems. When I removed Kaspersky from my system by running the Kaspersky uninstall script, the shutdown problem was resolved. Once I was confident the shutdown problem was completely resolved, I tried reinstalling Kaspersky, and found the the shutdown problem eventually reappeared. So if you’re experiencing shutdown problems on a Mac that’s running Parallels and Kaspersky, uninstall Kaspersky!

If you uninstalled Kaspersky and you’re still experiencing shutdown problems, you should confirm that Kaspersky is completely uninstalled. Try running the following kextstat command to see if Kaspersky is still being loaded as a kernel extension.

 

kextstat -kl | awk ' !/apple/ { print $6 } '

If after running the above command you see any references to Kaspersky in the output, you probably didn’t use the Kaspersky uninstall script. You can access this uninstall script by running the Kaspersky installation dmg file—just select the option “Kaspersky Anti-Virus 2011 Uninstaller.app” instead of “Kaspersky Anti-Virus 2011.mpkg.”

Other Possible Solutions

If uninstalling Kaspersky Anti-Virus 2011 didn’t resolve your shutdown problem, try some of the following troubleshooting steps:

  • Try stopping the Kaspersky services “Kaspersky” and “kav,” and deleting the file “/.com_kaspersky_iswift_journal” prior to shutting down or restarting your system.
  • Try removing items from your login items. One way to eliminate anything in your login items is to document what applications you have listed in your startup items, and remove all of them (System Preferences > Users & Groups > Login Items). If your shutdown problem persists, add all of the login items back. Another (faster) option would be to move or rename “~/Library/Preferences/com.apple.loginitems.plist” (I’ve never done it this way, but it should work).
  • Try manually stopping various services before you shutdown or reboot your system. Use the Activity Monitor to view and stop the various services, or the appropriate commands in a terminal window. I recommend documenting which services you manually stopped so you can keep track of which ones you tried.
  • For a few months while I was experiencing these shutdown problems, I ran a custom shell script that would kill all of the services/processes that I suspected were causing the problem. This solution worked fairly well, but I grew tired of having to run the script every time I wanted to shutdown my system. An example kill script is shown below. It uses “ps aux” to pull a listing of processes, pipes that into “grep” to look for the suspected process by name, pipes that to “cut” to get the Process ID (PID), and then pipes that into “xargs” to pass each string to the utility “kill” to terminate the process.

ps aux | grep -i prl_ | cut -c 17-22 | xargs kill
ps aux | grep -i Kaspersky | cut -c 17-22 | xargs kill
ps aux | grep -i kav | cut -c 17-22 | xargs kill
cd /
rm .com_kaspersky_iswift_journal

If you’re like me and prefer to run Parallels Desktop7 and Kaspersky Anti-Virus on the same system, you can make the process of running this script a bit easier by creating an ApplsScript file that calls it. You can then copy the AppleScript file to the /Library/Scripts directory, and show the script icon in the top menu bar to have quick access to the script.

Example of running the shell script “cleanshutdown” from AppleScript

do shell script "/usr/local/bin/cleanshutdown" password "" with administrator privileges

Recommended Anti-Virus for Mac

If you prefer to continue using an anti-virus product on your Mac (I do), I highly recommend VirusBarrier X6 by Intego. VirusBarrier X6 has a very small memory footprint and includes tons of options and additional utilities, some of which will will appeal to security professionals who like to use traceroute (including a mapping function), advanced firewall options (similar to fwbuilder for iptables), and traffic analysis tools.

I switched to VirusBarrier X6 a couple of weeks ago, and I haven’t had one shutdown problem! The problem is solved!

Tags: ,

Troubleshooting Mac OS X Hang on Shutdown

29 Responses

  1. Hi Robert,

    I can unequivocally confirm your findings. After 4 hours of troubleshooting and discovering that iTunes tripped the Kaspersky daemon, I was able to key in on the correct search terms that led me to your blogpost here.

    Ran the uninstall script, and all was resolved.

    With the utmost appreciation,

    Tim ;)

    Timothy Idol May 17, 2012 at 8:02 am #
    • Thanks for the comment Timothy, and I’m glad the article helped resolve your problem!

      Robert

      May 17, 2012 at 8:09 am #
      • Another very happy and grateful blogger here. My issue was all the more annoying as it seemed inconsistent. About every fifth shut down. I noticed a KAV process with Activity Monitor using up resources and sometimes being a real CPU hog. What got me initially was that I didn’t have any trace of kaspersky on my system. Spotlight couldn’t find anything. I must have installed and deleted it when I installed Paralles although I’ve been living with this for so long I can’t remember! I blame a bad uninstall. I downloaded a trial version of Kaspersky antivirus from their website and used the uninstall dmg. After running that KAV disappeared and my shut down issue with in. Thank you so much for taking the time blog a solution.

        Many thanks,
        Mark

        September 22, 2012 at 3:32 am #
        • Thanks for the positive comment!

          September 22, 2012 at 9:23 pm #
  2. I can not thank you enough for your information. Not only was my OS hanging up at shutdown, it would not unmount my iPods. Every time I updated my songs on my iPod, I had to force shutdown. Now everything is back to normal.
    Again, thank you much. I was one step away from erasing everything, and clean installing!

    June 11, 2012 at 6:01 am #
    • Glad to hear the article help you out Thomas. I was also on the verge of doing a fresh install!

      June 11, 2012 at 7:28 am #
  3. I installed kapersky with the parallels upgrade. Where can I get the uninstall tool to unistall it the proper way. Thanks!!!

    June 20, 2012 at 11:05 am #
    • Hi Jimmy.

      You can access this uninstall script by running the Kaspersky installation dmg file—just select the option “Kaspersky Anti-Virus 2011 Uninstaller.app” instead of “Kaspersky Anti-Virus 2011.mpkg.”

      If you don’t have the separate Kaspersky installation file because it was bundled with a Parallels installation, try searching your system and the Kaspersky website for “Kaspersky Anti-Virus 2011 Uninstaller.app.”

      Good luck!

      June 21, 2012 at 6:34 pm #
  4. Thank you!

    I have spent many hours with this problem, also many hours on the phone with apple care but with no results. Your uninstall of kaspersky did it! thankyou again.

    Now for the first time in a long time I can enjoy a proper shutdown/restart!

    September 22, 2012 at 8:40 pm #
    • Glad it fixed your issue. Thanks for the comment!

      September 22, 2012 at 9:23 pm #
  5. This has been driving me nuts for about 6 months! Running the Kaspersky uninstaller instantly solved it. Thank you sooooo much!

    October 14, 2012 at 7:45 am #
    • You’re very welcome! Glad the article helped you fix the problem!

      October 14, 2012 at 8:23 am #
  6. Robert:

    Your the “Bee’s Knees”, same shut-down problem, for months, too busy to troubleshoot in-depth,
    was blaming a VMFusion load.

    Ran your “kextstat -kl | awk ‘ !/apple/ { print $6 } ‘ in terminal.
    Saw Kapersky in the results
    Went to Kapersky, downloaded their “kapersky_security_uninstaller.zip”
    ran it, then checked “kextstat -kl | awk ‘ !/apple/ { print $6 } ‘ ” again – line item gone!

    Quit Safari, shut-down machine – no hang this time.

    Reboot, ran “kextstat -kl | awk ‘ !/apple/ { print $6 } ‘
    again, no trace.

    Thanks again!!!

    drdave

    October 15, 2012 at 6:53 pm #
    • Excellent drdave! Thanks for the comment!

      October 16, 2012 at 5:18 am #
  7. It worked for me too :-)
    Thank you so much for your help.

    November 1, 2012 at 9:59 am #
    • Great to hear Gabriel! Thanks for leaving a comment!

      November 2, 2012 at 4:22 pm #
  8. Hey Robert,

    I appreciate your effort on sharing the great hint and alternative solutions as well.

    Kannan December 6, 2012 at 8:36 pm #
  9. Robert,

    I was wondering if you’re using Intego 2013. Since you just installed Intego X6 in November, I’m guessing that you’re still using X6 until that year is up, though.

    I’ve been considering switching to Intego (from Sophos, which causes my laptop to slow to a crawl or even stall every time it updates, which is multiple times a day for as much as 15 minutes at a time). However, most of the early reviews for Intego 2013 (which I guess was a 64-bit overhaul) were horrible & rife with complaints of freezes, and loss of services. The recent reviews are stellar, though. If you’ve had a chance to have Intego 2013 running, I was wondering what your take on it is.

    Thanks!

    April 10, 2013 at 11:03 am #
    • Hi Mike.
      I’ve been using Intego 2013 since it was released, and it’s been working great for me. I haven’t experienced any problems with it.

      April 15, 2013 at 6:21 pm #
  10. I’m using intego 2013 – VirusBarrier 10.7.5 and I recently ran into a similar shutdown/restart issue. I found that it was VirusBarrier’s real-time scanner causing the issue. Contacted Intego support and they provided me a script which apparently corrects a permissions issues. After I ran the script from intego. everything was back to normal. Just adding my two cents..

    July 8, 2013 at 11:07 am #
    • Thanks for sharing your findings Brian!

      July 8, 2013 at 6:23 pm #
  11. I’ve got the same problem, except I’ve never used Kaspersky or Parallels. It’s suddenly happening on 4 different iMacs here – three running 10.6.8 and one running 10.8.4. The only thing I can think of that they all have in common is I recently ran an Apple OS update and Microsoft Office update to all four.

    Happen to have any thoughts on this? All the forums I’ve checked were inconclusive at best.

    July 19, 2013 at 11:04 am #
    • Hi Mike.
      Try killing some of the services that are running before you try to shutdown. Through the process of elimination, you might find a service that’s preventing your systems from shutting down. I’ve also seen Carbon Copy Cloner drives prevent proper shutdowns. If you have CC Cloner drives attached to your systems, try disconnecting them before you shutdown.

      Good luck!

      July 21, 2013 at 3:03 pm #
  12. I encountered this problem for the very first time today, upon my attempt to shutdown OSX 10.6.8 following use of Carbon Copy Cloner v 3.5.2 (latest version). No spinning beach ball. Mouse cursor displays and moves as expected. All icon, doc, clock, everything on top line of
    screen… everything disappeared leaving a gorgeous starry background. The hard disk was
    dead silent. I had left the cloned drive attached and mounted when I initiated Shutdown, and
    within 1-2 seconds this is what happened. After awhile I realized I could press Command+Option+Escape to obtain the “Force Quit Appliations” window. The were no
    applications listed. I could close the window and re-press the keys to obtain the window once
    again. I pressed Command (⌘)-Control-Media Eject key (⏏) to quit all applications and restart.

    September 9, 2013 at 9:51 pm #
    • Thanks for sharing this Howard!

      September 10, 2013 at 5:56 pm #
  13. Thanks for sharing – this solved my problem! :-)

    Kristian Sørensen October 6, 2013 at 4:39 pm #
    • Great! Thanks for the comment Kristian!

      October 6, 2013 at 8:16 pm #
  14. awesome solution!!! I’ve tried quite a few tricks in the past, but none seemed to work, but this did. Thanks mate!!!

    February 10, 2014 at 3:08 pm #
    • Glad the article helped Sunny!
      Thanks for the comment!

      February 10, 2014 at 7:08 pm #

Leave a Reply


*