Not shutting down, blue screen hangs indefinitely

If you can't reproduce the problem readily and can't identify it in your logs, then it will be hard to track down. In safe mode, third-party system addons are disabled, so if the problem is not reproducible in safe mode, it's caused by one of those.

It's also possible that a subtle hardware fault is causing it.

Standard troubleshooting step: Create a new admin user and test there.

So you're suggesting there's no other way than taking a wild guess?

No, I'm not suggesting that at all.

How come the console doesn't turn up anything useful to pinpoint the problem?

You mean the logs. I haven't seen anywhere near enough of your logs to know whether they contain anything useful or not. Have you combed through all the archived system logs, the kernel logs, and the diagnostic reports?

Have you taken a complete inventory of system addons such as kernel extensions? If so, what are they?

There are limits to how much can be done by remote question-and-answer. If you don't have the patience or the time for troubleshooting, then you can always do what Apple tech support would tell you to do: back up your data, erase your startup volume, reinstall the OS from original media, restore your data, and test. Then reinstall your third-party software one item at a time, testing as you go.

I'm not certain this is still the case in Snow, but you could try starting up in Verbose Mode, CMD-V, and see if it will shut down in Verbose Mode. It used to behave that way in Tiger, at least. Like that, you might be able to catch an error message just where it's hanging.

Of course, you may get the blue screen even before it can get into Verbose Mode to shutdown.

You might try rebuilding the dyld shared cache. It's harmless.

Open Terminal and copy/paste this command. Hit Enter/Return and give your password when prompted. You won't see it on the screen as you type it in.

sudo update_dyld_shared_cache -force

Wait until the $ sign prompt returns, which will indicate it has finished and then type in "exit" and close the window.

Mac OS X v10.5.6 or later: A Safe Boot deletes the dynamic loader shared cache at (/var/db/dyld/). A cache with issues may cause a blue screen on startup, particularly after a Software Update. Restarting normally recreates this cache.

I know this isn't your issue exactly -- shutdown, not startup -- but it might be related and it can't hurt to throw this at it.

Message was edited by: WZZZ

Please launch the Terminal application and copy or drag -- don't type -- the following text into the window:

kextstat -kl | awk ' !/apple/ { print $6 } '

Press return. If any non-blank lines appear below what you entered, post them. You can then quit Terminal.

Uninstall the Kaspersky product completely. It has no real use and can cause instability, whether or not it's causing the problem you have now. I can't tell you how to uninstall it. Contact the vendor for assistance.

You have to boot first in Verbose Mode in order to shut down in Verbose Mode (if if still works this way in SL; it may not. You'll know right away with a normal, non-blue screen shutdown.) In other words, you will have to boot now always in VM; you can't wait until a blue screen shutdown. It's no big deal: just a few moments of text, which may offer up a clue. Be ready to write things down or take a picture with a camera.

Well we stumbled through that one kind of scattershot. Glad to hear you got it solved.

@Linc: what was the goal of that kextstat command? What was it supposed to reveal or isolate?

It lists the bundle ID's of loaded third-party kernel extensions, a common cause of all kinds of problems.

Thanks, very useful command.

If any non-blank lines appear below what you entered, post them.

But what's that about, "non-blank lines?" Also, when I run the command, I see a couple of third party items, but not printed out as above with any extension, as in "com.kaspersky.kext.klif" (And what's the .klif extension? I've never seen that one. Could that be proprietary for kaspersky?)

I just get:

at.obdev.nke.LittleSnitch

com.bresink.driver.BRESINKx86Monitoring

Those are the bundles?