Solved

Win 7 Freezes When Shutting Down For Restart

Posted on 2010-11-30
13
584 Views
Last Modified: 2012-05-10
A month ago I replaced an XP machine with a new one with Win 7 64bit.  As with my other Win 7 PC, I'm having a lot of annoying trouble.  See most of my last 10 questions under garcpr in the EE Knowledge Base.

I've run various virus/malware scans and just ran two again and only find tracking cookies.

A few days ago I applied the MS ft Hotfix for freezeups.  Was OK for perhaps overnight.  Then got some freezes when trying to shut down or in shutdown portion of restart.

The Secunia scan for outdated applications flagged Adobe Reader and I updated it through Secunia.  A few minutes later a purported Adobe message about another Reader update appeared.  I went along with it.  After a while almost nothing worked.  I wonder if it was malware coming in through the access opened for Adobe a few minutes before.

I used a restore point from just before the second Adobe thing (I think) and that got things working a lot better.

Now when I power up or restart I get the attached screen (see end of this) right after logging on.  How do I figure out where this is coming from?

And, when I shut down or restart Win 7 freezes and never completes the process.  I have to use the power button to finish shutting down.  How do I find out what is causing this?



 StartErrorScreen.doc
0
Comment
Question by:garcpr
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 6
  • 5
  • 2
13 Comments
 
LVL 29

Expert Comment

by:chilternPC
ID: 34242380
you have a program (called P)  in the startup group or in msconfig startup area running.
run the msconfig program in the command line and see what programs are in the startup
press  start - run - msconfig
0
 

Author Comment

by:garcpr
ID: 34242966
Must be.  I can't locate it using msconfig or in the startup folders.

Searching for p.exe didn't help.  How can I locate it or confirm that it exists on my PC?
0
 
LVL 29

Expert Comment

by:chilternPC
ID: 34243972
run "regedit"  in the run commnd and look under the key
HKEY_LOCAL_MACHINE--SOFTWARE--microsoft--windows--current version---Run

then delete anything your don't want to run at start up
0
Independent Software Vendors: We Want Your Opinion

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

 
LVL 29

Expert Comment

by:chilternPC
ID: 34243989
another approach..
when the box comes up withthe question bring up the task manager (ctrl-alt-del) and choose task manager
see what applications are running - right click on the one conerned and choose "go to process"
this might  show you what exe is runnng.
0
 

Author Comment

by:garcpr
ID: 34244213
The process for "Open With" is rundll32.exe described as "Windows Host Process"

It's running under my user name.

I checked the C:\Windows  directory and there are 8 instances of it, half with a final suffix of mui.
0
 
LVL 4

Expert Comment

by:realParker
ID: 34244255
If you try and run or open "P" it will probably error out. Then  just need to go to control panel, system security, view event logs. It should note the error and specify where the file is. Also check for error messages logged during shutdown. A program or process isn't shutting down properly and the event log may help.
0
 

Author Comment

by:garcpr
ID: 34244484
I believe you mean the Event Viewer Logs under Computer Management?  

I "tried to open" P with Adobe Reader.  There were no error events logged at any time near when I did that, even though Reader issued a message.  I looked under all likely categories such as Applications, and also under the special Administrative summary of errors, critical events, etc.

Were you referring to some other logs?  There is no System Security item on the Win 7 Control Panel menu or on the CPnl System screen.

I'll work with the logs some more.
0
 

Author Comment

by:garcpr
ID: 34253106
I just finally located the file named P.  It was in the User's directory along with Default, me, and Public.  I imagine this is an illegal or at least very bad location for a file to be.  Here's a copy of it. P  I made a copy of it and deleted it from the Users directory.

It no longer appears as needing to be opened when I restart.

Here's a copy of it as text. P.txt

I think it might be hard to tell where it came from by just looking at the text, but if either of you can do so, great. Please let me know.   If not, I'll close this question and award points.

I haven't had too much trouble with a freeze on shut down in the last 24 hours.  If that starts again, I'll study the event logs.
0
 
LVL 29

Accepted Solution

by:
chilternPC earned 300 total points
ID: 34253163
make a restore point in case it comes back
. I still like to use malwarebyte (the free version) to check
http://www.malwarebytes.org/
try right clicking on the file and selecting Properties then click on the "details" tab
even malware writers can't help to sign programs :-)
0
 
LVL 29

Expert Comment

by:chilternPC
ID: 34253176
it looks like a nVidia nforce ethernet lookback interface
0
 
LVL 4

Assisted Solution

by:realParker
realParker earned 200 total points
ID: 34253574
That is odd. There are a few forum discussions about having an interface list auto-open when starting up. You can open the command prompt and run this to see the same output route print

I see a few that mention gtalk causing this but all I came across state that once the file was deleted the problem went away.
0
 

Author Comment

by:garcpr
ID: 34257662
I don't see any source info in the properties details for the file.

As soon as I get a chance, I'll do the further checks suggested.
0
 

Author Comment

by:garcpr
ID: 34260040
I don't see any way to check an individual file with the free version of Matwarebytes.  I sent P to Total Virus which uses ~ 24 virus check progrms to check stuff.  It didn't find anything.

route print does give as it's first 5 lines of output the same text as in P.

I have never used or even opened gtalk.  I do use gmail and calendar but doubt I ever got near gtalk.

If the problem occurs again, I'll have to look more but let's close this question.

Thanks very much for your help.
0

Featured Post

Free Tool: Path Explorer

An intuitive utility to help find the CSS path to UI elements on a webpage. These paths are used frequently in a variety of front-end development and QA automation tasks.

One of a set of tools we're offering as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

When you try to extract and to view the contents of a Microsoft Update Standalone Package (MSU) for Windows Vista, you cannot extract the files from the MSU. Here we are going to explain how to extract those hotfix details without using any third pa…
The Windows functions GetTickCount and timeGetTime retrieve the number of milliseconds since the system was started. However, the value is stored in a DWORD, which means that it wraps around to zero every 49.7 days. This article shows how to solve t…
This Micro Tutorial will teach you the basics of configuring your computer to improve its speed. It will also teach you how to disable programs that are running in the background simultaneously. This will be demonstrated using Windows 7 operating…
With the advent of Windows 10, Microsoft is pushing a Get Windows 10 icon into the notification area (system tray) of qualifying computers. There are many reasons for wanting to remove this icon. This two-part Experts Exchange video Micro Tutorial s…

688 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question