Want to win a PS4? Go Premium and enter to win our High-Tech Treats giveaway. Enter to Win

x
?
Solved

Win 7 Freezes When Shutting Down For Restart

Posted on 2010-11-30
13
Medium Priority
?
594 Views
Last Modified: 2012-05-10
A month ago I replaced an XP machine with a new one with Win 7 64bit.  As with my other Win 7 PC, I'm having a lot of annoying trouble.  See most of my last 10 questions under garcpr in the EE Knowledge Base.

I've run various virus/malware scans and just ran two again and only find tracking cookies.

A few days ago I applied the MS ft Hotfix for freezeups.  Was OK for perhaps overnight.  Then got some freezes when trying to shut down or in shutdown portion of restart.

The Secunia scan for outdated applications flagged Adobe Reader and I updated it through Secunia.  A few minutes later a purported Adobe message about another Reader update appeared.  I went along with it.  After a while almost nothing worked.  I wonder if it was malware coming in through the access opened for Adobe a few minutes before.

I used a restore point from just before the second Adobe thing (I think) and that got things working a lot better.

Now when I power up or restart I get the attached screen (see end of this) right after logging on.  How do I figure out where this is coming from?

And, when I shut down or restart Win 7 freezes and never completes the process.  I have to use the power button to finish shutting down.  How do I find out what is causing this?



 StartErrorScreen.doc
0
Comment
Question by:garcpr
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 6
  • 5
  • 2
13 Comments
 
LVL 29

Expert Comment

by:chilternPC
ID: 34242380
you have a program (called P)  in the startup group or in msconfig startup area running.
run the msconfig program in the command line and see what programs are in the startup
press  start - run - msconfig
0
 

Author Comment

by:garcpr
ID: 34242966
Must be.  I can't locate it using msconfig or in the startup folders.

Searching for p.exe didn't help.  How can I locate it or confirm that it exists on my PC?
0
 
LVL 29

Expert Comment

by:chilternPC
ID: 34243972
run "regedit"  in the run commnd and look under the key
HKEY_LOCAL_MACHINE--SOFTWARE--microsoft--windows--current version---Run

then delete anything your don't want to run at start up
0
What does it mean to be "Always On"?

Is your cloud always on? With an Always On cloud you won't have to worry about downtime for maintenance or software application code updates, ensuring that your bottom line isn't affected.

 
LVL 29

Expert Comment

by:chilternPC
ID: 34243989
another approach..
when the box comes up withthe question bring up the task manager (ctrl-alt-del) and choose task manager
see what applications are running - right click on the one conerned and choose "go to process"
this might  show you what exe is runnng.
0
 

Author Comment

by:garcpr
ID: 34244213
The process for "Open With" is rundll32.exe described as "Windows Host Process"

It's running under my user name.

I checked the C:\Windows  directory and there are 8 instances of it, half with a final suffix of mui.
0
 
LVL 4

Expert Comment

by:realParker
ID: 34244255
If you try and run or open "P" it will probably error out. Then  just need to go to control panel, system security, view event logs. It should note the error and specify where the file is. Also check for error messages logged during shutdown. A program or process isn't shutting down properly and the event log may help.
0
 

Author Comment

by:garcpr
ID: 34244484
I believe you mean the Event Viewer Logs under Computer Management?  

I "tried to open" P with Adobe Reader.  There were no error events logged at any time near when I did that, even though Reader issued a message.  I looked under all likely categories such as Applications, and also under the special Administrative summary of errors, critical events, etc.

Were you referring to some other logs?  There is no System Security item on the Win 7 Control Panel menu or on the CPnl System screen.

I'll work with the logs some more.
0
 

Author Comment

by:garcpr
ID: 34253106
I just finally located the file named P.  It was in the User's directory along with Default, me, and Public.  I imagine this is an illegal or at least very bad location for a file to be.  Here's a copy of it. P  I made a copy of it and deleted it from the Users directory.

It no longer appears as needing to be opened when I restart.

Here's a copy of it as text. P.txt

I think it might be hard to tell where it came from by just looking at the text, but if either of you can do so, great. Please let me know.   If not, I'll close this question and award points.

I haven't had too much trouble with a freeze on shut down in the last 24 hours.  If that starts again, I'll study the event logs.
0
 
LVL 29

Accepted Solution

by:
chilternPC earned 1200 total points
ID: 34253163
make a restore point in case it comes back
. I still like to use malwarebyte (the free version) to check
http://www.malwarebytes.org/
try right clicking on the file and selecting Properties then click on the "details" tab
even malware writers can't help to sign programs :-)
0
 
LVL 29

Expert Comment

by:chilternPC
ID: 34253176
it looks like a nVidia nforce ethernet lookback interface
0
 
LVL 4

Assisted Solution

by:realParker
realParker earned 800 total points
ID: 34253574
That is odd. There are a few forum discussions about having an interface list auto-open when starting up. You can open the command prompt and run this to see the same output route print

I see a few that mention gtalk causing this but all I came across state that once the file was deleted the problem went away.
0
 

Author Comment

by:garcpr
ID: 34257662
I don't see any source info in the properties details for the file.

As soon as I get a chance, I'll do the further checks suggested.
0
 

Author Comment

by:garcpr
ID: 34260040
I don't see any way to check an individual file with the free version of Matwarebytes.  I sent P to Total Virus which uses ~ 24 virus check progrms to check stuff.  It didn't find anything.

route print does give as it's first 5 lines of output the same text as in P.

I have never used or even opened gtalk.  I do use gmail and calendar but doubt I ever got near gtalk.

If the problem occurs again, I'll have to look more but let's close this question.

Thanks very much for your help.
0

Featured Post

VIDEO: THE CONCERTO CLOUD FOR HEALTHCARE

Modern healthcare requires a modern cloud. View this brief video to understand how the Concerto Cloud for Healthcare can help your organization.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Possible fixes for Windows 7 and Windows Server 2008 updating problem. Solutions mentioned are from Microsoft themselves. I started a case with them from our Microsoft Silver Partner option to open a case and get direct support from Microsoft. If s…
IF you are either unfamiliar with rootkits, or want to know more about them, read on ....
In this video, we discuss why the need for additional vertical screen space has become more important in recent years, namely, due to the transition in the marketplace of 4x3 computer screens to 16x9 and 16x10 screens (so-called widescreen format). …
This Micro Tutorial will give you a introduction in two parts how to utilize Windows Live Movie Maker to its maximum capability. This will be demonstrated using Windows Live Movie Maker on Windows 7 operating system.

610 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question