Win 7 Freezes When Shutting Down For Restart

Posted on 2010-11-30
Last Modified: 2012-05-10
A month ago I replaced an XP machine with a new one with Win 7 64bit.  As with my other Win 7 PC, I'm having a lot of annoying trouble.  See most of my last 10 questions under garcpr in the EE Knowledge Base.

I've run various virus/malware scans and just ran two again and only find tracking cookies.

A few days ago I applied the MS ft Hotfix for freezeups.  Was OK for perhaps overnight.  Then got some freezes when trying to shut down or in shutdown portion of restart.

The Secunia scan for outdated applications flagged Adobe Reader and I updated it through Secunia.  A few minutes later a purported Adobe message about another Reader update appeared.  I went along with it.  After a while almost nothing worked.  I wonder if it was malware coming in through the access opened for Adobe a few minutes before.

I used a restore point from just before the second Adobe thing (I think) and that got things working a lot better.

Now when I power up or restart I get the attached screen (see end of this) right after logging on.  How do I figure out where this is coming from?

And, when I shut down or restart Win 7 freezes and never completes the process.  I have to use the power button to finish shutting down.  How do I find out what is causing this?

Question by:garcpr
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 6
  • 5
  • 2
LVL 29

Expert Comment

ID: 34242380
you have a program (called P)  in the startup group or in msconfig startup area running.
run the msconfig program in the command line and see what programs are in the startup
press  start - run - msconfig

Author Comment

ID: 34242966
Must be.  I can't locate it using msconfig or in the startup folders.

Searching for p.exe didn't help.  How can I locate it or confirm that it exists on my PC?
LVL 29

Expert Comment

ID: 34243972
run "regedit"  in the run commnd and look under the key
HKEY_LOCAL_MACHINE--SOFTWARE--microsoft--windows--current version---Run

then delete anything your don't want to run at start up
Industry Leaders: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

LVL 29

Expert Comment

ID: 34243989
another approach..
when the box comes up withthe question bring up the task manager (ctrl-alt-del) and choose task manager
see what applications are running - right click on the one conerned and choose "go to process"
this might  show you what exe is runnng.

Author Comment

ID: 34244213
The process for "Open With" is rundll32.exe described as "Windows Host Process"

It's running under my user name.

I checked the C:\Windows  directory and there are 8 instances of it, half with a final suffix of mui.

Expert Comment

ID: 34244255
If you try and run or open "P" it will probably error out. Then  just need to go to control panel, system security, view event logs. It should note the error and specify where the file is. Also check for error messages logged during shutdown. A program or process isn't shutting down properly and the event log may help.

Author Comment

ID: 34244484
I believe you mean the Event Viewer Logs under Computer Management?  

I "tried to open" P with Adobe Reader.  There were no error events logged at any time near when I did that, even though Reader issued a message.  I looked under all likely categories such as Applications, and also under the special Administrative summary of errors, critical events, etc.

Were you referring to some other logs?  There is no System Security item on the Win 7 Control Panel menu or on the CPnl System screen.

I'll work with the logs some more.

Author Comment

ID: 34253106
I just finally located the file named P.  It was in the User's directory along with Default, me, and Public.  I imagine this is an illegal or at least very bad location for a file to be.  Here's a copy of it. P  I made a copy of it and deleted it from the Users directory.

It no longer appears as needing to be opened when I restart.

Here's a copy of it as text. P.txt

I think it might be hard to tell where it came from by just looking at the text, but if either of you can do so, great. Please let me know.   If not, I'll close this question and award points.

I haven't had too much trouble with a freeze on shut down in the last 24 hours.  If that starts again, I'll study the event logs.
LVL 29

Accepted Solution

chilternPC earned 300 total points
ID: 34253163
make a restore point in case it comes back
. I still like to use malwarebyte (the free version) to check
try right clicking on the file and selecting Properties then click on the "details" tab
even malware writers can't help to sign programs :-)
LVL 29

Expert Comment

ID: 34253176
it looks like a nVidia nforce ethernet lookback interface

Assisted Solution

realParker earned 200 total points
ID: 34253574
That is odd. There are a few forum discussions about having an interface list auto-open when starting up. You can open the command prompt and run this to see the same output route print

I see a few that mention gtalk causing this but all I came across state that once the file was deleted the problem went away.

Author Comment

ID: 34257662
I don't see any source info in the properties details for the file.

As soon as I get a chance, I'll do the further checks suggested.

Author Comment

ID: 34260040
I don't see any way to check an individual file with the free version of Matwarebytes.  I sent P to Total Virus which uses ~ 24 virus check progrms to check stuff.  It didn't find anything.

route print does give as it's first 5 lines of output the same text as in P.

I have never used or even opened gtalk.  I do use gmail and calendar but doubt I ever got near gtalk.

If the problem occurs again, I'll have to look more but let's close this question.

Thanks very much for your help.

Featured Post

On Demand Webinar - Networking for the Cloud Era

This webinar discusses:
-Common barriers companies experience when moving to the cloud
-How SD-WAN changes the way we look at networks
-Best practices customers should employ moving forward with cloud migration
-What happens behind the scenes of SteelConnect’s one-click button

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

First some basics on Windows 7 Backup.  It has 2 components one is a file based backup which is stored in .zip files each zip is split at around 200 Megabytes and there is the Image Backup which is as the name implies a total image of the partition …
Ever notice how you can't use a new drive in Windows without having Windows assigning a Disk Signature?  Ever have a signature collision problem (especially with Virtual Machines?)  This article is intended to help you understand what's going on and…
Windows 8 comes with a dramatically different user interface known as Metro. Notably missing from the new interface is a Start button and Start Menu. Many users do not like it, much preferring the interface of earlier versions — Windows 7, Windows X…
In this video, we discuss why the need for additional vertical screen space has become more important in recent years, namely, due to the transition in the marketplace of 4x3 computer screens to 16x9 and 16x10 screens (so-called widescreen format). …

730 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question