I originally launched my topic in the Malware forum about three weeks ago. I've been working with heir there and it was suggested that I post my issue here.

Here's a link to my original topic
http://www.geekstogo.com/forum/XP-Logoff-L....html&st=15

About three weeks ago;
I had my PC supported with a surge protector with battery back up. I can only assume the battery back up was bad because it kept tripping after each reset. I removed the battery back up and replaced it with surge protection only. When I attempted to login the first time, I found the PC automatically shutting down upon Login in normal mode. I don't recall how may days prior to that incident I used the PC, but this issue has existed since the battery back up went down. My kids and nephews also use the PC sporadically, but I don't recall seeing any issues prior to the battery back up going down. I thought the issue could be related to services in power management and I could never get to those in regular mode, so I used Safe Mode with my user account to check the UPS tab.

After a few days of tinkering with running a full scan with symantec antivirus in safe mode and using disk defrag to make the machine "clean". I found geekstogo.com and ran the Malware Cleaning process. My first run of Malwarebyte's Anti-malware tool found an infected Registry Key, but that's where my posts on the Malware site started.

Assistance resolving this issue would be sincerely appreciated. It's been difficult not having a PC at home. Thanks.

Hello,
Lets look at the difference between safe mode, and normal start up.
In normal start up anything that is in the start menu is loaded.
In safe mode only the basics needed to start the machine (and run Windows) is loaded.
What this means is that in safe mode the programs that normaly run at start up do not run, and the drivers for your hardware do not load. (generic drivers are used for your video.)
Now the questions come in.

• What changes have been made?
  • Have you added software?
  • Have you added hardware?
  • have you updated any device drivers?
• Have you tried uninstalling Norton? (Norton has been known to cause issues)
• Do you have an invidia video card? (their drivers have been known to cause issues)

Have you tried to do a system restore from safe mode?

Prior to the issue with normal mode, I am not aware of adding any new software, hardware (other than my battery back up failing and I did not replace it) or device drivers.
Since the issue started.

I have not uninstalled Norton. I will do that later tonight.

I do not believe that I have an invidia video card. I will try to confirm.

I have not tried a system restore from safe mode. To be honest, I do not know how to do a system restore. Is that just booting up with the operating CD installed and taking some steps from there? Will that cause me to lose any installed software? Just wondering what that entails and the impacts of doing the system restore.

I do know that I've installed quite a bit of software from the Malware removal steps, but that was after my issues with Normal Mode began.

Additionally, one experience I've had since beginning this process with the Malware forum was;
I created a new administrative user account in Safe Mode (no networking).
Rebooted the PC.
Allowed Windows to load in Normal Mode and logged into my new admin user account.
I was able to log in using Normal Mode. The first time my PC actually didn't automatically shut down from Normal Mode since this all began.
I connected to the Internet.
Windows Defender ran a scan.
Norton Antivirus picked up updates and ran a full scan.
Then Microsoft Update ran to pick up updates and installed the updates.
I received a message that restart was required was required to complete the installs.
I was not able to restart or shutdown the PC.
I left the PC unattended for 3 or 4 hours.
When I returned, there was a pop up message that reboot was required to complete the installs.
I still was not able to restart or shut down the pc.
I left it overnight and found the PC shut down by morning.
I rebooted, but the PC froze before the Windows Login screens ever loaded.
Left for a few hours, then returned and shut down the PC using the power button.
Turned the power back on and the PC loaded Windows properly.
I logged in using Normal Mode with my recently created user admin account.
The PC shut down while loading the desk top.
I've made a couple of attempts to recreate, but my PC shuts down from Normal Mode, even for a newly created user admin account.

Thanks for working to assist me.

A system restore is not the same as a system recovery.
A system recovery whipes out your data and programs, setting the machine to the original factury condition. This requires a disc or accessing a partition of your hard drive that is used for this purpose only.
System restore is a utility inside of Windows that takes a snapshot of your hard drive at various times (called restore points) and restores your hard drive exactly like it was at the time the restore point was made.

• Click on the start button.
• Select accessorys.
• Select system tools.
• Select system restore.
• Follow the instructions from the on screen prompts.

However, it sounds like Windows installed service pack 3, which Norton has problems with.
From safe mode try to uninstal; service pack 3, OR Norton.
This may be an issue with the nvidia driver, the only way to tell is trial and error so lets start with Norton.
You can always reinstall anything that was uninstalled but did not fix the issue.

Since the computer was infected, System Restore shouldn't be used in this case.
I'm pretty sure, that one of the steps taken, during curing your computer from an infection, was to flush Restore Points, so, most likely there are none.
But, if for some reason, old Restore Points still exist, they shouldn't be touched, or, most likely, an infection will return.

An infected restore point is better than no restore point.
Once the machine is working properly the malware can be properly removed.
A computer that does not work can not have malware removed.
So doing a restore is a starting point to getting the machine fixed.
Or in other words, big deal if the infection returns, it can be cleaned again!

This post has been edited by hfcg: Nov 14 2008, 10:33 PM

I got convinced

I decided to purchase a new battery back up. Once installed, everything appears to work fine. I guess there was a service running or something that was causing the PC to shut down.

Thanks for your assistance.

Good news