Member Avatar for cyclone3211

When starting WinXP, both desktop icons and quick launch icons appear. The hour glass appears and after a short time without starting an icon in the taskbar tray, the saving settings message appears and the computer turns off.

When going to F8, safe mode, and running msconfig, checking the startup items, make no changes and leave with allowing the system to re-boot, it often will complete the startup. This final step is known when icons begin to appear in the taskbar tray.

When the F8 process does not work, all is fine after re-booting several times. The number of times necessary to complete the process is a variable.

If a driver is corrupt somewhere, why would this occurrence be self correcting sometimes?

Most importantly, any suggestions on how to eliminate this from happening at boot time???

  • 2 Contributors
  • 4 Replies
  • 130 Views
  • 3 Days Discussion Span
  • Latest Post Latest Post by cyclone3211

Dani AI

Generated

As described, this looks like something is ordering a shutdown during the logon sequence before the tray icons finish loading. was right to point at policy or malware as possible causes, but gpedit showing nothing does not rule out a script, scheduled task, Run-key entry, or a corrupted shell/userinit entry. The checklist below helps narrow the cause and gives safe next steps.

First, inspect the logs. Open Event Viewer and look in the System log for shutdown-related entries at the time the machine goes down. Key events to note are Event ID 1074 (a process requested shutdown) and Event ID 6008 (unexpected shutdown). The event text usually names the process that requested the shutdown and gives a strong clue about whether this is intentional or a crash.

Next, look for things that run at logon. Check Task Scheduler for tasks with triggers "At logon" or "At startup." Examine the filesystem folders C:\Windows\System32\GroupPolicy\User\Scripts\Logon and C:\Windows\System32\GroupPolicy\Machine\Scripts\Startup for stray scripts. Inspect the Run keys HKLM\Software\Microsoft\Windows\CurrentVersion\Run and HKCU\Software\Microsoft\Windows\CurrentVersion\Run for suspicious entries. Also verify the Winlogon values at HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon — Userinit should reference userinit.exe, and Shell should be explorer.exe. Back up the registry before changing anything.

Ruling out malware and per-user problems: boot Safe Mode and run a current anti-malware scan (Malwarebytes, MSRT, a rootkit scanner like TDSSKiller). Create a new local user and log in; if the shutdown does not occur under a fresh account, the problem is per-user (logon scripts, Run keys, startup folder). If the new account also triggers the shutdown, focus on machine-wide items (scheduled tasks, services, drivers).

If an Event Viewer entry names the offending executable or script, remove or disable that entry. When unsure, enable more detailed tracing (verbose status messages or a process-level trace) and capture a log before making changes. Always create a restore point or full backup before editing system or registry settings.

Member Avatar for Member #210412

check user policies.. probably, a trojan is attached your user setting to shutdown your computer..

Member Avatar for cyclone3211

Thank you for the tip, but what are the steps to do this??

Member Avatar for Member #210412

start - run - mmc

add-remove snapp in select... group policy..

then u will find everything there

Member Avatar for cyclone3211

Thank you for the response but again, I can not seem to follow your directions.

Did the start—run—mmc…………………Saw the Console Root…did a double click…and saw the following: “there were no items to show”…………..nothing was there.

Ran start—run--gpedit.msc……………….Looked at the Group Policy for both the computer and user configuration and found that nothing was configured..same as above.

Sorry, but I did not understand how to use the “add-remove snapp in select... group policy..information that you provided.

Could you please explain what I am to do???

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.