Windows XP Pro goes into shutdown immediately after boot

[Tex Arcana]

Just like the title says: my Windows XP Pro (SP1), about 3 years old, suddenly decided to just go into a shutdown immediately after it boots to the desktop. Actually, it'll shut down even before logging in, if you just wait, takes about 30-40 seconds for it to shutdown.

It seems to be a forced shutdown, but I can't figure out what's doing it. I've run antivirus, the Sasser scans, MS's malicious program scan, and anything else, and I can't figure out what's causing it. The last changes to it were the installation of a third-party freeware CD burning program (after Sonic Easy CD Creator stoped working), a Notromo gamepad and software, and HalfLife2. I've ripped out all recent changes, to no avail.

Anyone have any ideas? Thanks in advance.

[darkpark]

does it also do it, if you boot into safe mode? i'd also look into the event viewer to see if there are any clues as to what is causing your problem.

[Tex Arcana]

does it also do it, if you boot into safe mode? i'd also look into the event viewer to see if there are any clues as to what is causing your problem.

Dang, and here I thought everyone was gonna ignore me! :(

It boots fine into safe mode. Remind me how to get to event viewer? I was trying to remember that, but was not succeeding. I used msconfig to try to troubleshoot, but didn't get too far. I also looking into services, and found the RPC service set to "shut down on all failures". I changed it to "do nothing", and on reboot the machine never got thru full reboot, and I had to skedaddle, so I ahven't done anything since.

[killa62]

run msconfig and turn off all startup items and all non-microsoft services and see if it stats up fine...
if it does, slowly add like 3 or 4 things at a time till you start rebooting
then you can figure out what is causing the reboots

[SmokeRngs]

Turn off the automatic rebooting. This way you will be able to find out what is causing the error if it's actually crashing.

http://www.hardfolding.com/ftag1.php/mem/207.png (http://www.hardfolding.com?go=38&id=207&tm=33)

[Phoenix86]

I don't think it's BSODing, but if it is, check the event log. Sounds like something is kicking off a shutdown process.

Does it do it in safe mode?
What about normal mode with the network cable disconnected?

[Tex Arcana]

run msconfig and turn off all startup items and all non-microsoft services and see if it stats up fine...
if it does, slowly add like 3 or 4 things at a time till you start rebooting
then you can figure out what is causing the reboots
Did that, nfg... even got to the point of uninstalling software that was recently loaded, even uninstalled the AV and anti-spyware stuff, in case some of it got corrupted/infected.

[Tex Arcana]

Turn off the automatic rebooting. This way you will be able to find out what is causing the error if it's actually crashing.

http://www.hardfolding.com/ftag1.php/mem/207.png (http://www.hardfolding.com?go=38&id=207&tm=33)


Did that already, didn't stop the problem. Hell, I had that disabled right from the get-go. :( It seems like SOMETHING is calling for a shutdown, because I can pull up the Task Manager, and watch it, and right at 30 seconds, you'll see the processes start to go away, and the list shrink to nothing, and right before the list empties, it'll go into shutdown.

[Tex Arcana]

I don't think it's BSODing, but if it is, check the event log. Sounds like something is kicking off a shutdown process.

Does it do it in safe mode?
What about normal mode with the network cable disconnected?

Nope, safe mode will run all day. And does it with network cable disconnected (did that almost immediately).

[Tex Arcana]

I"ve tried disabling RPC in services, but it has no way to disable it, and setting it to "no action" created a really long boot. However, I didn't wait for it to finish booting, since I had to leave my friend's house in short order. I need to try to boot and see if it'll go all the way, and if it'll kill itself again.

Another bit of info: if you don't log in at the login screen (the old-style network login, not the prettified Windows one), it'll shut down in exactly the same amount of time as it does if it goes to a desktop. I haven't bothered to time it, but it's barely enough time to try the "shutdown -i" or "shutdown -a" commands, neither of which work ("-a" comes back with a "unable to execute-shutdown has not been initiatied" message, and the other just doesn't work).

I tried system restore initially, and I get a message every time that it was "unable to restore". It would also toss a message at me at the beginning about the "H:\ drive not available", which is an external USB drive I have--maybe that's what was screwing with restore. Either way, system restore is disabled at this point, because I was afraid that a Sasser was resurrecting itself from that.

Speaking of Sasser et al: virus scans came back clean except for one in an archive, since deleted; Stinger came back clean. Did not have an opportunity to run spyware scans. Beyond that, I updated everything earlier in safe mode. And the problem still remained.

Why am I not running SP2?? Because I lost that last pesky "round-2-it". I have it, just haven't installed it, partially because I haven't had time, partially because I'm scared shitless that it'll break everything.

More info: I run AntiVir, set to scan EVERYTHING, and to look in ALL archives, and to delete anything that even looks suspicious; I also run Spybot: S&D, SpywareGuard, and Spyware Blaster. I NEVER use IE anymore, and surf only on Firefox (not latest, but that's the curse of dialup), and only use Gaim for my chat client. And I have Windows Firewall enabled on that machine.

Thanks for the suggestions, folks, I do appreciate it.

[Tex Arcana]

bump

[Tex Arcana]

bump 2

[Tex Arcana]

Please???

[SJConsultant]

Are there any errors in the event logs?

Have you run chkdsk to rule out HDD corruption?

[Eva_Unit_0]

That really sounds reminiscent of the blaster worm...it did the same type of thing. I see you're still running sp1...why? For some reason people are STILL afraid of sp2...it's been around a long time, it's been accepted, and you're simply asking for trouble by refusing to use it. Upgrade to sp2 and see if the problem goes away. It might be some obscure security/worm issue.

[heelix]

I'll second that - the blaster worm will shut down your box in 60 sec or so - so depending on how long it takes for your box to finish spinning up, it may seem shorter than that.

http://www.microsoft.com/security/incident/blast.mspx

for info on stopping the shutdown and fixing the worm...

[Tex Arcana]

Thanks for the help, folks, I do appreciate it.

The reason SP2 isn't on ther is I just didn't have the time, and with my limited online activities and lack of time, I dind't prioritize it. I will, tho.

[Imaulle]

yea SP2 should fix this

[IanG]

Do you have any temperature monitoring programs installed? (MBM, Speedfan, Motherboard manufacturer program) One of these could be seeing a 'critical' condition and starting a shutdown - I've seen the MSI Corecell program shut down one of my boxes for an abnormal temp reading (core @ 25 degrees) :rolleyes:

Hope you don't have a virus/worm.

[Tex Arcana]

Do you have any temperature monitoring programs installed? (MBM, Speedfan, Motherboard manufacturer program) One of these could be seeing a 'critical' condition and starting a shutdown - I've seen the MSI Corecell program shut down one of my boxes for an abnormal temp reading (core @ 25 degrees) :rolleyes:

Hope you don't have a virus/worm.

No monitoring programs, and I can run Linux on the dual-boot all day long. Fact is, the WIndows side isn't fixed yet, haven't tried to run SP2 yet.

[Zamboni]

Check to make sure the video card isn't walking out of its slot. I had a machine once that would crash every time when the desktop loaded, right when the OS switches from the 8-bit login screen to the 32-bit desktop. Safe mode ran fine, since it's all in 8-bit video. We finally tracked it down when we noticed the last couple of pins on the video card had pulled out, and apparantly these pins were only used when the card operated in full color.

[DarkElite]

check to make sure the video card drivers aren't corrupted. I once had a problem with this and reinstalling the drivers fixed it.

[Slartibartfast]

This does sound a lot like some viruses. Try this: open regedit, and do:

hkey_local_machine -> software -> microsft -> windows -> currentversion -> Run

and look at the keys in there. If anything looks like it's pointing to a suspicious file (esp. something like "a.exe") export the reg. key and delete it. If you break something, just double-click on the icon that was created by the export and windows will put it right back where it was.

[KevinO]

This does sound a lot like some viruses. Try this: open regedit, and do:

hkey_local_machine -> software -> microsft -> windows -> currentversion -> Run

and look at the keys in there. If anything looks like it's pointing to a suspicious file (esp. something like "a.exe") export the reg. key and delete it. If you break something, just double-click on the icon that was created by the export and windows will put it right back where it was.

and hkey_current_user -> software -> microsoft -> windows -> currentversion -> Run.

[eno-on]

I'm having the same problem on a customers machine.
Nothing works. It's also a sp1 machine. I've gone through it with ubcd, removed a couple viruses and some spyware, a password renew file keeps getting pointed to from the registry. It's called rnpasswd.exe
I've deleted the file and the registry entry that points to it, it tends to pop back up. The hd comes up clean when slaved to another machine.
Im installing sp2 in safe mode right now, will let you know if this helps me.

[eno-on]

Installing service pack 2 appears to have fixed this problem. I reccomend installing it to see if it fixes yours.

[Tex Arcana]

Installing service pack 2 appears to have fixed this problem. I reccomend installing it to see if it fixes yours.

NOt even close. Kept saying the "cryptography service" wasn't running, and would bail on the install. Couldn't get ANY service to start or stop--also, the taskbar and start menu and task tray were gone. I ended up pulling the drive, putting in a new one, and installing a fresh copy of XP Pro. I'll scan the drive, once I find a good scanner that doesn't piss me off, and just use it as a data drive. (sigh)

THanks for the help, all.