XP shutting down automatically

[pete]

I am busy with a client's pc. They have installed RegistrySmart and it loads on startup. The problem is that the PC is shutting down as soon as the app loads. I have tried going into safe mode, but you cannot uninstall apps in safe mode, nor can you start the Windows installer service...

Any ideas on how to remove this nicely?

 

[rvanwyk]

when in safe mode, rename the folder where this program resides by adding a 1 or something at the end. start normally. after everything loaded, rename back and uninstall.

hope it works

 

[wizzard]

I seem to remember you can hold ctrl+alt+shift while windows is starting and it stops everything except drivers and services loading on startup. That should help get it removed if it still works

 

[The_Unbeliever]

got a pc coming in which does exactly the same.

suspect (and I hope that it's not) a trojan or some nasty.

 

[|tera|]

I am busy with a client's pc. They have installed RegistrySmart and it loads on startup. The problem is that the PC is shutting down as soon as the app loads. I have tried going into safe mode, but you cannot uninstall apps in safe mode, nor can you start the Windows installer service...

Any ideas on how to remove this nicely?

Click start>run> type in msconfig

Look for the application's service or the app itself and disable it from starting up, once it's disabled, uninstall it from Windows

 

[LazyLion]

I am busy with a client's pc. They have installed RegistrySmart and it loads on startup. The problem is that the PC is shutting down as soon as the app loads. I have tried going into safe mode, but you cannot uninstall apps in safe mode, nor can you start the Windows installer service...

Any ideas on how to remove this nicely?

Why can't you uninstall apps in safe mode? I thought that's what safe mode was partly for? Just try it.

failing that, try to locate where the program's startup command is and disable it from starting up automatically.

 

[HavocXphere]

If all else fails use an XP to get to a cmd prompt and rename the exe. Bit of an overkill, but if you can't get it to work any other way...

 

[McGuywer]

Did you get it right?

 

[bboy]

if the pc is running and is about to shutdown you can abort the shutdown with "shutdown -a", but it all depends on the timing here

 

[medicnick83]

Try this:

Under clocking the CPU

Instead of running it at it's max speed, say 133, try running it at 100.
Maybe, just maybe it's a hardware problem.

 

[Mal1ce]

To enable the Windows Installer service in Safe Mode, open a command prompt from within Safe Mode and type the following:

REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MSIServer" /VE /T REG_SZ /F /D "Service"

You will get the result "The operation completed successfully".

To enable Windows Installer from Computer Management:

1.) Start >> Run >> compmgmt.msc (OR right click on "My Computer" and choose "Manage")

2.) Expand "Services and Applications". Go to "Services". Locate and right click on "Windows Installer" in the Name Field.

3.) Choose "Start"

EDIT: Minimal should be one word, copy past into forums splits it for some reason ?

 

[pete]

Thanks for all the input.

I got rid of all the weird apps the guy has installed. this now allows me into windows and I can do most things. but the pc still restarts by itself. I have found one of the triggers is win > run > cmd. that shuts it down immediately.

so i thought, lets do a repair install, and did so. abolutely nothing has changed.

I have set windows to not restart on failure, yet it still happens.

please tell me that the only remaining avenue is not a complete reinstall..?

McAfee isnt picking up anything either btw...

 

[ernstn]

There is not perhaps a cmd.bat or is it cmd.sys? file somewhere?

 

[TiredOfWaiting]

Did the client recently install SP3?

I've read about a lot of people who experience that exact same behaviour after installing it.

 

[pete]

No sp3.

McAfee just popped up.

W32/Rontokbro.gen@MM...

Ugh...

And its heavily infected.

 

[pete]

151 detections, all deleted or cleaned. hopefully that solves it.