windows won't shut down

[Bobb]

read many posts on this subject and tried all the suggestions, no luck.
Behavior: windows would not boot, gave the message
"c:\windows\system32\config\system is missing or corrupt. Found a kb 307545
that at least got me booted up but (copies the registry from a previous
restore point, Apr 20) but now windows will not react at all to a request to
shutdown or restart via task mgr or via the Start button. I tried shutting
down all running programs, no results. I even stopped explorer.exe, no diff.
So I did a power off but now on bootup, I get a windows XP screen with a main
blue area that is otherwise empty (only says Windows XP on a blue background;
no not the bsod) All safe mode bootup options result in this same screen. So
I run winternals ERD 2005, do the copy of the 5 registry files from the same
date as before, Apr 20, and it will boot but not shutdown. Trying any other
RP registry files does not fix or change the bootup problem. I have run
several spy, malware, virus, rootkit checkers, all negative. Ran chkdsk
twice, no probs. No event log entries show a problem. I suspect one of the 5
reg files has a problem.

 

[PA Bear [MS MVP]]

Without knowing the 5 registry files or the physical state of the HDD, one
could be tempted to cite...

Unexplained computer behavior may be caused by deceptive software
http://support.microsoft.com/kb/827315

 

[Bobb]

Thanks for the URL, as I mentioned, I've run spybot, ad-ware, AVG, Hauri and
the MS tools to clean the USER registry hive, the malicious software tool and
2 rootkits detectors, nothing detected. Chkdsk successfully completed with no
errros. Since copying the Apr 20th registry files DEFAULT, SYSTEM, SOFTWARE,
DAM, USER int system32/config is the only RP that allows a boot but result in
a non responsive system, I'm wondering about any methods to check those files
for a bit that doesn't allow response to a shutdown command.

 

[PA Bear [MS MVP]]

Run a /thorough/ check for hijackware, including posting your hijackthis log
to an appropriate forum.

Checking for/Help with Hijackware
http://aumha.org/a/parasite.htm
http://aumha.org/a/quickfix.htm
http://aumha.net/viewtopic.php?t=5878
http://wiki.castlecops.com/Malware_Removal_and_Prevention:_Introduction
http://mvps.org/winhelp2002/unwanted.htm
http://inetexplorer.mvps.org/data/prevention.htm
http://inetexplorer.mvps.org/tshoot.html
http://www.mvps.org/sramesh2k/Malware_Defence.htm
http://defendingyourmachine2.blogspot.com/
http://www.elephantboycomputers.com/page2.html#Removing_Malware

When all else fails, HijackThis v2.0.2
(http://aumha.org/downloads/hijackthis.exe) is the preferred tool to use.
It will help you to both identify and remove any hijackware/spyware with
assistance from an expert. **Post your log to
http://forums.spybot.info/forumdisplay.php?f=22,
http://castlecops.com/forum67.html,
http://forums.subratam.org/index.php?showforum=7,
http://aumha.net/viewforum.php?f=30, or other appropriate forums for review
by an expert in such matters, not here.**

If the procedures look too complex - and there is no shame in admitting this
isn't your cup of tea - take the machine to a local, reputable and
independent (i.e., not BigBoxStoreUSA) computer repair shop.