This is generally due to a Virus string that is created in the RUN registry Key that has a ‘Value data’ pointing to shutdown the PC.
Generally the shutdown timer is set is zero in these types of viruses, so that there is less chance for the user to abort the shutdown process. In case if the shutdown timer is not set or set to few seconds, you can quickly abort the shutdown process as given below:
1. Go to Start –> Run… and type Shutdown -a and press OK
2. This aborts the shutdown command initiated earlier. Now, you can easily access the registry editor and remove the Virus string.
But when the timer is set to zero, you can’t abort the shutdown process initiated as the system shutdowns as soon as it has started. So, to make that virus string doesn’t run during startup, you have to Start the system in Safe Mode as shown below:
1. Start your system and Press F8 Key which will take you to the windows Startup Menu
2. From the list of choices, highlight the appropriate “Safe Mode” using Up or Down arrow keys and then press ENTER
3. If you have a dual-boot or multiple-boot system, choose the installation that you need to access using the arrow keys, and then press ENTER.
4. As you have started the system in Safe Mode, you have access to only basic files and drivers (mouse, monitor, keyboard, mass storage, base video, default system services, and no network connections) which eliminates the possibility of loading the Virus String and helps to eliminate the Virus string easily.
Here is the How you can eliminate that Virus string from the registry :
(same is the process if you have successfully aborted the shutdown process in normal startup mode)
1. Click Start, and then click Run and type regedit (or) regedt32.exe and press OK.
This will take you to the registry Editor.
2. From the left-pane of the Registry Editor, locate the Registry key “Run” following the path
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
3. Now in the right-pane you can find a String Value named Virus (or similar) with the Value data %windir%\system32\shutdown.exe -s -f -t 0000 which is initiating the shutdown process during startup.
All you have to do is the right click with your mouse on that String Value and select delete (Choose Yes when asked to confirm value delete)
4. Close the registry editor window and restart you PC.
That’s it!! You have successfully deleted the Virus string that shutdowns your PC every time Windows starts.
Hope this helps.