Windows 11 PC shuts down automatically after fixed time, need help identifying what triggers it (offline analysis)


NeVet24

NeVet24

New member
Local time
4:09 PM
Posts
3
OS
windows 11
Hi everyone,

I’m dealing with a very persistent and unusual shutdown issue on a Windows 11 PC and would really appreciate expert help.

Problem summary:
• The computer shuts down automatically after a fixed amount of time (previously ~1 hour, now sometimes ~1 minute).
• It happens even before logging into a user account.
• It does NOT shut down while staying in BIOS.
• shutdown -a does NOT cancel it.
• This is NOT overheating or power supply related.

System:
• Windows 11 (exact build unknown at the moment)
• Gigabyte H510M H V2 motherboard
• PC was self-built
• BIOS password was previously set, later cleared via CMOS reset

Important background:
Previously, a parental time control program called “Babaika / Parents Time Control” was installed. It is known to:
• Run invisibly
• Shut down the PC when daily time expires
• Store state so shutdown can happen shortly after boot
• Work via service / background agent

I removed all visible Babaika files, renamed folders, deleted limit.txt files, etc.
However, the shutdown behavior continued, so I suspect:
• a leftover service
• a scheduled task
• or a kernel-level component / driver

What I have already checked (offline, via BootCD / WinPE):
• Prefetch folder (C:\Windows\Prefetch)
Found repeated launches of a non-system file named “AGENT.EXE”
• Recent files
• Startup folders
• BIOS settings
• Power settings

Prefetch shows AGENT.EXE launching shortly before shutdown events.
System files (svchost, runtimebroker, trustedinstaller, etc.) look normal.

Current situation:
• I can boot from external media (BootCD / WinPE)
• Windows Event Viewer is not available directly, so I’m trying to analyze System.evtx offline
• I want to determine EXACTLY what process or service initiates the shutdown

My questions:
1. What is the best way to identify a shutdown initiator using offline analysis (System.evtx, services, drivers)?
2. Could a leftover service or driver still enforce shutdown even if the original EXE was removed?
3. What specific Event IDs or registry/service locations should I focus on for time-based shutdowns?
4. Any known cases of parental control software persisting after removal?

I’m happy to provide:
• Event log excerpts
• Prefetch listings
• Service lists (offline)
• Folder paths of suspicious files

Thanks in advance, any help or ideas are very welcome.
 
Windows Build/Version
Windows 11

My Computer

System One

  • OS
    windows 11
    Computer type
    PC/Desktop
NeVet24 said:
Hi everyone,

I’m dealing with a very persistent and unusual shutdown issue on a Windows 11 PC and would really appreciate expert help.

Problem summary:
• The computer shuts down automatically after a fixed amount of time (previously ~1 hour, now sometimes ~1 minute).
• It happens even before logging into a user account.
• It does NOT shut down while staying in BIOS.
• shutdown -a does NOT cancel it.
• This is NOT overheating or power supply related.

System:
• Windows 11 (exact build unknown at the moment)
• Gigabyte H510M H V2 motherboard
• PC was self-built
• BIOS password was previously set, later cleared via CMOS reset

Important background:
Previously, a parental time control program called “Babaika / Parents Time Control” was installed. It is known to:
• Run invisibly
• Shut down the PC when daily time expires
• Store state so shutdown can happen shortly after boot
• Work via service / background agent

I removed all visible Babaika files, renamed folders, deleted limit.txt files, etc.
However, the shutdown behavior continued, so I suspect:
• a leftover service
• a scheduled task
• or a kernel-level component / driver

What I have already checked (offline, via BootCD / WinPE):
• Prefetch folder (C:\Windows\Prefetch)
Found repeated launches of a non-system file named “AGENT.EXE”
• Recent files
• Startup folders
• BIOS settings
• Power settings

Prefetch shows AGENT.EXE launching shortly before shutdown events.
System files (svchost, runtimebroker, trustedinstaller, etc.) look normal.

Current situation:
• I can boot from external media (BootCD / WinPE)
• Windows Event Viewer is not available directly, so I’m trying to analyze System.evtx offline
• I want to determine EXACTLY what process or service initiates the shutdown

My questions:
1. What is the best way to identify a shutdown initiator using offline analysis (System.evtx, services, drivers)?
2. Could a leftover service or driver still enforce shutdown even if the original EXE was removed?
3. What specific Event IDs or registry/service locations should I focus on for time-based shutdowns?
4. Any known cases of parental control software persisting after removal?

I’m happy to provide:
• Event log excerpts
• Prefetch listings
• Service lists (offline)
• Folder paths of suspicious files

Thanks in advance, any help or ideas are very welcome.
Click to expand...
rpq8Ca.png
 

My Computer

System One

  • OS
    Windows 11 Iot Enterprise 21h2 22000.3260
    Computer type
    PC/Desktop
    Manufacturer/Model
    Asus
    CPU
    xeon E5-2697v2
    Motherboard
    rampage iv extreme
    Memory
    32gb 8x4gb ddr3 1333 mhz
    Graphics Card(s)
    gtx 570 poit of view
    Sound Card
    realtek HD (ALC898)
    Monitor(s) Displays
    samsung b2030
    Screen Resolution
    1600x900
    Hard Drives
    2tb hd 5400 rpm
    3tb hd 5400 rpm
    1tb nvme pcie 3.0
    PSU
    hx850w
    Keyboard
    mtek
    Internet Speed
    500/250 gpon
    Browser
    r3dfox 146.0
    Antivirus
    none
NeVet24 said:
I removed all visible Babaika files
Click to expand...
I suggest you check their website / user forum for any guidance such as a specialist uninstall tool that removes remnants such as those that might cause your symptoms.

I assume you did not make a system image before installing that utility.


Denis
 

My Computer

System One

  • OS
    Windows 11 Home x64 Version 25H2 Build 26200.8037
My suggestion? Remove that program. You may already have done that already but there is still stuff inside the registry and/or tasks that was not removed. Take a look inside scheduled tasks because that 1 hour is a dead giveaway. Type: Win+R and type taskschd.msc. When open; open Task Schedular-Library. If the maker did a good job; there should be at that level an entry called; "Babaika" (or the company's name. Something you would recognize....) Look under that tree and find out if there is a task that runs every hour and shuts down your PC. Delete that task. If you can't see an entry at that level; That will become a little bit difficult. It then can hide itself under the Microsoft tree. Do you see it there?

To bad you can't search for such an entry. It's nobody's business to make a task under the Microsoft tree. If you find any tasks called "Babaika" just delete it.

The further option is to use a clean registry program. There are many of them. Programs like Yamicsoft's Windows 11 manager, or Revo's Registry Cleaner Pro and others. Both Windows Manager and Registry Pro are capable of inspecting your registry and finding keys that are invalid (because they are pointing to a program, location, etc. that does exists anymore) They will highlight those keys. After completion; Hit clean registry. Both will ask you if you want to save the to be deleted keys first. Always say yes!!!!! After the save it will delete all invalid keys. (if you do this for the first time? I can be as more than a hunderd.... The registry is also a thing that needs maintenance once in a while. If you don't? More and more not deleted keys will accumulate during time. When Windows starts it will go through the whole registry. At a certain point it becomes slower and slower because it has to go though all those invalid keys. Just a tip) The "save" contains a .reg file. Want to put back everything? (undo the save) DoubleClick on it and all deleted entry's are injected again into your registry.

Let me know if you had any succes removing the cause..... It's better to ask then to reinstall Windows if things go wrong.
 

My Computer

System One

  • OS
    Win 11 Pro "25H2" Build 26200.8653, Zorin OS Pro
    Computer type
    PC/Desktop
    Manufacturer/Model
    Self built
    CPU
    Intel® Core™ i7-12700KF 12th Gen. (S1700)
    Motherboard
    ASUS Prime Z690-A, BIOS v4505 (Z690 Intel Chipset)
    Memory
    32GB DDR5 5600-36 Vengeance (2x16)
    Graphics Card(s)
    PCIe4.0 Asus NVIDIA RTX3060Ti
    Sound Card
    Onboard; Realtek
    Monitor(s) Displays
    34" LG 34UC79G-B Curved 21:9 144Hz
    Screen Resolution
    2560x1080 (No HDR)
    Hard Drives
    250Gb Samsung 870PRO NVMe (Win 11 Pro)
    1Tb Samsung 980PRO NVMe
    1Tb Samsung 970EVO NVMe
    2Tb Samsung 990PRO NVMe with heatsink.
    4Tb WDC WD40EZRZ Blue SATA (Int.)
    4Tb WDC WD40EZRZ Blue SATA (Int.)
    3Tb WDC WD30EFRZ Red SATA (Int.)
    256Gb Samsung 840PRO SSD (RHEL 9,5)
    256Gb Samsung 850PRO SSD (Zorin OS Pro 18)
    PSU
    Coolermaster 850W V2 Gold with internal 12cm exaust fan
    Case
    Be-Quiet Pure Base 600.
    Cooling
    3x Be-Quiet! 12/14cm "Silent Wings 4" casefans, 1x Arctic Freezer i35 CPU towerblock with fan.
    Keyboard
    Steelseries APEX 7 keyboard.
    Mouse
    Logitech G-502 Hero
    Internet Speed
    1Gb
    Browser
    Brave
    Antivirus
    F-Secure
    Other Info
    No Noise system.
    256Gb Kingston Travler USB 3.0 drive.
    64Gb Sandisk USB 3.2 drive. (Ventoy)
    8Gb Philips USB 3.0 drive. (Win. Inst.)
    8Gb Philips USB 3.0 drive. (Rescue disk)
    2Tb WD USB 3.0 Passport drive.
    USB Ext. 500Gb WD SATA drive.
    External USB 3.0 C.A. CD/DVD* burner.
I disagree with the others. If you know it's not heat related, to be make sure it's not hardware/bios related, I would boot from a live Linux distro usb drive like Ubuntu or Mint Cinnamon. If it doesn't shut down, I wouldn't jack around wasting my time with it. I'd backup any important personal files while using the distro and clean install Windows.
 

My Computers

System One System Two

  • OS
    Windows 11 Pro 25H2 26200.8655
    Computer type
    PC/Desktop
    Manufacturer/Model
    Dell Optiplex 7080
    CPU
    i9-10900 10 core 20 threads
    Motherboard
    DELL 0J37VM
    Memory
    32 gb
    Graphics Card(s)
    none-Intel UHD Graphics 630
    Sound Card
    Integrated Realtek
    Monitor(s) Displays
    Benq 27
    Screen Resolution
    2560x1440
    Hard Drives
    2x1tb Solidigm m.2 nvme /External drives 512gb Samsung m.2 sata+2tb Kingston m2.nvme
    PSU
    500w
    Case
    MT
    Cooling
    Dell Premium
    Keyboard
    Logitech wired
    Mouse
    Logitech wireless
    Internet Speed
    so slow I'm too embarrassed to tell
    Browser
    #1 Edge #2 Firefox
    Antivirus
    Defender+MWB Premium
  • Operating System
    Windows 11 Pro 24H2 26200.8457
    Computer type
    PC/Desktop
    Manufacturer/Model
    Beelink Mini PC SER5
    CPU
    AMD Ryzen 7 6800U
    Memory
    32 gb
    Graphics card(s)
    integrated
    Sound Card
    integrated
    Monitor(s) Displays
    Benq 27
    Screen Resolution
    2560x1440
    Hard Drives
    1TB Crucial nvme
    Keyboard
    Logitech wired
    Mouse
    Logitech wireless
    Internet Speed
    still too embarrassed to tell
    Browser
    Firefox
    Antivirus
    Defender
    Other Info
    System 3 is non compliant Dell 9020 i7-4770/24gb ram Win11 PRO 26200.8457
hader said:
My suggestion? Remove that program. You may already have done that already but there is still stuff inside the registry and/or tasks that was not removed. Take a look inside scheduled tasks because that 1 hour is a dead giveaway. Type: Win+R and type taskschd.msc. When open; open Task Schedular-Library. If the maker did a good job; there should be at that level an entry called; "Babaika" (or the company's name. Something you would recognize....) Look under that tree and find out if there is a task that runs every hour and shuts down your PC. Delete that task. If you can't see an entry at that level; That will become a little bit difficult. It then can hide itself under the Microsoft tree. Do you see it there?

To bad you can't search for such an entry. It's nobody's business to make a task under the Microsoft tree. If you find any tasks called "Babaika" just delete it.

The further option is to use a clean registry program. There are many of them. Programs like Yamicsoft's Windows 11 manager, or Revo's Registry Cleaner Pro and others. Both Windows Manager and Registry Pro are capable of inspecting your registry and finding keys that are invalid (because they are pointing to a program, location, etc. that does exists anymore) They will highlight those keys. After completion; Hit clean registry. Both will ask you if you want to save the to be deleted keys first. Always say yes!!!!! After the save it will delete all invalid keys. (if you do this for the first time? I can be as more than a hunderd.... The registry is also a thing that needs maintenance once in a while. If you don't? More and more not deleted keys will accumulate during time. When Windows starts it will go through the whole registry. At a certain point it becomes slower and slower because it has to go though all those invalid keys. Just a tip) The "save" contains a .reg file. Want to put back everything? (undo the save) DoubleClick on it and all deleted entry's are injected again into your registry.

Let me know if you had any succes removing the cause..... It's better to ask then to reinstall Windows if things go wrong.
Click to expand...
Thanks for the detailed reply.

Important detail: I currently do NOT have administrator access inside Windows.
I’m doing most of the investigation offline via BootCD / WinPE.

Because of that, I can’t use taskschd.msc directly.
However, I will manually inspect:
C:\Windows\System32\Tasks
and the Microsoft subfolders offline.

Prefetch already shows repeated launches of AGENT.EXE shortly before shutdowns,
so I strongly suspect a leftover scheduled task or service.

I’ll report back if I find a suspicious task XML.
Thanks again.
 

My Computer

System One

  • OS
    windows 11
    Computer type
    PC/Desktop
NeVet24 said:
Important detail: I currently do NOT have administrator access inside Windows
Click to expand...
Unless you can fix that I think you will have no choice but to reinstall WIndows.
Why did you say currently?


Denis
 

My Computer

System One

  • OS
    Windows 11 Home x64 Version 25H2 Build 26200.8037
NeVet24 said:
Thanks for the detailed reply.

Important detail: I currently do NOT have administrator access inside Windows.
.....
Prefetch already shows repeated launches of AGENT.EXE shortly before shutdowns,
so I strongly suspect a leftover scheduled task or service.

I’ll report back if I find a suspicious task XML.
Thanks again.
Click to expand...
OK. Odd that you're not have administrator rights on that machine. (Installed and deinstalled it under a separate account?) Would make life so much easier.
The task are indeed inside C:\Windows\System32\Tasks. The files there don't have any extension with it. It's content has an XML format.

If you are able to delete that task (that has to be seen as your not an administrator) don't forget to delete the correct accompanying task inside the registry.
The entry's under the Tasks tree has a GUID format, but you can search from there by searching using the name of the task. You have to delete (if you can start regedit..) that entry also in the registry. Location: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks
Then you need also delete the task (name is visible, it's "path" was already visible in the task itself) in the Tree below Tasks.
Location: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree

Yes I am certain it's a leftover in the scheduled task. Don't believe it is an service. (To much hassle. Finding out when the PC started and look at the time. If 1 hour then shutdown.... Can easily be achieved by a task. That what they are there for; starting jobs under certain conditions.)

There maybe an alternate solution to all of this. You can edit the task. There must be a line like shutdown /s /t 0 inside the task. If you remove that entry (empty) that will prevent a shutdown. The task may be triggered but that has no consequences. Look also at the Logon task. There can be an action been added like shutdown /s /t 3600 (shutdown after 1 hour)

It's not easy to do this with one hand tied behind your back. Goodluck.
N.B. You also need to clean your registry! If this was an leftover who know how many rubbish has been left behind..
 

My Computer

System One

  • OS
    Win 11 Pro "25H2" Build 26200.8653, Zorin OS Pro
    Computer type
    PC/Desktop
    Manufacturer/Model
    Self built
    CPU
    Intel® Core™ i7-12700KF 12th Gen. (S1700)
    Motherboard
    ASUS Prime Z690-A, BIOS v4505 (Z690 Intel Chipset)
    Memory
    32GB DDR5 5600-36 Vengeance (2x16)
    Graphics Card(s)
    PCIe4.0 Asus NVIDIA RTX3060Ti
    Sound Card
    Onboard; Realtek
    Monitor(s) Displays
    34" LG 34UC79G-B Curved 21:9 144Hz
    Screen Resolution
    2560x1080 (No HDR)
    Hard Drives
    250Gb Samsung 870PRO NVMe (Win 11 Pro)
    1Tb Samsung 980PRO NVMe
    1Tb Samsung 970EVO NVMe
    2Tb Samsung 990PRO NVMe with heatsink.
    4Tb WDC WD40EZRZ Blue SATA (Int.)
    4Tb WDC WD40EZRZ Blue SATA (Int.)
    3Tb WDC WD30EFRZ Red SATA (Int.)
    256Gb Samsung 840PRO SSD (RHEL 9,5)
    256Gb Samsung 850PRO SSD (Zorin OS Pro 18)
    PSU
    Coolermaster 850W V2 Gold with internal 12cm exaust fan
    Case
    Be-Quiet Pure Base 600.
    Cooling
    3x Be-Quiet! 12/14cm "Silent Wings 4" casefans, 1x Arctic Freezer i35 CPU towerblock with fan.
    Keyboard
    Steelseries APEX 7 keyboard.
    Mouse
    Logitech G-502 Hero
    Internet Speed
    1Gb
    Browser
    Brave
    Antivirus
    F-Secure
    Other Info
    No Noise system.
    256Gb Kingston Travler USB 3.0 drive.
    64Gb Sandisk USB 3.2 drive. (Ventoy)
    8Gb Philips USB 3.0 drive. (Win. Inst.)
    8Gb Philips USB 3.0 drive. (Rescue disk)
    2Tb WD USB 3.0 Passport drive.
    USB Ext. 500Gb WD SATA drive.
    External USB 3.0 C.A. CD/DVD* burner.
NeVet24 said:
Important detail: I currently do NOT have administrator access inside Windows.
I’m doing most of the investigation offline via BootCD / WinPE.
Click to expand...
This seems kinda' important! Why exactly don't you have admin access? If you have a an admin account on this machine, you can give that account admin access.
 

My Computers

System One System Two

  • OS
    Win 11 Pro 25H2, Build 26200.8655
    Computer type
    PC/Desktop
    Manufacturer/Model
    Home Brew
    CPU
    Intel Core i5 14500
    Motherboard
    Gigabyte B760M G P WIFI
    Memory
    64GB DDR4
    Graphics Card(s)
    GeForce RTX 4060
    Sound Card
    Chipset Realtek
    Monitor(s) Displays
    LG 45" Ultragear, Acer 24" 1080p
    Screen Resolution
    5120x1440, 1920x1080
    Hard Drives
    Crucial P310 2TB 2280 PCIe Gen4 3D NAND NVMe M.2 SSD (O/S)
    Silicon Power 2TB US75 NVMe PCIe Gen4 M.2 2280 SSD (backup)
    Crucial BX500 2TB 3D NAND (2nd backup)
    Seagate 4TB Ironwolf, rotating HDD archive files
    External off-line backup Drives: 2 NVMe 4TB drives in external enclosures
    PSU
    Thermaltake Toughpower GF3 750W
    Case
    LIAN LI LANCOOL 216 E-ATX PC Case
    Cooling
    Lots of fans!
    Keyboard
    Microsoft Comfort Curve 2000
    Mouse
    Logitech G305
    Internet Speed
    Verizon FiOS 1GB
    Browser
    Firefox
    Antivirus
    Malware Bytes & Windows Defender Security
  • Operating System
    Win 11 Pro 25H2, Build 26200.8524
    Computer type
    PC/Desktop
    Manufacturer/Model
    Home Brew
    CPU
    Intel Core i5 14400
    Motherboard
    Gigabyte B760M DS3H AX
    Memory
    32GB DDR5
    Graphics card(s)
    Intel 700 Embedded GPU
    Sound Card
    Realtek Embedded
    Monitor(s) Displays
    27" HP 1080p
    Screen Resolution
    1920x1080
    Hard Drives
    Crucial P310 2TB 2280 PCIe Gen4 eD NAND PCIe SSD
    Samsung EVO 990 2TB NVMe Gen4 SSD
    Samsung 2TB SATA SSD
    PSU
    Thermaltake Smart BM3 650W
    Case
    Okinos Micro ATX Case
    Cooling
    Fans
    Keyboard
    Microsoft Comfort Curve 2000
    Mouse
    Logitech G305
    Internet Speed
    Verizon FiOS 1GB
    Browser
    Firefox
    Antivirus
    Malware Bytes & Windows Defender Security
I recommend first updating the BIOS to version F5b. This BIOS update addresses critical security vulnerabilities (CVE-2025-7026, CVE-2025-7027, CVE-2025-7029) identified by BRLY. That should wipe anything hiding there.

Following that, I agree with glasscutter in post #6 - boot to Linux and test/recover files then wipe and reload Windows from backup or from scratch.
 

My Computers

System One System Two

  • OS
    Win 10 Pro / Win 11 Pro & Home, Linux Mint
    Computer type
    PC/Desktop
    Manufacturer/Model
    Custom builds
    CPU
    AMD Ryzen 7 5700X / A10-7860K
    Motherboard
    MSI PRO B550-VC / ASRock A88M-G/3.1
    Memory
    32GB / 16GB
    Graphics Card(s)
    AMD RX 6650 XT / RX 580
    Monitor(s) Displays
    Samsung 27" / LG 24"
    Screen Resolution
    1920x1080
    Hard Drives
    Toshiba 2 TB
    Toshiba 1 TB
    Toshiba 1 TB
    WD Black SN770 1TB

    PNY 1 TB
    PNY 500 GB
    WD Black SN770 200 GB
    Inland 500 GB
    Inland 256 GB
    Case
    NZXT / Lian LI
    Keyboard
    ROCCAT PYRO / Logitech 148
    Mouse
    Logitech
    Browser
    Firefox, Opera, Waterfox, Tor
  • Operating System
    Windows 11 Home
    Computer type
    Laptop
    Manufacturer/Model
    HP 17
    CPU
    Intel i5
    Memory
    16GB
    Screen Resolution
    1920 x 1080
    Hard Drives
    512 GB
    Browser
    Firefox
gunrunnerjohn said:
This seems kinda' important! Why exactly don't you have admin access? If you have a an admin account on this machine, you can give that account admin access.
Click to expand...
Would not say this; I suspect this is not his laptop/PC..... All he has to do is ask the owner that installed Windows for his account to log in. If this is a company's laptop/PC let their tech support solve this issue. Some else installed Windows. He may only have an user account that is limited. That could be the reason why he is not Admin on this laptop/PC. As it's often the case with company's laptop's/PC's..... Or he bought it on eBay and the previous owner didn't gave his credentials. :eyeroll:
 

My Computer

System One

  • OS
    Win 11 Pro "25H2" Build 26200.8653, Zorin OS Pro
    Computer type
    PC/Desktop
    Manufacturer/Model
    Self built
    CPU
    Intel® Core™ i7-12700KF 12th Gen. (S1700)
    Motherboard
    ASUS Prime Z690-A, BIOS v4505 (Z690 Intel Chipset)
    Memory
    32GB DDR5 5600-36 Vengeance (2x16)
    Graphics Card(s)
    PCIe4.0 Asus NVIDIA RTX3060Ti
    Sound Card
    Onboard; Realtek
    Monitor(s) Displays
    34" LG 34UC79G-B Curved 21:9 144Hz
    Screen Resolution
    2560x1080 (No HDR)
    Hard Drives
    250Gb Samsung 870PRO NVMe (Win 11 Pro)
    1Tb Samsung 980PRO NVMe
    1Tb Samsung 970EVO NVMe
    2Tb Samsung 990PRO NVMe with heatsink.
    4Tb WDC WD40EZRZ Blue SATA (Int.)
    4Tb WDC WD40EZRZ Blue SATA (Int.)
    3Tb WDC WD30EFRZ Red SATA (Int.)
    256Gb Samsung 840PRO SSD (RHEL 9,5)
    256Gb Samsung 850PRO SSD (Zorin OS Pro 18)
    PSU
    Coolermaster 850W V2 Gold with internal 12cm exaust fan
    Case
    Be-Quiet Pure Base 600.
    Cooling
    3x Be-Quiet! 12/14cm "Silent Wings 4" casefans, 1x Arctic Freezer i35 CPU towerblock with fan.
    Keyboard
    Steelseries APEX 7 keyboard.
    Mouse
    Logitech G-502 Hero
    Internet Speed
    1Gb
    Browser
    Brave
    Antivirus
    F-Secure
    Other Info
    No Noise system.
    256Gb Kingston Travler USB 3.0 drive.
    64Gb Sandisk USB 3.2 drive. (Ventoy)
    8Gb Philips USB 3.0 drive. (Win. Inst.)
    8Gb Philips USB 3.0 drive. (Rescue disk)
    2Tb WD USB 3.0 Passport drive.
    USB Ext. 500Gb WD SATA drive.
    External USB 3.0 C.A. CD/DVD* burner.
I've had some doubts about the OPs access to this device from the start

Plain and simple, replace the drive with a new one and do a clean install

No matter what's going on here, I don't know why anyone would accept a second hand device and not do a clean install, at the minimum, but with preferably a new drive replacement.
 
Last edited:

My Computers

System One System Two

  • OS
    Windows 11 2xH2 (latest update ... forever anal)
    Computer type
    PC/Desktop
    Manufacturer/Model
    HP Slim S01
    CPU
    Intel i5-12400
    Memory
    8GB
    Graphics Card(s)
    NVIDIA GeForce GT730
    Sound Card
    OOBE
    Monitor(s) Displays
    Acer 32"
    Screen Resolution
    1920x1080
    Hard Drives
    512GB KIOXIA NVMe
    1TB SATA SSD
    PSU
    OOBE
    Case
    OOBE
    Cooling
    OOBE
    Keyboard
    BT
    Mouse
    BT
    Browser
    Brave FFox Chrome Opera
    Antivirus
    KIS
  • Operating System
    Windows 11 Pro 2xH2 (latest update ... 4ever anal)
    Computer type
    Laptop
    Manufacturer/Model
    HP Pavillion 15
    CPU
    i7-1165G7 @ 2.80GHz
    Graphics card(s)
    Intel Iris Xe Graphics
    Hard Drives
    Samsung NVMe 512GB
    + numerous/multiple SSD Type C USB enclosures
    Internet Speed
    NBN FTTN 50
    Browser
    Brave
    Antivirus
    KIS
Get Autoruns for PC (it's free).
learn.microsoft.com

Autoruns - Sysinternals

See what programs are configured to startup automatically when your system boots and you login.
learn.microsoft.com

Autoruns wlll display a list of everything that is designed to run at bootup and/or login. (You may be surprised how much stuff that is!)
Then search for "Babaika" in the list of vendors.
Some apps even install auxiliary tasks in AppData.

Alternatively, just complain to whoever installed this app that it's failed.
 

My Computer

System One

  • OS
    Windows 11
    Computer type
    PC/Desktop
    Manufacturer/Model
    Custom
    CPU
    Ryzen 9 7900X
    Motherboard
    ASUS ROG STRIX B-650 E-F
    Memory
    64 GB
    Graphics Card(s)
    Nvidia GeForce GTX 1650
    Hard Drives
    C: SSD, 500 GB
    D: HDD, 1 TB
    J: HDD, 1 TB
    Antivirus
    Norton
Eksy61 said:
Get Autoruns for PC (it's free).
learn.microsoft.com

Autoruns - Sysinternals

See what programs are configured to startup automatically when your system boots and you login.
learn.microsoft.com

Autoruns wlll display a list of everything that is designed to run at bootup and/or login. (You may be surprised how much stuff that is!)
Then search for "Babaika" in the list of vendors.
Some apps even install auxiliary tasks in AppData.

Alternatively, just complain to whoever installed this app that it's failed.
Click to expand...
Don't think this will run. Sysinternal programs must run under a user that has admin rights. He has no admin rights.
 

My Computer

System One

  • OS
    Win 11 Pro "25H2" Build 26200.8653, Zorin OS Pro
    Computer type
    PC/Desktop
    Manufacturer/Model
    Self built
    CPU
    Intel® Core™ i7-12700KF 12th Gen. (S1700)
    Motherboard
    ASUS Prime Z690-A, BIOS v4505 (Z690 Intel Chipset)
    Memory
    32GB DDR5 5600-36 Vengeance (2x16)
    Graphics Card(s)
    PCIe4.0 Asus NVIDIA RTX3060Ti
    Sound Card
    Onboard; Realtek
    Monitor(s) Displays
    34" LG 34UC79G-B Curved 21:9 144Hz
    Screen Resolution
    2560x1080 (No HDR)
    Hard Drives
    250Gb Samsung 870PRO NVMe (Win 11 Pro)
    1Tb Samsung 980PRO NVMe
    1Tb Samsung 970EVO NVMe
    2Tb Samsung 990PRO NVMe with heatsink.
    4Tb WDC WD40EZRZ Blue SATA (Int.)
    4Tb WDC WD40EZRZ Blue SATA (Int.)
    3Tb WDC WD30EFRZ Red SATA (Int.)
    256Gb Samsung 840PRO SSD (RHEL 9,5)
    256Gb Samsung 850PRO SSD (Zorin OS Pro 18)
    PSU
    Coolermaster 850W V2 Gold with internal 12cm exaust fan
    Case
    Be-Quiet Pure Base 600.
    Cooling
    3x Be-Quiet! 12/14cm "Silent Wings 4" casefans, 1x Arctic Freezer i35 CPU towerblock with fan.
    Keyboard
    Steelseries APEX 7 keyboard.
    Mouse
    Logitech G-502 Hero
    Internet Speed
    1Gb
    Browser
    Brave
    Antivirus
    F-Secure
    Other Info
    No Noise system.
    256Gb Kingston Travler USB 3.0 drive.
    64Gb Sandisk USB 3.2 drive. (Ventoy)
    8Gb Philips USB 3.0 drive. (Win. Inst.)
    8Gb Philips USB 3.0 drive. (Rescue disk)
    2Tb WD USB 3.0 Passport drive.
    USB Ext. 500Gb WD SATA drive.
    External USB 3.0 C.A. CD/DVD* burner.
hader said:
Would not say this; I suspect this is not his laptop/PC..... All he has to do is ask the owner that installed Windows for his account to log in. If this is a company's laptop/PC let their tech support solve this issue. Some else installed Windows. He may only have an user account that is limited. That could be the reason why he is not Admin on this laptop/PC. As it's often the case with company's laptop's/PC's..... Or he bought it on eBay and the previous owner didn't gave his credentials. :eyeroll:
Click to expand...
Yes, you are stating the obvious! I was really looking for the reason that he couldn't obtain access.

I realize the implications, just wanted to hear it from the source. When you're working on stuff like this, it's hard to imagine making much progress without admin rights.

I'm checking out anyway, we're wasting our time thinking about this if it's not his laptop, let the owner figure it out.
 

My Computers

System One System Two

  • OS
    Win 11 Pro 25H2, Build 26200.8655
    Computer type
    PC/Desktop
    Manufacturer/Model
    Home Brew
    CPU
    Intel Core i5 14500
    Motherboard
    Gigabyte B760M G P WIFI
    Memory
    64GB DDR4
    Graphics Card(s)
    GeForce RTX 4060
    Sound Card
    Chipset Realtek
    Monitor(s) Displays
    LG 45" Ultragear, Acer 24" 1080p
    Screen Resolution
    5120x1440, 1920x1080
    Hard Drives
    Crucial P310 2TB 2280 PCIe Gen4 3D NAND NVMe M.2 SSD (O/S)
    Silicon Power 2TB US75 NVMe PCIe Gen4 M.2 2280 SSD (backup)
    Crucial BX500 2TB 3D NAND (2nd backup)
    Seagate 4TB Ironwolf, rotating HDD archive files
    External off-line backup Drives: 2 NVMe 4TB drives in external enclosures
    PSU
    Thermaltake Toughpower GF3 750W
    Case
    LIAN LI LANCOOL 216 E-ATX PC Case
    Cooling
    Lots of fans!
    Keyboard
    Microsoft Comfort Curve 2000
    Mouse
    Logitech G305
    Internet Speed
    Verizon FiOS 1GB
    Browser
    Firefox
    Antivirus
    Malware Bytes & Windows Defender Security
  • Operating System
    Win 11 Pro 25H2, Build 26200.8524
    Computer type
    PC/Desktop
    Manufacturer/Model
    Home Brew
    CPU
    Intel Core i5 14400
    Motherboard
    Gigabyte B760M DS3H AX
    Memory
    32GB DDR5
    Graphics card(s)
    Intel 700 Embedded GPU
    Sound Card
    Realtek Embedded
    Monitor(s) Displays
    27" HP 1080p
    Screen Resolution
    1920x1080
    Hard Drives
    Crucial P310 2TB 2280 PCIe Gen4 eD NAND PCIe SSD
    Samsung EVO 990 2TB NVMe Gen4 SSD
    Samsung 2TB SATA SSD
    PSU
    Thermaltake Smart BM3 650W
    Case
    Okinos Micro ATX Case
    Cooling
    Fans
    Keyboard
    Microsoft Comfort Curve 2000
    Mouse
    Logitech G305
    Internet Speed
    Verizon FiOS 1GB
    Browser
    Firefox
    Antivirus
    Malware Bytes & Windows Defender Security
You must log in or register to reply here.

Similar threads

PC shuts down automatically every 60 minutes - how to find what triggers it?
Replies
3
Views
2K
antspants
antspants

Latest Support Threads

Latest Tutorials

Back
Top Bottom