I did a virus scan and found the UACd.sys trojan driver.
I had not done a virus scan before because all info led to a power surge.
However, my client always kept her computer on and when a reboot was required after the power outage the trojan was able to install itself.
For future edification; Look for the following characteristics;
1) Regular boot causes problems with automatic start of many services. These services can't be started manually.
2) Safe mode is OK
3) On regular boot several computer actions (see question above)
4) MBAM was the only antivirus I could install in safe mode. It will update virus definitions on install so run it even though you won't be able to update after install.