Running XP SP3, latest updates.
When the Plug and Play service is enabled, services.exe goes into an endless loop (100%) and after running the SysInternals utility Procmon.exe, it showed that it was in an endless loop trying to read what appears to be a corrupt registry key (under HKLM\...\<some guid that represents Plug and Play Monitor>\mode\<corrupt key>. If I try device mgr to uninstall Plug and Play Monitor, it hangs. If I try to read that key, an err msg appears "unable to read...".
The virus had apparently wiped out previous restore points, so I'm left with hoping there's a way to forcibly remove that errant key (so it could be rebuilt) or some other way, so the system could be made usable. This is such a tight loop, that only procexp.exe (not taskmgr) can at least lower the priority to idle to allow anything else to run (although slowly).