XP workstation logs on at state of log off

2003 domain, an XP Pro workstation shuts down all processes, logs out, login has same programs running in the state that was left before shutting down the programs and logging off. For example… a Quickbooks will open back to the exact state or window before shutdown. An Excel file will open and not have the changes saved at time of “closed and saved” the day before. Happens intermitant, about once a week. It’s as if the profile is remembering a system state before logoff. Group Policy is default. Rootkit, malware and any other already run.