Overnight Logging Off

Figured I'd start a new thread. I jumped in someone else's thread that was closed, and that was probably a bad idea. My stuff starts up on the last page, but here's my response to the last poster trying to help me (and here is where I jumped in that other thread):

gregrocker said:

Go over all of your BIOS settings to see if anything looks suspicious. You can also reset to defaults in case something is awry and not noticed.

Is there anything remaining in msconfig>Startup and msconfig>Services (after hiding MS Services) other than your AV? What is your AV?

Have you had a Clean Reinstall lately? Here are steps which are the same for retail to get a perfect Clean Reinstall - Factory OEM Windows 7.

I would mark your thread Unsolved to get more help.

At this point, I'm not going to re-install, that would be maddening. I wish I would have done something before Sunday, I could have just restored my entire machine from backup, full Norton Ghost. I reserve installing for new operating systems and 'sometimes' new hardware, depending on the hardware change.

So with that out of the way (sorry, only willing to go so far with this), let's look at some of your other questions.

Well, before those, let's keep a few things in mind:

1. This isn't a sleep or hibernation, nothing seems to be 'waking' and 'restoring where I was at'. Everything that was running was shut down.

2. I don't think it's restarting. While some of the events 'say' that some things have restarted, there are no Event ID 100-110 entries, so it's not physically restarting.

3. I do see an event ID 4647 at 2:29 this morning. Logoff. That is followed by the even logging service shutting down (1100) and then 2 minutes later a few other services started up. Firewall. Interestingly, there's an ID 4608 and it says:

Code:

Windows is starting up.

This event is logged when LSASS.EXE starts and the auditing subsystem is initialized.

But it didn't really restart, because it would have logged a boot, no?

Now, to your questions. I have a 'lot' of things running. As I would expect. I install lots of tools, toys, helpers and junk. Pretty sure all of them have been running for much longer than just the past week.

Here's a little album of screenshots.

Avast is my anti-virus (the free one). Plus I have Spybot (purchased) and SUPERAntiSpyware (purchased) running, as well as SpywareBlaster and run Malwarebytes often.

There's the potential monkey! Event ID 1074 in the System log right around the time of the 'logoff' from the security log.

The process SUPERANTISPYWARE.EXE has initiated the restart of computer xxxxxx on behalf of user xxxxx\xxxxxx for the following reason: Other (Unplanned)
Reason Code: 0x0
Shutdown Type: restart
Comment:

Now to go make nasties-posties in their forums!

Thanks Greg, for getting the wheels in this (sadly) older head turning a bit better! :)

If you happen to see this, post a reply so I can slap a 'solved' on you. Not sure if you get bonus points for that or not, but wanted to give a little back if this site works that way. :)

Glad to see you found what is causing this issue.
You could look through SAS settings and see if you can find something to "disable" this "feature".
Also, you could post a question on their forum, or look for an answer there.

You can give Greg a rep by clicking on the "Add to reputation" icon.
At the top right of each post there are 3 icons.
It's the middle icon, hover over it and it will pop up a description.

DavidW7ncus said:

Glad to see you found what is causing this issue.
You could look through SAS settings and see if you can find something to "disable" this "feature".
Also, you could post a question on their forum, or look for an answer there.

You can give Greg a rep by clicking on the "Add to reputation" icon.
At the top right of each post there are 3 icons.
It's the middle icon, hover over it and it will pop up a description.

Done and thank you.

I decided to strip all the many malware, virus, spyware apps I was running on this machine and just give 'essentials' a roll for awhile (at Greg's suggestion). Doing the same on my work laptop, and I have a few other work virtual machines that could benefit from it as well.

I do believe SAS has a setting where you can give it the authority to restart if it can't quarantine while someone is logged in. It must not be a full bounce, since no other boot records are being logged.

At any rate, it's moot because I dumped it, but I'll keep this in mind if I ever decide to go back to it.