Windows 7 Forums

Welcome to Windows 7 Forums. Our forum is dedicated to helping you find support and solutions for any problems regarding your Windows 7 PC be it Dell, HP, Acer, Asus or a custom build. We also provide an extensive Windows 7 tutorial section that covers a wide range of tips and tricks.


Windows 7: Windows 7 x64 machine suddenly performs restart as if I hit the button

22 Oct 2013   #1
TrunkMonkey

Windows 7 Professional 64 bit
 
 
Windows 7 x64 machine suddenly performs restart as if I hit the button

My HTPC has restarted itself probably 2-3 times in the last week. It's your standard Windows 7 restart complete with closing all apps, Logging Off, and Shutting Down screens. The most recent occurrence was just a few minutes ago. I was playing a video, running ATI CCC testing settings, and had Chrome open. I never issued this command or touched the PC itself. One thing I know was also going on was the daily MSE security definitions update, most likely in the install phase. I do not recall what was going on in the the previous times this happened, but it's all pretty recent.

This one has me stumped since it's not a blue screen, but a controlled restart with no errors or problems indicated. I can't for the life of me think of what could cause such a thing to happen. Can anyone think of any possible sources of a Restart command? Is MSE issuing this after definition updates? Is there a way to check the source of a restart command like in a windows system log?

EDIT: in Event Logs I found this:

Code:
Log Name:      System
Source:        Microsoft-Windows-Kernel-Power
Date:          10/22/2013 6:05:32 PM
Event ID:      109
Task Category: (103)
Level:         Information
Keywords:      (4)
User:          N/A
Computer:      Tower_Of_Power_
Description:
The kernel power manager has initiated a shutdown transition.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Kernel-Power" Guid="{331C3B3A-2005-44C2-AC5E-77220C37D6B4}" />
    <EventID>109</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>103</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000004</Keywords>
    <TimeCreated SystemTime="2013-10-22T23:05:32.272660300Z" />
    <EventRecordID>85572</EventRecordID>
    <Correlation />
    <Execution ProcessID="532" ThreadID="536" />
    <Channel>System</Channel>
    <Computer>Tower_Of_Power_</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="ShutdownActionType">5</Data>
    <Data Name="ShutdownEventCode">0</Data>
    <Data Name="ShutdownReason">5</Data>
  </EventData>
</Event>
And also this. Clearly here is the problem but why is it happening and what does it mean?

Code:
Log Name:      System
Source:        USER32
Date:          10/22/2013 6:05:06 PM
Event ID:      1074
Task Category: None
Level:         Information
Keywords:      Classic
User:          SYSTEM
Computer:      Tower_Of_Power_
Description:
The process C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe (TOWER_OF_POWER_) has initiated the restart of computer TOWER_OF_POWER_ on behalf of user NT AUTHORITY\SYSTEM for the following reason: Legacy API shutdown
 Reason Code: 0x80070000
 Shutdown Type: restart
 Comment: 
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="USER32" />
    <EventID Qualifiers="32768">1074</EventID>
    <Level>4</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2013-10-22T23:05:06.000000000Z" />
    <EventRecordID>85524</EventRecordID>
    <Channel>System</Channel>
    <Computer>Tower_Of_Power_</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data>C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe (TOWER_OF_POWER_)</Data>
    <Data>TOWER_OF_POWER_</Data>
    <Data>Legacy API shutdown</Data>
    <Data>0x80070000</Data>
    <Data>restart</Data>
    <Data>
    </Data>
    <Data>NT AUTHORITY\SYSTEM</Data>
    <Binary>00000780000000000000000000000000000000000000000000000000000000000000000000000000</Binary>
  </EventData>
</Event>



My System SpecsSystem Spec
.
22 Oct 2013   #2
TrunkMonkey

Windows 7 Professional 64 bit
 
 

Ok so I've found the issue. Event Logs showed MalwareBytes restarting after a daily quick scan and removal of suspicious software:

Code:
Malwarebytes Anti-Malware (PRO) 1.75.0.1300
www.malwarebytes.org

Database version: v2013.10.22.10

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 10.0.9200.16721
SYSTEM :: TOWER_OF_POWER_ [limited]

Protection: Enabled

10/22/2013 6:00:12 PM
mbam-log-2013-10-22 (18-00-12).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM | P2P
Scan options disabled: 
Objects scanned: 221031
Time elapsed: 4 minute(s), 54 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 1
C:\Users\Trunk Monkey\Downloads\attsetup.exe (PUP.Optional.OpenCandy) -> Quarantined and deleted successfully.

(end)
About an hour ago I downloaded ATI Tray Tools from Softpedia. MBAM flagged and deleted the installer, which had not been run yet. I wonder if it's a false positive. Hmmmm. Posting all this in case someone else ever encounters mysterious restarts. I'll update anything new I find out.
My System SpecsSystem Spec
22 Oct 2013   #3
Golden
Microsoft MVP

Windows 7 Ult. x64
 
 

Take care when downloading off Softpedia
My System SpecsSystem Spec
.

22 Oct 2013   #4
Britton30
Microsoft MVP

Windows 7 Ultimate X64 SP1
 
 

Agreed, many free sites have downloads injected with all sorts of crapware. Also read each window that comes up when installing one, even the EULA, sometimes it has opt=out options well buried.
My System SpecsSystem Spec
22 Oct 2013   #5
TrunkMonkey

Windows 7 Professional 64 bit
 
 

thanks for the advice, i'll take heed. I thought Softpedia was one of the good ones. But I guess it's installer beware. Thankfully I never installed it.
My System SpecsSystem Spec
Reply

 Windows 7 x64 machine suddenly performs restart as if I hit the button




Thread Tools




Similar help and support threads
Thread Forum
IE 11 back button not working on windows 7 machine
Hi Guys, I am using IE11 version 11.0.9600.17105 on a Windows 7 machine. The back button does not work most of the time. I have found many old threads regarding this issue, however my issue is current, I'm wondering if there has been a fix and I have somehow missed it
Browsers & Mail
How to Windows-disable the front-panel restart button?
In http://www.sevenforums.com/hardware-devices/295913-spontaneous-restarts-perhaps-seemingly-caused-power-switch-help.html I describe a bothersome situation where, as of now, it appears that my PC is rebooting itself once in the morning upon being woken from sleep and logged into, then behaves fine...
Hardware & Devices
My Windows XP virtual machine froze during restart
I have been using Windows XP mode for quite some time now, but i have never encountered a problem like this before. Last night when I rebooted my virtual machine I also accidentally closed the VM window at the same time. This sent the virtual machine into hibernation while it was still...
Virtualization
Win 7 suddenly won't restart
I attempted to reboot today, but I can't. I'm told to go through the startup repair sequence, which appears to successfully load files, then I see a brief set of arrows suggesting something is going on, but then the screen goes blank and stays that way. Won't start normally either. I'm running...
BSOD Help and Support
Suddenly cannot connect to an XP machine (others work)
I have a small home network setup with a handful of Windows XP machines. I recently upgraded one machine to Windows 7 and everything was configured and working. This morning the Windows 7 machine will not connect to one of the XP machines. I set up the Windows 7 machine with two logins (my wife...
Network & Sharing
Windows 7 Problem - Restart after "Install" button :(
So... the problem is, when I try to install Win 7, the installer keeps restarting, when I press the Install button at the beginning. The version is 7600 RTM, x86. My prev OS is Win XP x86, but i want to do a full format-> install, so dunno if this matters... Can somebody help me? My old...
Installation & Setup


Our Sites

Site Links

About Us

Find Us

Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

Designer Media Ltd

All times are GMT -5. The time now is 15:51.

Twitter Facebook Google+



Windows 7 Forums

Seven Forums Android App Seven Forums IOS App