Stop Doing That!

April 29, 2009 9:14 AM

Something's rebooting my PC at 4:30am every day - help me find out what and stop it?!?

I have lots of the usual stuff going on my PC (win XP) - and lots of them are capable of initiating a reboot. And I think I've checked them all - damned if I can find out which one is doing it!!

The AVG virus scanner for example has a 'reboot after scan' option - but it's not set and I moved the scan time just to be sure. So I'm not listing here all the stuff that's running on it - so I please don't expect the hive to guess what is the cause. But can you suggest ways that I can trap it ? Ways to divert, pause, trap, dump whatever-is-doing-it?

And here's the kicker - the PC is actually in an office (which is locked and I have no access at night), so I can't watch it shut down. So I need something that will dump a file or freeze it so I can see in the morning.

(I have full administrator rights to the PC).

TIA

posted by Xhris to computers & internet (19 answers total)

You could uninstall the AVG scanner just to make absolutely sure it isn't doing something you don't want it to. Or any other sw that is causing the reboots to occur.

You can also look in the Event Viewer logs to see if it shows any particular action occurring then (which I presume you have already done since you happen to know it's rebooting at exactly 4:30, but just in case that's not the reason you know the time...).

If you use or trust System Restore, if you have it enabled, you could see when the last time your system did not reboot at 4:30 am, and restore it to that point or one prior. I've always liked the idea of 'System Restore', but I have always found it to be a complete crap shoot on its effectiveness.
posted by bitterkitten at 9:20 AM on April 29, 2009

change the system time, see if it still happens at 430...
look in task scheduler and see if anything is there?
posted by fozzie33 at 9:20 AM on April 29, 2009

Just a couple sanity checks. Have you:

a) Disabled "Automatically Restart" in System Properties > Advanced > Startup and Recovery Settings > System Failure? In other words, are you sure you're not bluescreening every time some automated process runs? This has happened to me a couple times.

b) Tried checking the System and Application logs in Event Viewer? Start > Run > eventvwr.msc -- You can often find lots of informative log entries in there -- might be able to discover what's running at that time, and stop it.
posted by jake at 9:24 AM on April 29, 2009

Is it really every day?

I ask because Windows pushes updates during the night, at 3am PST I think. But not every single night.
posted by drjimmy11 at 9:25 AM on April 29, 2009

Have you checked the BIOS? my last DELL system has a BIOS initiated scheduled Reboot/Shutdown/Restart option.
posted by jrishel at 9:39 AM on April 29, 2009

I'm voting for the Windows update explanation. Either that, or is it possible that you have another antivirus program running in addition to the AVG?
posted by The Light Fantastic at 9:40 AM on April 29, 2009

Another thought....have you tried to search for log files created at or around the time of the reboot? That may give you a hint.
posted by The Light Fantastic at 9:41 AM on April 29, 2009

Yes, I'm thirding/fourthing the problem being Windows Update. This happened to me awhile back after I got XP; I had some projects on the screen overnight and was mortified to find that they were gone the next morning due to an update reboot. Here's a thread of teed-off people discussing this.
posted by crapmatic at 9:48 AM on April 29, 2009

Have you tried setting the system clock to 4:25am and watching to see it it happens?

If its an anti-virus program or the like surely that would trigger it?
posted by chrispy108 at 9:49 AM on April 29, 2009

Is it possible that your company's IT department is initiating these reboots remotely?
posted by meowzilla at 9:53 AM on April 29, 2009

You can look at the system event viewer and it might let you know what's happening right before the restart.

Right click on "My Computer", then go to "Manage" and expand the Event logs at the top of the right column. You can get the exact time of the restart by looking at the timestamp on the system restart. If you can't see any system event that seems to be causing it, compare the timestamp to the application event log.
posted by camcgee at 10:36 AM on April 29, 2009

Is it possible that your company's IT department is initiating these reboots remotely?

Or that there's some kind of power cycle at your company every night?
posted by inigo2 at 10:59 AM on April 29, 2009

Use logmein or gotomypc to watch it shut down from your home computer. Actually, use gotoassist, they have a free trial and you can set it up as an "unattended support" computer so you can log in from home. Then you will be able to see what happens when it shuts down.

Another option is to get some sort of software that will take a screenshot every 10 seconds or so. Put the task manager in the screen so you can see which processes are running and then look through the screenshots for which programs did funny stuff right before the shutdown.

Probably it is being rebooted by the sysadmins. They do that where I work too, installing crazy updates and stuff and assuming that I won't mind if my computer is rebooted at 2am. When I need to run something all night I just unplug the Ethernet cable when I leave so that they can't do it unless they find my cube and physically plug it back in, which I'm betting they're too lazy to do.
posted by brenton at 11:49 AM on April 29, 2009

I would adjust the clock, as noted. I would also check the BIOS for any sort of auto reboot options. You should also view the system logs which should have a clue.
posted by chairface at 12:56 PM on April 29, 2009

As someone mentioned before, 9 times out of 10 there is some sort of notification present in the Windows Event Viewer when an automatic computer restart occurs.
posted by seppyk at 1:23 PM on April 29, 2009

If you can't figure out what's causing the problem, at least you can nullify it with shutdown guard.

A friend of mine has been using this on his machine (which receives faxes) which doesn't turn back on when it reboots (so if it reboots unattended he's screwed).

It works. It's light-weight.
posted by reddot at 1:26 PM on April 29, 2009

Can't you, um, just shut down your PC every night before you go home?
posted by exphysicist345 at 3:16 PM on April 29, 2009

WELL ... Thank you all.

It hadn't occurred to me to change the system time and just watch it. As it happens, it didn't work - but that was probably because I didn't reboot it myself with the new time set.

The system event log was funny - the last entry each night (at 04:30:14) was "closing event log" (or something like that).

The application event log was the one that solved the mystery. At 04:30:10 was the line "logmein initiating reboot".

Ah ha. logmein indeed.

It was my fault (I kinda knew that, but forgot what I did). logmein has a preferences/'reboot options'/'scheduled reboot' option. I must have set it - then forgot about it.

Solved.
Thank you all.

- Xhris

ps: the suggestion just to switch the PC off at night ... I took that as a brilliant piece of out-of-the-box thinking. Simple and 100% effective. Thank you.
posted by Xhris at 6:08 PM on April 29, 2009

Two other thoughts about this:

It could be a virus/malware, but I assume you have checked and you are up to date and recently scanned.

If you have an IT department that pushes updates to company machines at night try 'accidentally' knocking the network cable a out of the machine and see if that stops the problem.
posted by RobGF at 5:14 AM on April 30, 2009