Windows reboots when waking from sleep, after black screen and disk activity

Topic

New Reply

This seems to happen a couple times a week. I will put my computer to sleep, and when I wake it, it sits there with a black screen and a lot of disk activity for a minute or so. Then it reboots.

I wondered whether it was some kind of update. I have updates paused until 11/5 (3 days from now). When I look at the update history, I do see that there has been a Microsoft Defender Antivirus update today, but I don’t know what time. Is that what caused the activity and reboot? How can I track this down?

Reply | Quote

Replies

Rich,
?Are you sure you’re not trying to awaken it while the sleep process is still underway – or only if it’s been asleep for some time?
Zig

1 user thanked author for this post.

richw42

Reply | Quote

Try these NirSoft utilities to show any recent issues.

Turned on Times view
Last Activity view
Win Crash Report

cheers, Paul

1 user thanked author for this post.

richw42

Reply | Quote

When I look at the update history, I do see that there has been a Microsoft Defender Antivirus update today, but I don’t know what time. Is that what caused the activity and reboot? How can I track this down?

The date/time of each Microsoft Defender update is recorded in Reliability Monitor at Control Panel, Security and Maintenance, Maintenance, View reliability history:

How to View Reliability History in Windows 10 [TenForums.com]

1 user thanked author for this post.

richw42

Reply | Quote

1. This happens after the computer has been sleeping (supposedly) for some time.
2. Nirsoft has some interesting looking entries. I don’t know the timing of these entries vs. when I tried to wake the computer, so more information may be forthcoming the next time it happens. WinCrashReport has no entries.
   TurnedOnTimesView has an interesting entry…

   Startup Time Shutdown Time Last System Event Time Duration Shutdown Reason Shutdown Type Shutdown Process Shutdown Code Computer Name 11/2/2020 12:21:42 PM 11/2/2020 5:20:03 PM 04:58:21 Unexpected Shutdown 0x00000000 seven

   What I don’t know is whether this occurred anywhere near when the undesired reboot happened. I’ll take better records the next time this happens. LastActivityView shows around that time

   Action Time Description Filename Full Path More Information File Extension Data Source 11/2/2020 12:21:43 PM Run .EXE file TiWorker.exe C:\Windows\WinSxS\AMD64_MICROSOFT-WINDOWS-SERVICINGSTACK_31BF3856AD364E35_10.0.19041.504_NONE_E781E76525FB2269\TiWorker.exe Microsoft Corporation, Microsoft® Windows® Operating System, Windows Modules Installer Worker, 10.0.19041.504 (WinBuild.160101.0800) exe C:\WINDOWS\Prefetch\TIWORKER.EXE-E2D09FAD.pf 11/2/2020 12:21:42 PM Run .EXE file TRUSTEDINSTALLER.EXE C:\Windows\SERVICING\TRUSTEDINSTALLER.EXE Microsoft Corporation, Microsoft® Windows® Operating System, Windows Modules Installer, 10.0.19041.1 (WinBuild.160101.0800) EXE C:\WINDOWS\Prefetch\TRUSTEDINSTALLER.EXE-3CC531E5.pf 11/2/2020 12:21:42 PM Run .EXE file LULnchr.exe C:\Users\rw\AppData\Local\LOGITECH® WEBCAM SOFTWARE\Logishrd\LU2.0\LULnchr.exe Logitech, Inc., Logitech Updater (LU), Logitech Updater, 2.22.6.0 exe C:\WINDOWS\Prefetch\LULNCHR.EXE-E2FCA2A4.pf 11/2/2020 12:21:42 PM Run .EXE file SEARCHPROTOCOLHOST.EXE C:\Windows\System32\SEARCHPROTOCOLHOST.EXE Microsoft Corporation, Windows® Search, Microsoft Windows Search Protocol Host, 7.0.19041.488 (WinBuild.160101.0800) EXE C:\WINDOWS\Prefetch\SEARCHPROTOCOLHOST.EXE-0CB8CADE.pf 11/2/2020 12:21:42 PM Run .EXE file svchost.exe C:\Windows\System32\svchost.exe Microsoft Corporation, Microsoft® Windows® Operating System, Host Process for Windows Services, 10.0.19041.1 (WinBuild.160101.0800) exe C:\WINDOWS\Prefetch\SVCHOST.EXE-86AA6B35.pf 11/2/2020 12:21:42 PM Resumed from sleep 11/2/2020 12:21:41 PM Run .EXE file svchost.exe C:\Windows\System32\svchost.exe Microsoft Corporation, Microsoft® Windows® Operating System, Host Process for Windows Services, 10.0.19041.1 (WinBuild.160101.0800) exe C:\WINDOWS\Prefetch\SVCHOST.EXE-262D494C.pf 11/2/2020 12:21:41 PM Run .EXE file svchost.exe C:\Windows\System32\svchost.exe Microsoft Corporation, Microsoft® Windows® Operating System, Host Process for Windows Services, 10.0.19041.1 (WinBuild.160101.0800) exe C:\WINDOWS\Prefetch\SVCHOST.EXE-0D126A9F.pf 11/2/2020 12:21:41 PM Run .EXE file mobsync.exe C:\Windows\System32\mobsync.exe Microsoft Corporation, Microsoft® Windows® Operating System, Microsoft Sync Center, 10.0.19041.1 (WinBuild.160101.0800) exe C:\WINDOWS\Prefetch\MOBSYNC.EXE-C5E2284F.pf 11/2/2020 12:21:31 PM Run .EXE file G2MUPLOAD.EXE C:\Users\rw\AppData\Local\GOTOMEETING\18962\G2MUPLOAD.EXE LogMeIn, Inc., GoToMeeting, GoToMeeting, 10.14.0 Build 18962 EXE C:\WINDOWS\Prefetch\G2MUPLOAD.EXE-8C42B41F.pf

   Sorry, that’s really hard to read. GoToMeeting? What’s that doing there?
   I have a previous unexpected shutdown that looks different, so I’ll copy that too…

   Startup Time Shutdown Time Last System Event Time Duration Shutdown Reason Shutdown Type Shutdown Process Shutdown Code Computer Name 10/27/2020 9:55:06 AM 10/27/2020 5:03:55 PM 07:08:49 Unexpected Shutdown 0x00000000 seven

   And nearby activities

   Action Time Description Filename Full Path More Information File Extension Data Source 10/27/2020 9:55:26 AM Run .EXE file SIHCLIENT.EXE C:\WINDOWS\SYSTEM32\SIHCLIENT.EXE Microsoft Corporation, Microsoft® Windows® Operating System, SIH Client, 10.0.19041.1 (WinBuild.160101.0800) EXE C:\WINDOWS\Prefetch\SIHCLIENT.EXE-A872A8BF.pf 10/27/2020 9:55:06 AM Resumed from sleep 10/27/2020 9:54:56 AM Run .EXE file UPFC.EXE C:\WINDOWS\SYSTEM32\UPFC.EXE Microsoft Corporation, Microsoft® Windows® Operating System, Updateability From SCM, 10.0.19041.1 (WinBuild.160101.0800) EXE C:\WINDOWS\Prefetch\UPFC.EXE-BDDF79D6.pf

3. The next time it happens, I’ll check the antivirus update time.

Reply | Quote

P.S. The unexpected shutdowns are happening about once a week:

10/12 9:30 AM
10/19 9:05 AM
10/27 9:55 AM
11/2 12:21 PM

10/27 may have been delayed by a day since the computer was on all day 10/26 from 10:39 AM to 9:48 PM, so there wasn’t a wake from sleep until the next day.

Reply | Quote

Does the unexpected shutdown time coincide with the time you sleep or wake the machine?

Do you turn off / lose power after sleeping?

Laptop or desktop?

cheers, Paul

Reply | Quote

The unexpected shutdown can apparently occur near the sleep time or the wake time. The initial post was about wake time; today’s experience was near sleep time.
I have no reason to think there have been any power disturbances.
This is a desktop. Put together by me, originally windows 7 pro and upgraded and expanded. So likely still Win7 junk hanging around.

Reply | Quote

Somewhat regular. Maybe some task that is scheduled weekly? Which obviously can’t run while the machine is not on, but will trigger asap when it is? Which needle in this haystack?

Reply | Quote

It’s getting more interesting. Last night, when I put the computer to sleep, I noticed that it took a long time (one minute?) to go to sleep. I didn’t notice whether the power  LED was blinking. But this morning, it wasn’t, and it was a normal cold boot.

TurnedOnTimesView shows the unexpected shutdown last night at 5:09. And a normal startup this morning. LastActivityView shows a bunch of stuff several minutes after that time. MemoryDiagnostic.dll? cleanmgr.exe? LanguageComponentInstaller.dll? I’ll paste all that below. WinCrashReport still shows nothing. And look below this stuff for another possible hint.

Startup Time Shutdown Time Last System Event Time Duration Shutdown Reason Shutdown Type Shutdown Process Shutdown Code Computer Name
11/3/2020 9:43:25 AM 11/3/2020 5:09:01 PM 07:25:36 Unexpected Shutdown 0x00000000 seven
11/4/2020 8:30:28 AM 00:06:18 0x00000000 seven

 

Action Time Description Filename Full Path More Information File Extension Data Source
11/4/2020 8:30:27 AM User Logon WORKGROUP\UMFD-0
11/3/2020 5:19:05 PM Task Run LanguageComponentsInstaller.dll C:\Windows\System32\LanguageComponentsInstaller.dll Installation, \Microsoft\Windows\LanguageComponentsInstaller\Installation dll
11/3/2020 5:19:05 PM Task Run MemoryDiagnostic.dll C:\WINDOWS\System32\MemoryDiagnostic.dll RunFullMemoryDiagnostic, \Microsoft\Windows\MemoryDiagnostic\RunFullMemoryDiagnostic dll
11/3/2020 5:19:05 PM Task Run cleanmgr.exe C:\WINDOWS\system32\cleanmgr.exe SilentCleanup, \Microsoft\Windows\DiskCleanup\SilentCleanup exe
11/3/2020 5:19:05 PM Task Run MemoryDiagnostic.dll C:\WINDOWS\System32\MemoryDiagnostic.dll ProcessMemoryDiagnosticEvents, \Microsoft\Windows\MemoryDiagnostic\ProcessMemoryDiagnosticEvents dll
11/3/2020 5:16:44 PM Run .EXE file chrome.exe C:\PROGRAM FILES (X86)\Google\Chrome\APPLICATION\chrome.exe Google LLC, Google Chrome, Google Chrome, 86.0.4240.183 exe C:\WINDOWS\Prefetch\CHROME.EXE-D999B1C2.pf
11/3/2020 5:14:07 PM Run .EXE file chrome.exe C:\PROGRAM FILES (X86)\Google\Chrome\APPLICATION\chrome.exe Google LLC, Google Chrome, Google Chrome, 86.0.4240.183 exe C:\WINDOWS\Prefetch\CHROME.EXE-D999B1BB.pf
11/3/2020 5:09:45 PM Run .EXE file WmiPrvSE.exe C:\Windows\System32\wbem\WmiPrvSE.exe Microsoft Corporation, Microsoft® Windows® Operating System, WMI Provider Host, 10.0.19041.1 (WinBuild.160101.0800) exe C:\WINDOWS\Prefetch\WMIPRVSE.EXE-1628051C.pf
11/3/2020 5:09:00 PM Run .EXE file chrome.exe C:\PROGRAM FILES (X86)\Google\Chrome\APPLICATION\chrome.exe Google LLC, Google Chrome, Google Chrome, 86.0.4240.183 exe C:\WINDOWS\Prefetch\CHROME.EXE-D999B1BB.pf
11/3/2020 5:04:07 PM Run .EXE file chrome.exe C:\PROGRAM FILES (X86)\Google\Chrome\APPLICATION\chrome.exe Google LLC, Google Chrome, Google Chrome, 86.0.4240.183 exe C:\WINDOWS\Prefetch\CHROME.EXE-D999B1BB.pf

I just found something interesting in the task scheduler. Every Sunday at 1:38 AM, start the program c:\Program Files\Microsoft Security Client\MpCmdRun.exe Scan -Schedule -RestrictPrivileges. Result: The system cannot find the file specified. Last run 11/1/2020 11:54:46 AM I presume this is a leftover (from as long ago as Windows 7) and should be deleted.

And why can’t I copy/paste from windows dialogs like the Task Scheduler?

Reply | Quote

When your computer sleeps it stays powered on, in a low power state and the power light should blink.
If you turn it on and it cold boots, something failed / turned off the power.

Does it ever return from sleep (blinking power LED) correctly?

cheers, Paul

Reply | Quote

It will usually return from sleep correctly.

Reply | Quote

richw42 wrote:

MpCmdRun.exe… I presume this is a leftover (from as long ago as Windows 7) and should be deleted.

This is the scheduled scan with Windows Defender. It should be a task under Microsoft\Windows\Windows Defender

richw42 wrote:

It will usually return from sleep correctly

Something is failing / crashing to cause the power off.

Do you leave it longer than usual between shutdown and restart?

Maybe a schedule task attempts to start the machine and fails.
Use this command to see what is set to wake the machine.
1. Open an admin Command Prompt.
2. Type: powercfg -waketimers

You could try hibernating instead of sleeping. This will test the wake up theory because power is off after hibernation.

cheers, Paul

Reply | Quote

Summary: I think it’s an old driver crashing the system.

I just learned about a new tool: Reliability Monitor. [perfmon /rel]
It shows me the unexpected shutdowns, but gives more information.

Problem signature
Problem Event Name: BlueScreen
Code: 3b
Parameter 1: c0000005
Parameter 2: fffff80570a8be50
Parameter 3: ffffc102aaadea30
Parameter 4: 0
OS version: 10_0_19041
Service Pack: 0_0
Product: 256_1
OS Version: 10.0.19041.2.0.0.256.48
Locale ID: 1033

And along with the unexpected shutdown, I see “Windows stopped working”, Description

The computer has rebooted from a bugcheck. The bugcheck was: 0x0000003b (0x00000000c0000005, 0xfffff80570a8be50, 0xffffc102aaadea30, 0x0000000000000000). A dump was saved in: C:\WINDOWS\MEMORY.DMP. Report Id: d86b49f0-27e3-47aa-b6ef-b25f024d4ab1.

I followed https://www.instructables.com/How-to-Analyze-a-BSOD-Crash-Dump/ to analyze MEMORY.DMP. It looks like it has something to do with MAudioDelta.sys, which I presume is the driver for my M-Audio Delta 1010LT sound card. There are seven files with that name on my system, but the newest one is dated 2012 I presume I’m lucky that it works at all.

I’ve attached the analysis file from MEMORY.DMP in case anyone is curious or can glean any extra information from it.

 

 

Reply | Quote

Not sure if this is related in any way, but when I put computer (Windows 10 Pro Version 1909 (OS Build 18363,11,39) to sleep using short cut

C:\Windows\System32\rundll32.exe powrprof.dll,SetSuspendState 0,1,0

The machine powers down and goes to sleep but wakes up again immediately.  This has just started in the past couple of weeks.  Sometimes it does appear to sleep but will not start again until the power is switched off and then pressing the start button brings it up from sleep as normal.  Any suggestions gratefully received.

Reply | Quote

Any information from the utilities mentioned above?

Try running Performance Monitor (Win R, perfmon /rel, Enter). See if it shows any errors.

cheers, Paul

Reply | Quote

Thank you for rapid response.

Attached is screen print of performance monitor.

Reply | Quote

stisvc.exe is an executable which is installed by Windows together with digital cameras, scanners or another graphical input devices.

Do you have any recently installed devices?

Is there any info about the restart from the nirsoft utils?

cheers, Paul

Reply | Quote

richw42 wrote:

It looks like it has something to do with MAudioDelta.sys, which I presume is the driver for my M-Audio Delta 1010LT sound card. There are seven files with that name on my system, but the newest one is dated 2012 I presume I’m lucky that it works at all.

I would temporarily uninstall that M-Audio card as a test to see if your system functions normally without it. That is an old hardware device that has not seen a driver update in 8 years.

I say that as a former M-Audio user that was having issues with sleep that occasionally resulted in resuming from sleep with a BSOD that pointed to my M-Audio driver. When M-Audio was acquired by inMusic in 2012 there were no more driver updates for the legacy devices. So if yours worked on Win 10 you were lucky. As was I. But the BSODs eventually got annoying. I have retired my M-Audio and replaced it with a modern USB 2 audio interface.

PC is sleeping like a baby now, and wakes without a fuss anytime that I need it to.

Windows 10 Pro 22H2

Reply | Quote

[satrow]

Edited to add that “the Reply to which this one was made has been trashed, bad advice and backed up by an untrustworthy source”.

Sorry but that article doesn’t read well to me, you may have skipped some important phrases as well. It’s a little over half-baked and about as much is confusing, some of those ‘facts’ might have come from 3-4 revisions (0.5-2 decades) ago (MS has been known to make blind guesses as well).

Virtual memory acts as RAM when the latter is full, thus freeing up space and improving the system’s performance.

If you are noticing a certain lag when running high-end applications or games, it could be that the RAM is full.

Also, it’s important to mention that Windows can, on its own, take care of the virtual memory or page file.

Your RAM isn’t full at 33%. To a great extent, Windows can manage the page file size quite well.

I suggest you had other issues, or maybe just trying to ruin Christmas.

• This reply was modified 1 year, 5 months ago by satrow. Reason: Trashed the comment replied to

1 user thanked author for this post.

PKCano

Reply | Quote