Is my computer constantly restarting on its own a sign of a bigger problem?

[yungman]

My laptop restarts on it's own more and more often. At first I thought it's because of Windows updates or Norton updates that did that. But it's been like every other day and right in the middle of me typing in a message on different forums.

Is my computer dying, what can I do?

Another thing is the wireless connection sometimes when I just unplug the power and go onto battery. Sometimes, I can go through the troubleshooting manual and fix it. One time I had to bring the computer back to a previous day to fix it.

It sounds like it's all software, but it keep happening. What can I do?

Thanks.

 

[AlephZero]

You could try this, to see if it locates the problem. http://www.resplendence.com/whocrashed

If you already have crash dumps enabled, whocrashed will try to look at them all. This can get confusing, if some of the crashes had different causes. It might be worth deleting all the existing crash dumps and then run whocrashed after the next crash. Search for a directory with lots of .dmp files that have date and time stamps matching the crashes., and delete them.

"Random" crashes can also be caused by intermittent hardware problems with power supplies or batteries, overheating (fans blocked with dust, etc), memory and disk drive errors, etc. Those can be the hardest ones to nail down.

 

[yungman]

Thanks for the link, I downloaded and ran the program. It said I had 4 crashes in the past but all in a few months ago. Nothing about the last 3 times that happened lately. In fact, there is none reported in April.

The crash is very funny, it restarted and it will go back to where it left off in Internet Explorer. For Firefox, if I click the Firefox, it will load up everything where I left off before it crash. One time even the blog I was in the middle of typing when it restarted came back and I can continue typing.

It really felt like Windows or Norton did an update and require restart. But usually, it will ask me first before restarting.

 

[Mark44]

You might try looking at the events that Windows records. Whenever one of my computer does something strange, I check Event Viewer to see if I can see what caused it.

To start Event Viewer,
1. Click the Start menu.
2. Click Run.
3. In the Run window, type eventvwr and hit Enter.

When Event Viewer opens, expand Windows Logs.
Any events that were generated will be under either System or Application, depending on whether the OS or an application generated them.

There will likely be lots and lots of events in either category. Most will be Informational events (icon is a white circle with the letter "i" inside). Some will be warnings (yellow triangle with "!"). The ones to look at first are the actual errors (red circle with "!" inside).

If there is something going on with your computer, the errors and warnings can offer a clue as to what's going on.

 

[yungman]

You might try looking at the events that Windows records. Whenever one of my computer does something strange, I check Event Viewer to see if I can see what caused it.

To start Event Viewer,
1. Click the Start menu.
2. Click Run.
3. In the Run window, type eventvwr and hit Enter.

When Event Viewer opens, expand Windows Logs.
Any events that were generated will be under either System or Application, depending on whether the OS or an application generated them.

There will likely be lots and lots of events in either category. Most will be Informational events (icon is a white circle with the letter "i" inside). Some will be warnings (yellow triangle with "!"). The ones to look at first are the actual errors (red circle with "!" inside).

If there is something going on with your computer, the errors and warnings can offer a clue as to what's going on.

I followed your instruction. I only see "Applications and Service log". I gone through Hardware, Internet Explorer, Key Management Service... There is no event!

I looked under Administrative Events, the error closest to the time of reboot is:

Source: NetBT, and EventID: 4311

The general description is:
Initialization failed because the driver device could not be created. Use the string "78ACC044DD10" to identify the interface for which initialization failed. It represents the MAC address of the failed interface or the Globally Unique Interface Identifier (GUID) if NetBT was unable to map from GUID to MAC address. If neither the MAC address nor the GUID were available, the string represents a cluster device name.

I have no idea what this mean.

 

[Mark44]

When I open Event Viewer (I'm running Windows 7), in the pane at the left I see

Event Viewer (Local)
--Custom Views
--Windows Logs
--Applications and Services Logs
--Subscriptions

What I described in my previous post pertains to Windows Logs, the second item in the list. Don't you see that one?

BTW, what OS are you running?

 

[yungman]

When I open Event Viewer (I'm running Windows 7), in the pane at the left I see

Event Viewer (Local)
--Custom Views
--Windows Logs
--Applications and Services Logs
--Subscriptions

What I described in my previous post pertains to Windows Logs, the second item in the list. Don't you see that one?

BTW, what OS are you running?

Thanks, I have Windows 7 Professional. This is from Windows Logs/System. These are the two events in question:
(1) on 4/9/14

Log Name: System
Source: Service Control Manager
Date: 4/9/2014 9:45:42 AM
Event ID: 7000
Task Category: None
Level: Error
Keywords: Classic
User: N/A
Computer: Bo-PC
Description:
The Crypkey License service failed to start due to the following error:
The system cannot find the file specified.
Event Xml:
<Event xmlns="[PLAIN][PLAIN]http://schemas.microsoft.com/win/2004/08/events/event"> [/PLAIN] [/PLAIN] [/PLAIN] [/PLAIN]
<System>
<Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
<EventID Qualifiers="49152">7000</EventID>
<Version>0</Version>
<Level>2</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x8080000000000000</Keywords>
<TimeCreated SystemTime="2014-04-09T16:45:42.230906700Z" />
<EventRecordID>163973</EventRecordID>
<Correlation />
<Execution ProcessID="612" ThreadID="616" />
<Channel>System</Channel>
<Computer>Bo-PC</Computer>
<Security />
</System>
<EventData>
<Data Name="param1">Crypkey License</Data>
<Data Name="param2">%%2</Data>
</EventData>
</Event>

AND in the same time
Log Name: System
Source: Service Control Manager
Date: 4/9/2014 9:45:52 AM
Event ID: 7026
Task Category: None
Level: Error
Keywords: Classic
User: N/A
Computer: Bo-PC
Description:
The following boot-start or system-start driver(s) failed to load:
NetworkX
Event Xml:
<Event xmlns="[PLAIN][PLAIN]http://schemas.microsoft.com/win/2004/08/events/event"> [/PLAIN] [/PLAIN] [/PLAIN] [/PLAIN]
<System>
<Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
<EventID Qualifiers="49152">7026</EventID>
<Version>0</Version>
<Level>2</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x8080000000000000</Keywords>
<TimeCreated SystemTime="2014-04-09T16:45:52.152524100Z" />
<EventRecordID>163995</EventRecordID>
<Correlation />
<Execution ProcessID="612" ThreadID="616" />
<Channel>System</Channel>
<Computer>Bo-PC</Computer>
<Security />
</System>
<EventData>
<Data Name="param1">
NetworkX</Data>
</EventData>
</Event>

(2) on 4/10/14
Log Name: System
Source: NetBT
Date: 4/10/2014 9:39:20 AM
Event ID: 4311
Task Category: None
Level: Error
Keywords: Classic
User: N/A
Computer: Bo-PC
Description:
Initialization failed because the driver device could not be created. Use the string "78ACC044DD10" to identify the interface for which initialization failed. It represents the MAC address of the failed interface or the Globally Unique Interface Identifier (GUID) if NetBT was unable to map from GUID to MAC address. If neither the MAC address nor the GUID were available, the string represents a cluster device name.
Event Xml:
<Event xmlns="[PLAIN][PLAIN]http://schemas.microsoft.com/win/2004/08/events/event"> [/PLAIN] [/PLAIN] [/PLAIN] [/PLAIN]
<System>
<Provider Name="NetBT" />
<EventID Qualifiers="49152">4311</EventID>
<Level>2</Level>
<Task>0</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2014-04-10T16:39:20.094548800Z" />
<EventRecordID>164184</EventRecordID>
<Channel>System</Channel>
<Computer>Bo-PC</Computer>
<Security />
</System>
<EventData>
<Data>
</Data>
<Data>78ACC044DD10</Data>
<Binary>000000000200320000000000D71000C013010000250200C000000000000000000000000000000000</Binary>
</EventData>
</Event>

Do you know what that means?

In the Windows Logs/Applications there are only "Warning" in that time frame. No error.

(1) on 4/9/14
Log Name: Application
Source: Microsoft-Windows-User Profiles Service
Date: 4/9/2014 9:43:57 AM
Event ID: 1530
Task Category: None
Level: Warning
Keywords:
User: SYSTEM
Computer: Bo-PC
Description:
Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards.

DETAIL -
7 user registry handles leaked from \Registry\User\S-1-5-21-914397508-3380542701-1707591768-1001:
Process 6528 (\Device\HarddiskVolume2\Program Files (x86)\Norton 360 Premier Edition\Engine\20.4.0.40\ccSvcHst.exe) has opened key \REGISTRY\USER\S-1-5-21-914397508-3380542701-1707591768-1001
Process 668 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-914397508-3380542701-1707591768-1001\Software\Microsoft\Internet Explorer\Main
Process 668 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-914397508-3380542701-1707591768-1001\Software
Process 668 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-914397508-3380542701-1707591768-1001\Software\Policies
Process 668 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-914397508-3380542701-1707591768-1001\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings
Process 668 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-914397508-3380542701-1707591768-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Process 668 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-914397508-3380542701-1707591768-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings

Event Xml:
<Event xmlns="[PLAIN][PLAIN]http://schemas.microsoft.com/win/2004/08/events/event"> [/PLAIN] [/PLAIN] [/PLAIN] [/PLAIN]
<System>
<Provider Name="Microsoft-Windows-User Profiles Service" Guid="{89B1E9F0-5AFF-44A6-9B44-0A07A7CE5845}" />
<EventID>1530</EventID>
<Version>0</Version>
<Level>3</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x8000000000000000</Keywords>
<TimeCreated SystemTime="2014-04-09T16:43:57.292562500Z" />
<EventRecordID>18302</EventRecordID>
<Correlation />
<Execution ProcessID="968" ThreadID="13348" />
<Channel>Application</Channel>
<Computer>Bo-PC</Computer>
<Security UserID="S-1-5-18" />
</System>
<EventData Name="EVENT_HIVE_LEAK">
<Data Name="Detail">7 user registry handles leaked from \Registry\User\S-1-5-21-914397508-3380542701-1707591768-1001:
Process 6528 (\Device\HarddiskVolume2\Program Files (x86)\Norton 360 Premier Edition\Engine\20.4.0.40\ccSvcHst.exe) has opened key \REGISTRY\USER\S-1-5-21-914397508-3380542701-1707591768-1001
Process 668 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-914397508-3380542701-1707591768-1001\Software\Microsoft\Internet Explorer\Main
Process 668 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-914397508-3380542701-1707591768-1001\Software
Process 668 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-914397508-3380542701-1707591768-1001\Software\Policies
Process 668 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-914397508-3380542701-1707591768-1001\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings
Process 668 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-914397508-3380542701-1707591768-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Process 668 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-914397508-3380542701-1707591768-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings
</Data>
</EventData>
</Event>

(2) on 4/10/14
Log Name: Application
Source: LMS
Date: 4/9/2014 9:45:45 AM
Event ID: 1
Task Category: None
Level: Warning
Keywords: Classic
User: SYSTEM
Computer: Bo-PC
Description:
LMS Service cannot connect to Intel(R) MEI driver
Event Xml:
<Event xmlns="[PLAIN][PLAIN]http://schemas.microsoft.com/win/2004/08/events/event"> [/PLAIN] [/PLAIN] [/PLAIN] [/PLAIN]
<System>
<Provider Name="LMS" />
<EventID Qualifiers="32768">1</EventID>
<Level>3</Level>
<Task>0</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2014-04-09T16:45:45.000000000Z" />
<EventRecordID>18310</EventRecordID>
<Channel>Application</Channel>
<Computer>Bo-PC</Computer>
<Security UserID="S-1-5-18" />
</System>
<EventData>
<Data>LMS Service cannot connect to Intel(R) MEI driver</Data>
</EventData>
</Event>

Thanks

 

[Mark44]

I would start by doing a web search using the event ID for each of the system errors you listed. I had to do this last week after my computer crashed. From the event log I was able to determine that I didn't have my wireless network set up correctly. I was also getting an error that I can safely ignore, according to what I read on a Microsoft site.

The first two errors you list have event IDs of 7000 and 7026. I would use a search string (on Google or whatever) of "win 7 eventid 7000" for the first and a similar search string for the other one.

Good luck!

 

[Routaran]

Hey Youngman,
None of the errors you listed seem like they are anything critical that would cause the system to shutdown.

I'm just going to get you to re-do some steps that Mark44 did but I'll post some screenshots from my system so you know exactly what I am getting at.

First do this
Click Start> Right click computer> Select manage (This will open the Computer Management window)> Select event viewer> Windows logs> System

This is where windows logs the major errors like those that cause the system to crash.

Second, there's a lot of information we don't need here. Let's filter it.
Filter Current log...> Place checkmarks on Critical & Error> Click OK

Now we only see the major and critical errors on the system

Here's an example from my computer's logs. I'm looking back in Oct of last year, that's where I have some interesting errors. You will need to patiently go through this list. Windows corrects and logs plenty of errors that you never even knew happened. Start with the newest errors and work your way down.
The important bits of information here are the Source and Event ID, this will help is figure out what is going on.

Now what you have to do is go to
http://eventid.net/
This website is a good source to get an idea of what each entry listed here means and maybe get some help on resolving the issue

I selected the disk error I had. I type in the source and event ID and then click search. Then click on the "Comments and links for eventID from source" link and see what people have to say about it.

One more thing, have you flipped it around and touched the back panel to see how hot it feels? Since you're using a notebook computer here, there's a good chance that heat may be the problem. Most, if not all, newer computers come with a failsafe that kills the system if it reaches a specific temp threshold. Generally no user warnings. CPU hits 75C for example and poof! computer off.
If your computer is shutting down due to overheating, then the back will feel unusually warm. In this case, it's time to get a couple cans of compressed air, take the back pannel off and cleaning the dust. Also never use a "laptop" on your lap or anything else soft. You will block the air vents and nothing quite kills the lifespan of a computer like heat. (this is why I call them notebooks) Always use it on a hard surface like a table.

Hope this helps!

Cheers

 

[harborsparrow]

IF you are using Windows...

One reason a computer might reboot like that is if it does not have enough free disk space and the (invisible to most users) swap file grows to be too large for the available space. This is plausible on an older system where the disk was not huge, but unlikely on most newer systems. It would happen when you have a lot of programs open at the same time, which would cause the swap file on the disk to get large due to paging out of inactive parts of programs not actively being used.

If that were the case, freeing up more disk space would be good, or running only one or two programs at a time.

 

[enorbet]

Greetings
Before you get involved in the sometimes round-robin software fixes, please note that by far the number one reason for spurious reboots on many laptops is heat. Are you running any software like SpeedFan that outputs sensor data monitoring temperatures? or can you feel that your system is hot if you actually put it in your lap?

Often for the price of a can of compressed air and a few minutes you can at least improve this, if your laptop runs hotter than it used to. If it has always run hot there are often fixes for that, some hardware some software, but those will depend somewhat on your tools and skill levels.

If you don't have sensor monitors running it would be a good starting point to get one and post your temps and laptop brand and model here.

 

[Mordred]

There is one simple step you can also try, in my experience I've seen numerous computers crash for the simple reason of overheating. Try cleaning your CPU fan, power supply fan and video card fan if you have one. You can also try running it with the case off the PC with a house fan blowing air on it. Helps identify a slow CPU fan that is worn out. Its a simple preventative maintenance step that should be performed regularly and may or may not help. However at least you've narrowed out that possibility. Oft times erroneous errors can lead you down the garden path looking through software to figure it out. Overheating can lead to numerous false symptoms

edit I just noticed the above post

 

[enorbet]

Well it appears OPs laptop was either fixed or the component damaged by excessive heat finally "let the smoke out" since he hasn't responded in over a month. I hope it was the former. To anyone reading this thread with a similar problem - Do yourself a favor and monitor temps. There are many apps that do this. SpeedFan is just one good one.

 

[Chronos]

Go to taskmaster [alt-del] and see if you have any unfamiliar apps or processes running. You may be hijacked by a bug. The lazy fix is use system restore to a point that predates the problems you are having.