Tell me more ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.
up vote 1 down vote favorite

I use KDE on a Debian-based Linux distro. I run Windows 7 in a virtual machine on a secondary desktop. Often times during the day, I hear the Windows startup sound. I would like to know why Windows just reset itself. I use the VM mostly for software development, other than MS Security Essentials, Firefox, Anki, and Visual Studio there are no other software installed on the machine.

Is there some sort of log that I might check to see why the latest reset was performed? The VM is connected to the internet so System Updates are possible, but I find malware to be extremely unlikely.

EDIT: Looking in the system log, there is no log entry for the shutdown. Only after the restart does this appear in the System Log:

The previous system shutdown at 11:17:48 AM on ‎5/‎18/‎2012 was unexpected.

The entries prior to that are dated about a quarter of an hour earlier, when I turn on the VM. So whatever is causing the reset is not giving the OS time to write to the logs. I would suspect the power, but this is a virtual machine!

share|improve this question
1  
It sounds like the Windows is attempting to place the "machine" to sleep. If it is connected to the internet then malware is as likely as any other vulerable computer with access to the internet. – Ramhound May 15 '12 at 16:31

2 Answers

up vote 1 down vote accepted

It's probably just downloading and installing updates, Windows does this by default. If you check the Event Viewer system log (eventvwr.msc) and filter by event 6006 (last log before shutdown/sleep/reboot), you should be able to look at times just before this gets logged to figure out what was going on. Also automatic updates logs event 18, you can just look for event 18's then check to see if it reboots afterwards.

If it is automatic updates causing reboots, you can change times and settings in Control Panel>Windows Updates>Change Settings.

share|improve this answer
EventID 6006 is just the event log service stopping. Event 1074 (source USER32) is the one that actually provides information about what initiated the shutdown or restart and why. – Indrek May 15 '12 at 16:43
@Indrek Your assuming it was shutdown or restarted. Event 6006 shows right after the reboot/shutdown event and after the Hibernate/sleep event. He's not even sure if it's actually shutting down, so this should cover all possibilities for now. I'll update the answer with that info later if it turns out it was a shutdown/reboot. – Kyle May 15 '12 at 16:51
Fair enough. Though the OP mentions "reset" several times, which would seem to point to a restart. Also, I'm pretty sure the Windows startup sound doesn't play when the computer resumes from sleep or hibernation. – Indrek May 15 '12 at 17:02
Thanks. It looks like the whole 6000 block is what I need to look for to diagnose. Looking at the 1074 codes I see that sometimes winlogin.exe and sometimes EXPLORER.exe initialise the shutdown. – dotancohen May 17 '12 at 12:51
Thanks, Kyle, I have now updated the question with information from the log. – dotancohen May 18 '12 at 8:32
show 1 more comment
up vote 2 down vote

Multiple restarts each day are hardly caused by Windows Update or Microsoft Update as there are usually updates only once each month. Check you event log for any hints related to the restarts by looking at the timestamps just before the restart happened. Probably the most likely cause is a Blue Screen of Death.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.