1

Recently (over the last week or so), my computer will be working fine, then all of a sudden the screen flashes (red, maybe yellow, difficult to tell because it's extremely brief) and the machine reboots.

Occasionally this is accompanied by all temporary files everywhere, including browser cookies and Start Menu jumplists, to be deleted.

From the System Event Log:

Event 6008, EventLog: The previous system shutdown at 05:44:33 on ‎27/‎09/‎2011 was unexpected.
Event 41, Kernel-Power: The system has rebooted without cleanly shutting down first. This error could be caused if the system stopped responding, crashed, or lost power unexpectedly.

Then there's all the usual start-up events. There are no events anywhere logged at or near the shutdown time.

The system's not overheating, the power supply is there (and it's a laptop so there's a battery too), everything was working just fine beforehand, and as far as I recall I haven't installed anything new in months. I can't work out what's happening and why, so can anyone help me track the cause?

System information:
Alienware M17X10
8.00GB of RAM
64-bit Windows Home Premium
Just under a year old
Intel Core i7 CPU, Q840 @ 1.87GHz 1.86GHz


Five events before the Event 41:
File System Filter 'FPAV_RTP' (6.0, ‎2010‎-‎09‎-‎22T13:47:28.000000000Z) has successfully loaded and registered with Filter Manager. at 05:45:01

File System Filter 'FileInfo' (6.1, ‎2009‎-‎07‎-‎14T00:34:25.000000000Z) has successfully loaded and registered with Filter Manager. at 05:44:58

The operating system started at system time ‎2011‎-‎09‎-‎27T04:44:56.610798500Z. at 05:44:57

The Application Experience service entered the stopped state. at 05:29:16 (note 15-minute gap)

The Microsoft Software Shadow Copy Provider service entered the stopped state. at 05:06:58

0

3 Answers 3

1

Use Bluescreen View to see if any crash dumps were created during that time frame. There may be a clue to what system file or driver is causing it.

What are the 5 event viewer entries just before 05:44:33 They don't have to be real close in time to show what might be going on.

Microsoft page for debugging dump files see this page.

Advanced debugging Here and Here

9
  • Added the five events to the post. Sep 27, 2011 at 5:10
  • Bluescreen View is showing usbport.sys, usbehci.sys and ntoskrnl.sys in red. I've found the first two through Device Manager and checked them for updates, but apparently they're up-to-date. I can't find the last one. Sep 27, 2011 at 5:18
  • What is the date of the dump file? Does it match the date of the restart? If so you most likely have a usb device causing the restart. ntoskrl is a Windows system file, not a driver.
    – Moab
    Sep 27, 2011 at 5:51
  • The dump file is from the last time the reboot happened. There don't appear to be dump files for any other times it has happened. The only USB device currently connected is my Alienware TactX mouse. I just noticed I last installed Windows updates 6 months ago (oops), so I'll install those and see if that solves the problem. Sep 27, 2011 at 5:52
  • Check my edited post, I was not correct on which events I wanted, go by the timestamp not the event 41
    – Moab
    Sep 27, 2011 at 5:53
1

Moab's suggestions for diagnosing bits left behind is a good one to start with. If that doesn't pan out, you might try running workloads to see if you can trigger the problem more directly (e.g. run a memory test, or run a benchmark workload against the CPU/memory/Video or disk). If some particular test makes the problem happen more often, that may help narrow the cause down a bit.

0

One of the drivers if of F-PROT Antivirus and there is - according to my knowledge - a newer version of the driver available. It might resolve the issue.

Since your comments suggest, though, that this could be related to a USB driver, I would like to point out that sometimes internal devices such as webcams can also be connected via the USB bus even without you realizing.

However, if this is a hardware cause, it is likely that the dump will point "fingers" to some scape goat instead of the real culprit. More important than the drivers on the stack would in this case be the bugcheck code.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .