3

Just 15 minutes ago, while on Windows 7, my desktop unexpectedly initiated a shutdown (Word prompted me to save my document, the Force Shutdown dialog came up), but I had not initiated any form of shutdown, and neither was Windows Update prompting an update.

Before I could save my Word doc, the computer just totally shut off, unlike what would have happened for a normal Windows shutdown. I couldn't start the computer again (sometimes not making past POST, sometimes beeping and immediately dying) despite multiple tries (switching the mains off and on), until I disconnected the network cable - which started my suspicions.

Went straight into UEFI BIOS, CPU temps look OK (at 41 deg C), which means overheating should be ruled out.

Started Windows, went into Event Viewer, couldn't find any Shutdown events under Windows Logs > System at all, except those like "The previous shutdown was unexpected".

This is really very creepy..... I immediately suspected remote shutdown via network, but because this is a home network and everyone else is asleep, it could be possible that someone initiated a shutdown remotely through my Dynamic DNS address.... Immediately disabled them too.

I need some advice and ideas for what else could have caused this, and how should I go about trying to find out the trigger for the last shutdown.

Thanks very much... I'm trying to see if I got inadvertently hacked (even though I consider myself rather good around computers), or was it a hardware/software fault which can be rectified (thus eliminating a larger part of my worries). I'm not too sure if my network is secure or not though, and that could have been the reason for allowing a hack through, even though I'm on a shared dynamic IP provided by ISP.


Specs if you are curious:

  • Gigabyte Z97-D3H
  • Intel i7-4790
  • G.skill 4x 4GB 2133MHz
  • Sapphire R9-280X

I guess the rest shouldn't matter.

  • 3
    how would the presence of the network cable effect general Post? even if some wild hack was proceeding down that line which isnt very likely when at that point you probably dont have addresses and all, any crasy hacking or data could point to. If that occured more than a few times that the network cable itself is the actual cause of it not posting, I would suspect a (wacked out) flow of power comming from one device to another. Rare but not unheard of for some power wiring to be grounding or touching wrong things. But your 15 minutes, you have as of yet to get into any discoveries. – Psycogeek Jul 18 '15 at 23:42
  • 3
    You can't rule out overheating as the problem because after several failed reboots the CPU temperature was normal. That's more than enough time for it to cool down. My bet is that the problem was a stuck CPU fan that became unstuck after bumping the case while removing the network cable. – Ross Ridge Jul 19 '15 at 2:00
  • Sounds like a heat problem to me as well. If you can reproduce "no problems without the network cable, problems as soon as the network is connected", i'd check the grounding; this might be a potential on the network affecting the hardware. Unlikely as this may seem, I learned it's not impossible when I got a strong jolt one day touching the shield of the network cable and the computer at a customer who had network problems. – Guntram Blohm supports Monica Jul 19 '15 at 8:06
  • @GuntramBlohm I couldn't reproduce issues when I reconnected the network cable after my computer managed to boot. It's been running fine ever since. I'll be still getting a new router as I suspect it may be the problem Psycogeek mentioned, about power flow. – Irvin Lim Jul 19 '15 at 8:10
  • 1
    The CPU's heat sink and fan are designed to remove a lot of heat quickly. If my guess was right and it was a stuck fan, it would have taken only a few seconds for the CPU to cool down to normal temperatures once the fan started working again. There would have been some sort of event generated about the shutdown, whatever the cause, when you saw it start to shutdown normally. This event was apparently lost when the computer then suddenly just turned itself off. – Ross Ridge Jul 19 '15 at 14:21
10

You wrote "I couldn't start the computer again (sometimes not making past POST, sometimes beeping and immediately dying)". If the system was failing to make it past the power-on self-test (POST) that can be an indication of a hardware problem. Without a Post card to show the POST codes, the sequence of beeps can indicate the cause of the problem - see Post beep codes.

Admittedly, it does seem odd that you were unable to boot the system until you removed the network cable, but you might have a hardware problem that is intermittent and it may only be coincidental that the system rebooted after you disconnected that cable. E.g., see some of the replies to Windows 7 - 64 Computer shuts off unexpectedly on possible hardware issues and ways you can test your hardware.

A power supply tester is nice to have to check the power supply, but I will presume you don't have one of those handy. You can run a memory test with a number of free tools, though, to check whether the issue could be with RAM, though sometimes a flaky power supply can cause memory tests to fail. Some free memory test tools you could use:

MemTest86

memtest86+

DocMemory - you will have to register to download the free memory diagnostic utility

You can also find memtest86 and memtest86+ as well as other memory diagnostic utilities and other test tools on the Ultimate Boot CD.

The way these utilities usually work is that you create a bootable CD, usually from an ISO file. If you don't have a utility to burn an ISO file to a CD/DVD to create a bootable CD/DVD, there are a number of utilities to do so. Note: you can't just put the file on the disc the way you would put other files on the disc when burning a CD/DVD. You need to use a tool that can create a bootable CD/DVD from an ISO image, such as Totally Free Burner, etc.; there are a number of free ones available. Though if you burn the CD/DVD from a Windows 7 system, you shouldn't need to install any additional software - see Create Bootable CD from ISO. The memtest86+ site also offers an auto-installer version for a USB key that you can download.

It's better to use a memory tester that runs after you've booted the system from such a CD/DVD, so you are eliminating the Windows operating system or applications running in it as a potential cause of the problem. And, because booting from one of these CDs uses much less memory than Microsoft Windows will claim, you can test more of the memory.

It may not be a hardware problem, but it also could be a hardware problem, so I wouldn't assume your system has been infected by malware or otherwise compromised.

  • 1
    Memtest86 is available also in some Linux CD/DVDs. Also, be careful to use the latest version. There were a few versions that threw a bunch of errors due to bugs. – Ismael Miguel Jul 19 '15 at 3:46
  • 1
    Thanks for the comprehensive answer. I'd like to emphasise that Windows presented me with the shutdown dialog (the one where it says waiting for programs to close, with Force Shut down buttons and all). I don't think Windows would respond to a power supply fault or a memory fault in this way (it'll just power off immediately for the former, possibly bsod for the latter). Or am I wrong in this regard? – Irvin Lim Jul 19 '15 at 5:16
  • 1
    Some critical system process trigger a system shutdown on process death. So it isn't out of reach for a memory fault to crash such a process and therefore cause a shutdown - although I think that this should be visible in the logs. – fefrei Jul 19 '15 at 9:25
  • 1
    Hardware failure usually would not trigger a "soft poweroff", when things like "Word prompted me to save my document, the Force Shutdown dialog came up" do occur. In case of a hardware failure everything halts abruptly without any prior warnings. So it actually looks more like a hacking attack… – Sarge Borsch Jul 19 '15 at 12:16
5

Go to your control panel, administrative tools, event viewer and look for the events that are related to startup and shutdown. Any shutdown will be listed there and who initiated it (a program or user, etc) It will tell you if this is the action of a virus, or perhaps an update process.

  • 1
    Like I said in the question, I surprisingly couldn't find any events that were logged prior to the shutdown that could possibly point to the trigger of the shutdown. I've looked at Windows Logs > System mostly, the rest didn't seem to have shutdown events. – Irvin Lim Jul 18 '15 at 21:55
  • 1
    There will be something in the event log, even if it's a reference to a file written out during the shutdown process because there is information which doesn't fit into the event log. That file may well hold the key. – Andrew Leach Jul 19 '15 at 10:27
  • Good point, except it's easy for a determined attacker to delete that event record – Sarge Borsch Jul 19 '15 at 12:06
2

One thing that came to mind immediately was the motherboard power switch. Since Windows received a shutdown command, which was followed immediately by a forced power shutdown, it looks very similar to what would happen if I held down the power button on the chassis.

Therefore, you should verify that the physical power switch itself is fully functional, and not activating without an intentional push (eg external objects bumping into the switch, or something shorting the pins within the motherboard.)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.