Spontaneous Restart and BIOS woes

templewulf

Hey all,

I'm having a problem with my PC where it just restarts all on its own. When it restarts, it sets my BIOS to some time in 2001. I didn't originally realize it was restarting, I just thought it was a date problem with Windows. However, my wife just noticed it restart while she was streaming media from it, and both of our cats were in the bedroom (away from the power supply).

I have Avira AntiVir updating and scanning nightly, Windows Firewall is up, and our router is set to drop anonymous inbound traffic. The only other applications running at the time were PlayOn, MagicJack, TVersity, and uTorrent.

I checked eventvwr, and in System logs I found the last entry before the time switch here:

Spoiler:

Log Name: System
Source: Microsoft-Windows-Power-Troubleshooter
Date: 10/20/2009 6:03:49 PM
Event ID: 1
Task Category: None
Level: Information
Keywords:
User: LOCAL SERVICE
Computer: templewulf-PC
Description:
The system has resumed from sleep.

Sleep Time: 10/20/2009 11:03:19 PM
Wake Time: 10/20/2009 11:03:27 PM

Wake Source: Device -USB Root Hub
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Power-Troubleshooter" Guid="{cdc05e28-c449-49c6-b9d2-88cf761644df}" />
<EventID>1</EventID>
<Version>0</Version>
<Level>4</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x8000000000000000</Keywords>
<TimeCreated SystemTime="2009-10-20T23:03:49.204Z" />
<EventRecordID>121340</EventRecordID>
<Correlation ActivityID="{EB678397-7F79-464C-BB55-D13249859EB3}" />
<Execution ProcessID="1388" ThreadID="1900" />
<Channel>System</Channel>
<Computer>templewulf-PC</Computer>
<Security UserID="S-1-5-19" />
</System>
<EventData>
<Data Name="SleepTime">2009-10-20T23:03:19.470Z</Data>
<Data Name="WakeTime">2009-10-20T23:03:27.139Z</Data>
<Data Name="SleepDuration">5669</Data>
<Data Name="WakeDuration">613</Data>
<Data Name="DriverInitDuration">497</Data>
<Data Name="BiosInitDuration">778</Data>
<Data Name="HiberWriteDuration">0</Data>
<Data Name="HiberReadDuration">0</Data>
<Data Name="HiberPagesWritten">0</Data>
<Data Name="Attributes">21506</Data>
<Data Name="TargetState">4</Data>
<Data Name="EffectiveState">4</Data>
<Data Name="WakeSourceType">4</Data>
<Data Name="WakeSourceTextLength">12</Data>
<Data Name="WakeSourceText">USB Root Hub</Data>
</EventData>
</Event>

and the first entry after the time switch indicates an unexpected shutdown:

Spoiler:

Log Name: System
Source: EventLog
Date: 12/31/2001 11:08:44 PM
Event ID: 6008
Task Category: None
Level: Error
Keywords: Classic
User: N/A
Computer: templewulf-PC
Description:
The previous system shutdown at 6:17:34 PM on 10/20/2009 was unexpected.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="EventLog" />
<EventID Qualifiers="32768">6008</EventID>
<Level>2</Level>
<Task>0</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2002-01-01T05:08:44.000Z" />
<EventRecordID>121341</EventRecordID>
<Channel>System</Channel>
<Computer>templewulf-PC</Computer>
<Security />
</System>
<EventData>
<Data>6:17:34 PM</Data>
<Data>10/20/2009</Data>
<Data>
</Data>
<Data>
</Data>
<Data>313631</Data>
<Data>
</Data>
<Data>
</Data>
<Binary>D9070A00020014001200110022004503D9070A00020014001700110022004503600900003C000000010000006009000000000000B004000001000000BD000000</Binary>
</EventData>
</Event>

The last application event was from Media Mall's PlayOn, but it seems to happen often enough that it doesn't look very concerning:

Spoiler:

Log Name: Application
Source: MediaMall Server
Date: 10/20/2009 6:03:31 PM
Event ID: 0
Task Category: None
Level: Information
Keywords: Classic
User: N/A
Computer: templewulf-PC
Description:
PowerEvent handled successfully by the service.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="MediaMall Server" />
<EventID Qualifiers="0">0</EventID>
<Level>4</Level>
<Task>0</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2009-10-20T23:03:31.000Z" />
<EventRecordID>15060</EventRecordID>
<Channel>Application</Channel>
<Computer>templewulf-PC</Computer>
<Security />
</System>
<EventData>
<Data>PowerEvent handled successfully by the service.</Data>
</EventData>
</Event>

My first suspicion is a bad mobo, but I really hope not as I'm not in a position to buy a new one right now. Any ideas?

templewulf

Ba-dum-bump.

It hasn't happened recently, but I'm wondering if I should be concerned about any possible virii or if I'll just need to save up for a motherboard.

Tofystedeth

I'd almost gaurantee this is a hardware issue. Mobo is a good guess. IS your comp set to sleep? It could be having trouble with the power management, causing it to go to an off state sometimes, and i guess presumably cutting power to the BIOS as well*. Is it only the BIOS time reseting, or are you also losing other config? Or do you have no config that is non-default?

*If your BIOS battery is in good shape this shouldn't be an issue. it could be alot of things here.

Mr. Buttons

you should be getting some sort of error code (hopefully) if the problem is your motherboard (unexpected beeps or lights when you boot up)

I've had a similar experience with this, and in my case it was actually the power supply that was the culprit and not the mobo. It could also be a virus, but if you're keeping up with security updates and have a good anti-virus running it really shouldn't be

psychotix

Mr. Buttons wrote: »

you should be getting some sort of error code (hopefully) if the problem is your motherboard (unexpected beeps or lights when you boot up)

I've had a similar experience with this, and in my case it was actually the power supply that was the culprit and not the mobo. It could also be a virus, but if you're keeping up with security updates and have a good anti-virus running it really shouldn't be

It is probably hardware. But AV doesn't do jack against "some" viri problems. I've seen some really odd problems where the virus dumped itself to the MBR prior to shut down. You had to delete MBR to kill the sucker.