How to Troubleshoot Unexpected Windows XP Restarts during Shutdown and Normal Usage - Reading the Event Log

Two potentially frustrating problems with Windows XP involve what to do when the computer spontaneously shuts down and restarts and what to do when a normal-appearing shutdown unexpectedly turns into a restart. We will try to look logically at this issue in a troubleshooting format, but we won’t be looking at issues that cause the PC to freeze and force the user into doing a manual shutdown.

For reference, this article is based on parts of Microsoft Knowledgebase articles 308029, 320299, and 308427.

Check or Stop Automatic Restart

A core concept in troubleshooting both spontaneous reboots and reboots after shutdown is that Windows XP, by default, is set up to restart after the system stops responding. This can happen when a conflict that Windows doesn’t know how to deal with arises during normal usage or during shutdown, so we’ll verify this setting first.

Right-click “My Computer” and select “Properties.” On the “Advanced tab” under “Startup and Recovery,” click the Settings button.

Under “System Failure,” you’ll see a checkbox beside “Automatically restart.” If this is selected, then Windows will restart if the system stops responding during normal usage or during shutdown.

If the problem involves the system spontaneously rebooting, try unchecking “Automatically restart.” It’s possible that this will allow you to see an error message that explains the cause of the stoppage.

This won’t do much good if it’s a restart after a shutdown, but the next step in troubleshooting is to check the system event log.

Check the System Log

Windows XP writes significant events for applications and processes into the system log. Sometimes it’s useful to determine the last event that occurred normally. It’s also possible that something about the disruptive event was recorded.

The Windows XP system log is actually composed of three separate logs: application, security, and system. The Windows Event Viewer provides a central location to peruse the three types.

In Control Panel, double-click “Administrative Tools,” and then double-click “Event Viewer.” If “Event Viewer (Local)” is the only thing showing, double-click the folder to the left to expand the section. Then you should see folders for Applications, Security, and System below. (You may also see a folder for Internet Explorer. That’s fine to ignore.)

Double-click System. Three types of events are recorded: information, warnings, and errors. Click the top of the “Type” column to sort by type, and then scroll down and find the Errors section. The first few records may reveal more about the event that triggered the problem.

It is very helpful to note the time that an event happened. This helps you to move back to find the last recorded event that happened before the shutdown.

Double-clicking an event will produce a popup that shows you the date and time it was recorded, the source of the error, and an “Event ID.” It’s not likely that you’ll be lucky enough to find an event that says, “The system stopped because…”

So the next best thing is to find out what the last event recorded was. Here it may be necessary to note the exact time for each error, warning, and notification. This can give you a picture of what was happening with the PC right before the event happened. If the problem has been recurrent, you should be able to go further back in the event log and find a similar sequence that happened just before the previous crash.

If so, go back and check the Application section. Maybe something was being recorded there (like maybe a notification to the user) just before the crash happened.

Then look in the Security section as well.

When you have your Event ID or error message, go to Microsoft’s Events and Errors page and do a search to find more information.

Find Out if the Problem Occurs in Safe Mode

Windows XP’s Safe Mode loads only a very basic set of drivers required to get the PC running. It provides a baseline environment. If the problem with spontaneous reboots or shutdown reboots doesn’t happen in Safe Mode, you can rule out basic Windows processes causing the problem.

To restart your computer in Safe Mode, repeatedly press F8 as the computer boots. If it goes to the Windows XP logo, you’ve missed it and need to try again. If your XP computer is set up to boot multiple operating systems, you can wait until the boot menu appears and then press F8.

If the problem doesn’t happen in Safe Mode, be suspicious about a driver problem or an unrecoverable application error.

Next we’ll look at possible hardware conflicts, problems with antivirus applications, performing a deep scan for known malware, and finally the big gun that will almost certainly work to find your reboot problem.

Check for Hardware Conflicts

Click “My Computer” and select “Properties.” Click on the Hardware tab and click the “Device Manager” button. Look for a black exclamation point on a yellow background - that denotes a problem area. If a device conflict is found, it may be necessary to try to download a more recent driver from the device manufacturer’s website. Note that this does NOT apply to video or specialized hardware drivers for notebooks. For these devices, you should check the laptop manufacturer’s webpage for updates.

Go Offline and Run with Antivirus Disabled

Your antivirus program could be creating a conflict that is crashing the computer and causing a spontaneous reboot. To check for this, disconnect physically from the Internet and try running the computer with antivirus disabled. If the problem goes away, my suggestion would be to uninstall the antivirus package and try another company’s product.

Check for Malware and Viruses

Conversely, if you exhibit certain “risk behaviors” like visiting “warez” sites and indiscriminately using torrents, you may have an active infection on your machine. Other than performing a full system scan with your existing antivirus, you may want to try running a deep scan using Windows Defender (requires Service Pack 2) and the Malicious Software Removal Tool, both of which are free and available through Windows Update. Both are also “after the fact” removal tools, so they work great for known malware and viruses.

Create and Analyze a Memory Dump File

The ultimate in troubleshooting is to set Windows XP to write the contents of memory to a “dump file” at the same time it writes any error to the event logs or reboots the PC. This is covered for Vista PCs in this article, but the same steps in the same order are also applicable to Windows XP.

I hope that this has helped you resolve your spontaneous reboot or failed shutdown reboot problem in Windows XP. Thank you for visiting Bright Hub, and thank you for reading this article.