Legacy API shutdown?

[guru2090]

I like to have my computer running 24/7, but a couple of days ago I woke up to find that it was turned off. It appeared as if someone manually turned it off but that wasn't the case. I turned it back on and everything seemed fine. I'm using Windows 7 Ultimate x64. I checked the event log and saw this:

The process wininit.exe (127.0.0.1) has initiated the shutdown of computer <PC NAME> on behalf of user NT AUTHORITY\SYSTEM for the following reason: Legacy API shutdown
Reason Code: 0x80070000
Shutdown Type: shutdown
Comment:

This appeared to have happened in the middle of a scheduled full system scan with avast, but this has never happened before. I thought maybe I was infected with some sort of virus but everything is coming up clean. What could have caused this?

 

[trapper]

Check your power settings. They can be re-set to defaults sometimes after windows updates.

 

[guru2090]

I thought it might have had something to do with the power settings as well, but everything is fine. I've had my computer on for 2 days straight and it hasn't turned off on me yet.

 

[Moo Scree]

I think it was caused by avast itself. I just installed avast 9 around 6pm 3/17. I used the computer heavily until around 5am. When I got back to the computer around 1:30pm 3/18, I found it was shutdown at 9:38am with the same exact event log entry you posted. The only system change was avast. Maybe it's autosandbox vm thing had something to do with it, because I did have DeepScreen kick in on a download earlier. Strange, but since this shutdown issue never happened before, I went back to another antivirus.

 

[glennalperin]

I am not sure this is specifically an aVast issue. I also use aVast. In addition, I am running Windows 7 Home Premium x64 (OEM from my laptop). This occurred just after I did an update on Spybot Search&Destroy, and there was no notice or notification that a reboot was going to occur. In fact, it happened so quickly that I was not sure if the update even completed, and the next time I ran the Spybot update application, it appeared that the updates had not been applied. Going through the update procedure again did cause them to be applied, and the second time did not cause a reboot. What I am not clear on is whether Spybot or Windows initiated the reboot.

In any event, I understand the need for reboots after most software updates, but I was rather annoyed that I did not get the chance to save the work I had been doing before the reboot occurred.

I also found this thread on Microsoft's web site discussing the same problem, although in a different context. (I am not running a Windows server of any variety.) I also found this thread on the Symantec web site, although the Symantec thread seemed to indicate a problem with a Symantec product achieving the same negative result.

Given that there are multiple software products involved causing the same problem, I would tend to believe this is a Windows problem, but I am certainly no expert on the matter.

 

[Moo Scree]

Well I would tend to agree it's some underlying Windows problem, but it is definitely brought out by one of avast's drivers. I believe it has something to do with the autosandbox VM driver used by its DeepScreen feature. At any rate, I never had this shutdown occurrence before installing avast, and I have not had it again since removing avast. So in my experience I would have to say the cause was avast (at least at some point after its DeepScreen feature has been utilized).

 

[glennalperin]

aVast is not the only software product experiencing this problem. I would be willing to believe that aVast may be a portion of a more complex software problem, or perhaps one of several offending software products which use similar programming methodology, but given my research and my own experience having this same issue when dealing with a completely separate software product update, I can't buy into the idea that the problem is definitely one related to aVast. aVast was not my open application at the time of the reboot. (I know, I know, background processes are still running, but I wasn't running it as a primary process at the time.)

Having said all of that, if your problems go away when you remove aVast, it hardly matters which software conflicts cause the problem because you no longer use one program which seemed to contribute to or initiate this problem for you. All I am suggesting here is that it is rather unlikely that aVast would be the only potential culprit, and it might even be likely that the problem is not aVast, but aVast in combination with a separate product or two. Of course, unless the techies from each of these companies get together to hash out how to avoid such software conflicts causing these reboots, we are left to our own devices to come up with solutions that work, and yours, Moo, is as good of a solution as any.

I happen to like aVast. It has proven itself worthy many times over in my case, but buggy software is buggy software, and from the end-user perspective, it doesn't matter which software product or product combination is the culprit if the problem still exists. So far, I have only had this specific problem once, and for all I know, it may never happen again. After all, Windows has a habit of such odd glitches popping up out of nowhere. As a result, it is also quite possible we are *both* wrong, Moo. Isn't modern software wonderful?