Newly upgraded windows 11 restarts after shutting down

CountMike · Mar 17, 2022

AVG and Kaspersky on same PC ?

zbook · Mar 17, 2022

AVG displayed residual entries in the event viewer.

Kaspersky current.

Code:

Event[22885]
  Log Name: System
  Source: Service Control Manager
  Date: 2022-03-17T06:51:47.4100000Z
  Event ID: 7000
  Task: N/A
  Level: Error
  Opcode: N/A
  Keyword: Classic
  User: N/A
  User Name: N/A
  Computer: DESKTOP-95U5S6C
  Description:
The avgntflt service failed to start due to the following error:
The system cannot find the file specified.

Code:

Event[22880]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2022-03-17T06:51:46.1850000Z
  Event ID: 5
  Task: N/A
  Level: Warning
  Opcode: Info 
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: DESKTOP-95U5S6C
  Description:
File System Filter 'avgntflt' (Version 10.0, ?2019?-?05?-?10T15:31:49.000000000Z) failed to register with Filter Manager.  The final status for this operation was 0xC0000034.

simmyjiff · Mar 17, 2022

Hi, just finishing off...should I reinstall the Kaspersky Virus software? had a problem with Item 8? received a Malware/Trojan alarm?
Thanks

zbook · Mar 17, 2022

All files with .bat extension will trigger antivirus software.

The end user must manually click OK to run the script.

Please use Microsoft Defender during the troubleshooting and reinstall your preferred AV after troubleshooting has completed.

simmyjiff · Mar 18, 2022

Info as requested.
1. Completed.
2. Completed.
3. Confirmed.
4. Programmed.
5. Updated to 63a.
6. Checked, all okay.
7. Attached.
8. Attached.
9.In Work.
DESKTOP-95U5S6C-(2022-03-18_07-26-15).zip
Event_logs-(2022-03-18_07-31-25).zip

zbook · Mar 18, 2022

Please check device manager again for:

Code:

Generic Bluetooth Radio    USB\VID_0A12&PID_0001\6&5DF280E&0&22    Failure using the VxD loader.

Uninstall and reinstall:

Code:

Web Companion                                                      7.0.2417.4248                                    Lavasoft                         20210129

AVG residuals still appear in the event viewer: (Please contact the vendor)

Code:

Event[23490]
  Log Name: System
  Source: Service Control Manager
  Date: 2022-03-18T07:21:17.9110000Z
  Event ID: 7000
  Task: N/A
  Level: Error
  Opcode: N/A
  Keyword: Classic
  User: N/A
  User Name: N/A
  Computer: DESKTOP-95U5S6C
  Description:
The avgntflt service failed to start due to the following error:
The system cannot find the file specified.

Code:

Event[23202]
  Log Name: System
  Source: Service Control Manager
  Date: 2022-03-18T06:53:45.3950000Z
  Event ID: 7000
  Task: N/A
  Level: Error
  Opcode: N/A
  Keyword: Classic
  User: N/A
  User Name: N/A
  Computer: DESKTOP-95U5S6C
  Description:
The avgntflt service failed to start due to the following error:
The system cannot find the file specified.

Code:

Event[23160]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2022-03-18T06:53:36.1580000Z
  Event ID: 41
  Task: N/A
  Level: Critical
  Opcode: Info 
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: DESKTOP-95U5S6C
  Description:
The system has rebooted without cleanly shutting down first. This error could be caused if the system stopped responding, crashed, or lost power unexpectedly.

Code:

Event[23147]
  Log Name: System
  Source: EventLog
  Date: 2022-03-18T06:53:45.5670000Z
  Event ID: 6008
  Task: N/A
  Level: Error
  Opcode: N/A
  Keyword: Classic
  User: N/A
  User Name: N/A
  Computer: DESKTOP-95U5S6C
  Description:
The previous system shutdown at 8:25:52 PM on ?3/?17/?2022 was unexpected.

simmyjiff · Mar 19, 2022

HI, Contacted APG, further cleaning carried out.
Uninstalled companion.

Event_logs-(2022-03-19_07-08-16).zip

Shared with Dropbox

www.dropbox.com

DESKTOP-95U5S6C-(2022-03-19_07-05-07).zip

Shared with Dropbox

www.dropbox.com

simmyjiff · Mar 19, 2022

simmyjiff said:
HI, Contacted APG, further cleaning carried out.
Uninstalled companion.

Event_logs-(2022-03-19_07-08-16).zip

Shared with Dropbox

www.dropbox.com

DESKTOP-95U5S6C-(2022-03-19_07-05-07).zip

Shared with Dropbox

www.dropbox.com

PC still restarting on shutdown?

zbook · Mar 19, 2022

For the unexpected shutdowns and restarts > when available > swap test PSU

What was done with webcompanion?

See if AVG can clean these event viewer entries:

Code:

Event[23766]
  Log Name: System
  Source: Service Control Manager
  Date: 2022-03-19T06:56:43.6270000Z
  Event ID: 7000
  Task: N/A
  Level: Error
  Opcode: N/A
  Keyword: Classic
  User: N/A
  User Name: N/A
  Computer: DESKTOP-95U5S6C
  Description:
The avgntflt service failed to start due to the following error:
The system cannot find the file specified.

Code:

Event[22578]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2022-03-18T16:35:10.8780000Z
  Event ID: 5
  Task: N/A
  Level: Warning
  Opcode: Info
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: DESKTOP-95U5S6C
  Description:
File System Filter 'avgntflt' (Version 10.0, ?2019?-?05?-?10T15:31:49.000000000Z) failed to register with Filter Manager.  The final status for this operation was 0xC0000034.

Code:

Event[8697]
  Log Name: Application
  Source: Application Error
  Date: 2022-03-18T15:50:35.6950000Z
  Event ID: 1000
  Task: Application Crashing Events
  Level: Error
  Opcode: Info
  Keyword: Classic
  User: N/A
  User Name: N/A
  Computer: DESKTOP-95U5S6C
  Description:
Faulting application name: avgremoverx.exe, version: 16.161.0.8041, time stamp: 0x59fc7b9b
Faulting module name: avgremoverx.exe, version: 16.161.0.8041, time stamp: 0x59fc7b9b
Exception code: 0xc0000005
Fault offset: 0x00192d15
Faulting process ID: 0x573c
Faulting application start time: 0x01d83adfe82e3ee4
Faulting application path: C:\WINDOWS\system32\avgremoverx.exe
Faulting module path: C:\WINDOWS\system32\avgremoverx.exe
Report ID: 8f113e6c-fed2-4aa1-85ac-749516d55822
Faulting package full name:
Faulting package-relative application ID:

Code:

Event[8698]
  Log Name: Application
  Source: Windows Error Reporting
  Date: 2022-03-18T15:50:36.5760000Z
  Event ID: 1001
  Task: N/A
  Level: Information
  Opcode: Info
  Keyword: Classic
  User: N/A
  User Name: N/A
  Computer: DESKTOP-95U5S6C
  Description:
Fault bucket 2181592419750315133, type 1
Event Name: APPCRASH
Response: Not available
Cab Id: 0

Problem signature:
P1: avgremoverx.exe
P2: 16.161.0.8041
P3: 59fc7b9b
P4: avgremoverx.exe
P5: 16.161.0.8041
P6: 59fc7b9b
P7: c0000005
P8: 00192d15
P9:
P10:

Attached files:
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER.68014aa2-94e6-4aed-899d-765b446451e1.tmp.dmp
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER.27a01c0a-bb9a-41cd-b2aa-9711a83d154f.tmp.WERInternalMetadata.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER.ff472334-e074-40a6-ac02-9712f3e3a455.tmp.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER.b287a4ae-280a-46db-9e60-bd511c3ea150.tmp.csv
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER.fcb97487-40b0-463b-82b4-7ad377441eec.tmp.txt

These files may be available here:
\\?\C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_avgremoverx.exe_383bc6631070d86f7495af5025fdc93dd798a68a_5007ee0d_1dea1b5b-8fab-452c-882a-617ef660fbbf

Analysis symbol:
Rechecking for solution: 0
Report Id: 8f113e6c-fed2-4aa1-85ac-749516d55822
Report Status: 268435456
Hashed bucket: a3528b8a43f3d55c1e4692bf47e7047d
Cab Guid: 0

Code:

Event[23554]
  Log Name: System
  Source: EventLog
  Date: 2022-03-19T06:49:11.2720000Z
  Event ID: 6008
  Task: N/A
  Level: Error
  Opcode: N/A
  Keyword: Classic
  User: N/A
  User Name: N/A
  Computer: DESKTOP-95U5S6C
  Description:
The previous system shutdown at 7:09:09 PM on ?3/?18/?2022 was unexpected.

Code:

Event[23569]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2022-03-19T06:49:00.9890000Z
  Event ID: 41
  Task: N/A
  Level: Critical
  Opcode: Info
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: DESKTOP-95U5S6C
  Description:
The system has rebooted without cleanly shutting down first. This error could be caused if the system stopped responding, crashed, or lost power unexpectedly.

Code:

Bluetooth L2CAP Interface    BTHENUM\{6E0C8F4C-D928-4852-B6B2-F0F0E0D126FA}_LOCALMFG&0000\8&2132C89&0&000000000000_0000000B    This device cannot start.
Bluetooth Hands-free Audio    BTHENUM\{24DF01A9-3E4F-4C9F-9F66-5AA8AB14F8F4}_LOCALMFG&0000\8&2132C89&0&000000000000_00000006    This device cannot start.
Bluetooth Remote Control    BTHENUM\{84A1E9B8-12BA-4A9C-8AB0-A43784E0D149}_LOCALMFG&0000\8&2132C89&0&000000000000_00000002    This device cannot start.

simmyjiff · Mar 19, 2022

Hi,
As far as I know I'm not experiencing any unexpected shutdowns? I am unable to shut down in the normal way through windows, so I have to shutdown on the Power button, could this be manifesting itself as unexpected shutdowns?
Uninstalled Web Companion, read up about it and felt there was no value in it, am I wrong?
What issues are showing relating to the PSU?
Are all the events related to AVG?
Not showing any problems with in Device Manager on the Bluetooth line, however just picked up a Code 10 under Bluetooth Remote Control under the Human Interface Devices, tried replacing drivers but comment is that existing are current, what can I do about the Bluetooth issue?
Thanks for your help.

Ernimus Prime · Mar 19, 2022

Was this a clean install of Win 11 or did you upgrade over Windows 10. I myself prefer to do a clean install of any new OS. I always had bad luck upgrading. But that's just me.

simmyjiff · Mar 19, 2022

...over the top?

simmyjiff · Mar 19, 2022

simmyjiff said:
...over the top?

Maybe the best thing to do?

glasskuter · Mar 19, 2022

I wouldn't ever run those 2 anti-virus programs at the same time. It will kill your system resource usage.

simmyjiff · Mar 19, 2022

I wasn't aware that I was, I had AVG for a year or so, but then got hold of Kaspersky up until last week, didn't realise AVG was still there....thanks for your comment though

johnlgalt · Mar 19, 2022

simmyjiff said:
I am unable to shut down in the normal way through windows, so I have to shutdown on the Power button, could this be manifesting itself as unexpected shutdowns?
Thanks for your help.

Using the power button constitutes an unexpected shutdown - IOW, one that was not initiated through the Windows system.

You've already explored the usual suspects, so keep working with zbook, but, TBH, it might be time to consider that clean install now.

One thing you probably want to verify is, as he stated, you've missed a couple of UEFI fw updates. Check if either of those from the manufacturer actually address issues related to Windows 11, specifically. While you don't necessarily need to update your UEFI fw if you are not having issues (and this is what hardware gurus tell most people), as there is always a small possibility (well below 1%) of something getting messed up, most enthusiasts and experienced users do tend to keep their UEFI fw updated to the latest version. With Windows 11 having been released recently, it's entirely possible that something in the older fw may, in fact, be cause some sort of issue where the OS tells the system to shutdown but the UEFI fw interprets it instead as a call to restart the machine.

So, consider working with zbook more, as you've pretty much done what everyone else has suggested already, and if he is still unable to get hte issue fixed, he'll also advise for the next possible steps.

zbook · Mar 19, 2022

simmyjiff said:
Hi,
As far as I know I'm not experiencing any unexpected shutdowns?

See post #29

Event[23554]
Date: 2022-03-19T06:49:11.2720000Z
The previous system shutdown at 7:09:09 PM on ?3/?18/?2022 was unexpected.

and

Event[23569]
Date: 2022-03-19T06:49:00.9890000Z
The system has rebooted without cleanly shutting down first.
This error could be caused if the system stopped responding, crashed, or lost power unexpectedly.

simmyjiff said:
I am unable to shut down in the normal way through windows, so I have to shutdown on the Power button, could this be manifesting itself as unexpected shutdowns?

A manual power off will create entries in the event viewer that are the same as a malfunctioning PSU.
So it is important to report whenever you perform a manual power off.

simmyjiff said:
Uninstalled Web Companion, read up about it and felt there was no value in it, am I wrong?

Please uninstall any software that you don't use.
It will free up space.
Sometimes there may be improve performance.
There were many web companion application crashes.

simmyjiff said:
What issues are showing relating to the PSU?

Unexpected shutdowns and restarts when the end user is not having BSOD and not performing manual power offs.

simmyjiff said:
Are all the events related to AVG?

The event logs still display AVG entries so there appear to be residual files that were incompletely cleaned.

simmyjiff said:
Not showing any problems with in Device Manager on the Bluetooth line, however just picked up a Code 10 under Bluetooth Remote Control under the Human Interface Devices, tried replacing drivers but comment is that existing are current, what can I do about the Bluetooth issue?
Thanks for your help.

See the three Bluetooth entries in post #29.

simmyjiff · Mar 19, 2022

I've been on to the AVG support web site, but it appears improvement works are in progress and they can't help, will try again tomorrow, in the meantime is there anything else I can be doing?

Ernimus Prime · Mar 19, 2022

simmyjiff said:
I've been on to the AVG support web site, but it appears improvement works are in progress and they can't help, will try again tomorrow, in the meantime is there anything else I can be doing?

Did you reformat and start fresh?