Why the reboot after downloading defender definition files.

[Guest]

My system keeps rebooting. Sometimes in the middle of the day while I'm
working. When I look at the system I find no reason except when I look at the
Microsoft Update View History page, I see that defender loaded updated
definition files. If defender wants to reboot, it should ask me and wait
indefinitly for my response instead of closing down all my work (without
saves) even when I'm in the middle of debugging something.

 

[Guest]

I don't know any reason to connect either your symptoms or the specific to
Windows Defender. I would suggest staying on the side of caution... I'd
recommend trying Ewido.

http://www.ewido.net/en

 

[Bill Sanderson MVP]

I haven't seen this behavior. The time of the restarts should be accurately
available in the System event log. The updates are also in that log, with
source WinDefend, and event ID 2000.

Do the times really correlate?

 

[Guest]

Be sure to enable a Firewall
http://www.microsoft.com/athome/security/protect/windowsxpsp2/Default.mspx

Install the Required Update (Critical Updates)
http://update.microsoft.com/microsoftupdate/v6/default.aspx?ln=en-us

Check For and Remove Sasser
http://www.microsoft.com/security/malwareremove/default.mspx

 

[Guest]

There was nothing in the event log at the time of reboot except the normal
items that show when starting. There was a 3366_appcompat.txt file in the
TEMP directory but it only listed system dlls. The date for the update
history does not include minutes so it might not have been defender at all.
The event log showed a defender update early in the morning (12:30AM) so it
probably wasn't defender that caused the reboot. Thanks for the responses.

 

[Guest]

FYI: The reboot was caused by AutoUpdate (the only thing updated that day was
Defender) but the WindowsUpdate.log file showed that there was nothing to
update at 2:54PM but it initiated a reboot anyway.

This is what was in the log at the time:

2006-08-04 14:40:26 900 110 Misc =========== Logging initialized (build:
5.8.0.2469, tz: -0500) ===========
2006-08-04 14:40:26 900 110 Misc = Process: C:\Program Files\Internet
Explorer\IEXPLORE.EXE
2006-08-04 14:40:26 900 110 Misc = Module: C:\WINDOWS\system32\wuweb.dll
2006-08-04 14:40:26 900 110 Setup *********** Setup: Checking whether
self-update is required ***********
2006-08-04 14:40:26 900 110 Setup * Inf file:
C:\WINDOWS\SoftwareDistribution\WebSetup\wusetup.inf
2006-08-04 14:40:26 900 110 Setup Update NOT required for
C:\WINDOWS\system32\cdm.dll: target version = 5.8.0.2469, required version =
5.8.0.2469
2006-08-04 14:40:26 900 110 Setup Update NOT required for
C:\WINDOWS\system32\iuengine.dll: target version = 5.8.0.2469, required
version = 5.8.0.2469
2006-08-04 14:40:26 900 110 Setup Update NOT required for
C:\WINDOWS\system32\wuapi.dll: target version = 5.8.0.2469, required version
= 5.8.0.2469
2006-08-04 14:40:26 900 110 Setup Update NOT required for
C:\WINDOWS\system32\wuauclt.exe: target version = 5.8.0.2469, required
version = 5.8.0.2469
2006-08-04 14:40:26 900 110 Setup Update NOT required for
C:\WINDOWS\system32\wuauclt1.exe: target version = 5.8.0.2469, required
version = 5.8.0.2469
2006-08-04 14:40:26 900 110 Setup Update NOT required for
C:\WINDOWS\system32\wuaucpl.cpl: target version = 5.8.0.2469, required
version = 5.8.0.2469
2006-08-04 14:40:26 900 110 Setup Update NOT required for
C:\WINDOWS\system32\wuaueng.dll: target version = 5.8.0.2469, required
version = 5.8.0.2469
2006-08-04 14:40:26 900 110 Setup Update NOT required for
C:\WINDOWS\system32\wuaueng1.dll: target version = 5.8.0.2469, required
version = 5.8.0.2469
2006-08-04 14:40:26 900 110 Setup Update NOT required for
C:\WINDOWS\system32\wucltui.dll: target version = 5.8.0.2469, required
version = 5.8.0.2469
2006-08-04 14:40:26 900 110 Setup Update NOT required for
C:\WINDOWS\system32\wups.dll: target version = 5.8.0.2469, required version =
5.8.0.2469
2006-08-04 14:40:26 900 110 Setup Update NOT required for
C:\WINDOWS\system32\wups2.dll: target version = 5.8.0.2469, required version
= 5.8.0.2469
2006-08-04 14:40:26 900 110 Setup * IsUpdateRequired = No
2006-08-04 14:54:48 1756 744 AU AU found 0 updates for install at shutdown
2006-08-04 14:54:48 1592 da4 Misc =========== Logging initialized (build:
5.8.0.2469, tz: -0500) ===========
2006-08-04 14:54:48 1592 da4 Misc = Process: C:\WINDOWS\explorer.exe
2006-08-04 14:54:48 1592 da4 Misc = Module: C:\WINDOWS\system32\wuaueng.dll
2006-08-04 14:54:48 1592 da4 Shutdwn Install at shutdown: no updates to
install
2006-08-04 14:55:12 1756 fc AU AU found 0 updates for install at shutdown
2006-08-04 14:55:12 1592 da4 Misc =========== Logging initialized (build:
5.8.0.2469, tz: -0500) ===========
2006-08-04 14:55:12 1592 da4 Misc = Process: C:\WINDOWS\explorer.exe
2006-08-04 14:55:12 1592 da4 Misc = Module: C:\WINDOWS\system32\wuaueng.dll
2006-08-04 14:55:12 1592 da4 Shutdwn Install at shutdown: no updates to
install
2006-08-04 14:55:20 1756 fc AU AU Restart required....
2006-08-04 14:55:21 1756 14c AU ########### AU: Initializing Automatic
Updates ###########
2006-08-04 14:55:21 1756 14c AU # Approval type: Pre-install notify (User
preference)
2006-08-04 14:55:21 1756 14c AU # Auto-install minor updates: No (User
preference)
2006-08-04 14:55:21 1756 14c AU # AU is paused, not initializing any
handlers
2006-08-04 14:55:24 1756 14c Service *********
2006-08-04 14:55:24 1756 14c Service ** END ** Service: Service exit
[Exit code = 0x240001]
2006-08-04 14:55:24 1756 14c Service *************

 

[Bill Sanderson MVP]

That is odd-looking, but I don't have a lot of experience with those logs.

I think that if this were related to the definitions, we'd have heard from a
LOT of people, including myself.

Hmm--how often have I done some form of patch install myself which "requires
a restart" and then intentionally not done the restart.... Any chance that
such a restart was pending? I would guess that there's only one such
restart flag as far as Microsoft packaged patches go.
--

FYI: The reboot was caused by AutoUpdate (the only thing updated that day
was
Defender) but the WindowsUpdate.log file showed that there was nothing to
update at 2:54PM but it initiated a reboot anyway.

This is what was in the log at the time:

2006-08-04 14:40:26 900 110 Misc =========== Logging initialized (build:
5.8.0.2469, tz: -0500) ===========
2006-08-04 14:40:26 900 110 Misc = Process: C:\Program Files\Internet
Explorer\IEXPLORE.EXE
2006-08-04 14:40:26 900 110 Misc = Module: C:\WINDOWS\system32\wuweb.dll
2006-08-04 14:40:26 900 110 Setup *********** Setup: Checking whether
self-update is required ***********
2006-08-04 14:40:26 900 110 Setup * Inf file:
C:\WINDOWS\SoftwareDistribution\WebSetup\wusetup.inf
2006-08-04 14:40:26 900 110 Setup Update NOT required for
C:\WINDOWS\system32\cdm.dll: target version = 5.8.0.2469, required version
=
5.8.0.2469
2006-08-04 14:40:26 900 110 Setup Update NOT required for
C:\WINDOWS\system32\iuengine.dll: target version = 5.8.0.2469, required
version = 5.8.0.2469
2006-08-04 14:40:26 900 110 Setup Update NOT required for
C:\WINDOWS\system32\wuapi.dll: target version = 5.8.0.2469, required
version
= 5.8.0.2469
2006-08-04 14:40:26 900 110 Setup Update NOT required for
C:\WINDOWS\system32\wuauclt.exe: target version = 5.8.0.2469, required
version = 5.8.0.2469
2006-08-04 14:40:26 900 110 Setup Update NOT required for
C:\WINDOWS\system32\wuauclt1.exe: target version = 5.8.0.2469, required
version = 5.8.0.2469
2006-08-04 14:40:26 900 110 Setup Update NOT required for
C:\WINDOWS\system32\wuaucpl.cpl: target version = 5.8.0.2469, required
version = 5.8.0.2469
2006-08-04 14:40:26 900 110 Setup Update NOT required for
C:\WINDOWS\system32\wuaueng.dll: target version = 5.8.0.2469, required
version = 5.8.0.2469
2006-08-04 14:40:26 900 110 Setup Update NOT required for
C:\WINDOWS\system32\wuaueng1.dll: target version = 5.8.0.2469, required
version = 5.8.0.2469
2006-08-04 14:40:26 900 110 Setup Update NOT required for
C:\WINDOWS\system32\wucltui.dll: target version = 5.8.0.2469, required
version = 5.8.0.2469
2006-08-04 14:40:26 900 110 Setup Update NOT required for
C:\WINDOWS\system32\wups.dll: target version = 5.8.0.2469, required
version =
5.8.0.2469
2006-08-04 14:40:26 900 110 Setup Update NOT required for
C:\WINDOWS\system32\wups2.dll: target version = 5.8.0.2469, required
version
= 5.8.0.2469
2006-08-04 14:40:26 900 110 Setup * IsUpdateRequired = No
2006-08-04 14:54:48 1756 744 AU AU found 0 updates for install at shutdown
2006-08-04 14:54:48 1592 da4 Misc =========== Logging initialized (build:
5.8.0.2469, tz: -0500) ===========
2006-08-04 14:54:48 1592 da4 Misc = Process: C:\WINDOWS\explorer.exe
2006-08-04 14:54:48 1592 da4 Misc = Module:
C:\WINDOWS\system32\wuaueng.dll
2006-08-04 14:54:48 1592 da4 Shutdwn Install at shutdown: no updates to
install
2006-08-04 14:55:12 1756 fc AU AU found 0 updates for install at shutdown
2006-08-04 14:55:12 1592 da4 Misc =========== Logging initialized (build:
5.8.0.2469, tz: -0500) ===========
2006-08-04 14:55:12 1592 da4 Misc = Process: C:\WINDOWS\explorer.exe
2006-08-04 14:55:12 1592 da4 Misc = Module:
C:\WINDOWS\system32\wuaueng.dll
2006-08-04 14:55:12 1592 da4 Shutdwn Install at shutdown: no updates to
install
2006-08-04 14:55:20 1756 fc AU AU Restart required....
2006-08-04 14:55:21 1756 14c AU ########### AU: Initializing Automatic
Updates ###########
2006-08-04 14:55:21 1756 14c AU # Approval type: Pre-install notify
(User
preference)
2006-08-04 14:55:21 1756 14c AU # Auto-install minor updates: No (User
preference)
2006-08-04 14:55:21 1756 14c AU # AU is paused, not initializing any
handlers
2006-08-04 14:55:24 1756 14c Service *********
2006-08-04 14:55:24 1756 14c Service ** END ** Service: Service exit
[Exit code = 0x240001]
2006-08-04 14:55:24 1756 14c Service *************

I haven't seen this behavior. The time of the restarts should be
accurately
available in the System event log. The updates are also in that log,
with
source WinDefend, and event ID 2000.

Do the times really correlate?