Defender Shuts Computer Down

[Andrea]

I'm using Windows XP, SP3 and have Defender set to run a full scan at a
specific time each day. If I forget and happen to be using the computer at
the scheduled time, it will sometimes, but not always, shut my system down.
Other times when the scan runs and I'm not using the computer, I check later
and discover that it's shut down and Defender informs me that I haven't
scanned in a few days, so it must have aborted the scan. I have the latest
definitions, 1.59.1115.0.

 

[Ǝиçεl]

Hello Andrea,

Something else is shutting down your PC, WD don't cause that.

Experiment, In this case, change Windows Defender scheduling.


If you have a particular piece of spyware or other unwanted software that is
detected by Windows Defender, the vast majority of the time it should be
detected by the quick scan.


The full scan, in addition to performing all of the checks in a quick scan,
also examines every single file on your system.

This is a quite time-consuming operation if you have a lot of files.


I would always start with a quick scan - if it gives you a clean bill of
health, you can be pretty confident in the results.

If the quick scan finds anything, you probably should follow it up with a
full scan to find any additional junk that the malicious software dropped on
your machine that may have been missed by the quick scan.

It's also a good idea to schedule the full scan to happen periodically
(every night, for instance) at a time when you are not typically using your
computer and the added time to scan all of the files won't be noticed.


The recommendation is to use the quick scan routinely, and do full scans
either on a longer periodicity--weekly, monthly--or only when something is
found or you have some reason for suspicion.


I hope this post is helpful, but we would highly appreciate it if you could
rate the pºst, so we can keep the community informed and saves somebody
else the hours of trawling through the web trying to find a solution.
-=-

:

 

[Andrea]

Hello,

I appreciate your response and will try the quick scan. I did have the full
scan scheduled at a time when I'm not generally using my computer, but there
are exceptions. I disagree that something else is shutting down my computer
because it only began when I installed Defender, and it only happens during
one of its scans. But it didn't happen last night, so may be the problem has
been resolved.

How do we rate posts? I'm using a newsreader to read this. Thanks.

Andrea

 

[Bill Sanderson]

You can only rate posts when using the html interface to these groups, I'm
afraid.

I agree with Engel that Windows Defender is the messenger in this case,
rather than the sender of the message.

I'd suggest running a chkdsk with the repair options turned on for your
system drive. This will require that you restart, at which time the chkdsk
will run (be prepared for how long this may take.) After the restart, the
results of the chkdsk command are available in a Windows log message--I
think the system events log, but perhaps application.

How recently has your system been scanned in full by a competent antivirus
application?

The thoughts behind these suggestions are that perhaps there's some disk
corruption which is only evident when a particular file is touched, and this
happens only during the WD Scan--a bit shakey, I'll admit--why should disk
corruption cause a crash, but still...

And, the possibility of running virus code, or a rootkit, which crashes when
WD attempts to see whats what.

I'm not very satisfied with either of these ideas, but Windows Defender is
running on millions of machines worldwide, with a corresponding variety of
hardware and drivers, and a compatibility issue that would cause this kind
of crash is likely to be known pretty quickly. So, unless you happen to be
the bleeding edge case, I'd look harder at the hardware for the cause.

Speaking of the events log--are there event log messages for these crashes?
In some blue-screen crash cases, the OS can manage to write an event log
record, and sometimes these records show a driver name.