MSE, restarts and missing event log entries

Discussion in 'Windows 7' started by yhekntalahzjxw, Dec 3, 2009.

  1. yhekntalahzjxw

    yhekntalahzjxw MDL Novice

    Nov 17, 2009
    3
    0
    0
    #1 yhekntalahzjxw, Dec 3, 2009
    Last edited: Dec 4, 2009
    Hi,

    UPDATE 1: It's not activation related.

    I'm quite consternated and I'd love to hear your opinions on this. The story:

    I'm experiencing strange restarts but not random, I can routinely replicate it. After a boot IF I leave the logon screen alone (i.e. without logging in), the system restarts itself almost like automatically after about 10 seconds. Though If I do log in within the 10 seconds interval, the login is successful and the restart won't occur. So no restarts while working.

    Logically, I started searching the Event log; that's where I discovered the scary part (after some tests and trials):

    The entire "restarted" session is missing!

    Like:

    20:00 I shutdown the computer (from Windows start menu).

    20:10 I start the computer. The log on screen appears. 10 seconds pass and said automatic restart occurs.

    20:20 I start the computer, log in within 10 seconds interval and start working (and searching the Event log).

    In the Event log around 20:00 there are usual shutdown routine entries.
    Around 20:20 there are usual boot up routine entries.
    But absolutely NO entries indicating anything happened at 20:10 at all!!!

    I find this extremely confusing.

    I suspected Microsoft Security Essentials because there was one time that the restart occurred shortly AFTER I logged in, with MSE error - that one was recorded in the event log but unfortunately I cleared it some time ago.

    After I uninstalled MSE (Defender automatically kicked in), things got worse. The restart followed shortly even after login no matter what. System was unusable so I restored previous bit copy.

    I'm running W7 Enterprises (official trial image) + ChewWGA. Quite new installation without any special settings (I believe).

    I certainly appreciate any help or advice...
     
  2. Hazar

    Hazar MDL Guru

    Jul 29, 2009
    2,523
    454
    90
    #2 Hazar, Dec 3, 2009
    Last edited by a moderator: Apr 20, 2017
    The restart is caused by a service designed to enforce the 90 day expiry in trial isos. To kill it either use RemoveWAT, or run this:

    Code:
    taskkill /F /IM wlms.exe & takeown /F %windir%\System32\wlms\wlms.exe & icacls %windir%\System32\wlms\wlms.exe /deny *S-1-1-0:(X) & shutdown -a
    Run that as one big command from admin cmd prompt and no more restarts.
     
  3. yhekntalahzjxw

    yhekntalahzjxw MDL Novice

    Nov 17, 2009
    3
    0
    0
    #3 yhekntalahzjxw, Dec 3, 2009
    Last edited by a moderator: May 23, 2017
    (OP)
  4. sam3971

    sam3971 MDL Guru

    Nov 14, 2008
    2,220
    303
    90
    #4 sam3971, Dec 4, 2009
    Last edited by a moderator: May 23, 2017
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  5. yhekntalahzjxw

    yhekntalahzjxw MDL Novice

    Nov 17, 2009
    3
    0
    0
    OK.

    I tried unistalling ChewWGA - restarts persists.
    I installed RemoveWAT - restarts persists.

    It's something else.
     
  6. Hazar

    Hazar MDL Guru

    Jul 29, 2009
    2,523
    454
    90
    That's interesting.

    I can only suggest you reinstall the OS.

    i was a bit quick to post when I saw "official trial iso" + "shutdowns" :p