No way to stop PC rebooting

No idea where to write this one ... maybe someone can redirect me :).

I have a PC that reboots itself no matter what I do. After lot of painfull tests this is what I found:

* The PC does not reboot if the LAN cable is not connected.
* As soon (15/20seconds) as the LAN cable is reconnected, it boots.

An Ethereal trace shows a series of
NBNS Name query NB BRN_6F2D1D<00>
messages just before the PC reboots, coming from diferent PCs on the LAN and directed to 192.168.1.255

This seems to be a request for a shared Brother printer USB connected to the rebooting PC ... but somehow strange because the PC reboots itself even when all other PCs on the LAN are switched off (and of course I cannot get an Ethereal trace in that situation :rolleyes: ).

Any idea? Even a forum where this can be posted would help, I don't know how to deal with it.

Thks

Most modern BIOS have a wakeup on LAN feature, is that enabled?

I have tested it both with LAN enabled and disabled. It reboots on both situations.

We would like to have LAN reboot enabled because this particular PC needs to be rebooted early on the morning by some user on a diferent room, and to avoid him going to the PC room. But as I said, it reboots even with LAN reboot disabled.
The software we use to wake up the PC sends a series of UDP messages that we can easily identify on Ethereal and that are NOT present at all when we test the reboot problem.

Thks

What is the time frame of this 15 to 20 seconds. Is this after Windows is fully loaded and just sitting there? What kind of processes are running in the background? Possible trojan?

Safe mode? w/Networking? Be specific

Quote:

---

Originally Posted by PeejAvery

What is the time frame of this 15 to 20 seconds. Is this after Windows is fully loaded and just sitting there? What kind of processes are running in the background? Possible trojan?

---

Maybe I didn't explain it correctly.

I shut down the PC. It closes orderly. All lights off.
Then, after a period of aprox 15/20sec it reboots itself.
There is nothing running in the background because the PC is stopped.
McAfee doesn't find anything wrong on it (neither on other PCs on the LAN).

If the LAN cable is disconnected, it doesn't reboot.
If the LAN cable is connected, using Ethereal on another PC on the LAN, shows the NBNS protocol messages just before the PC reboots.
What makes me crazy is that it reboots when no other PC on the LAN is on :confused:, so I cannot stablish a 100% relationship with the messages and the rebooting.

Quote:

---

Originally Posted by dglienna

Safe mode? w/Networking? Be specific

---

Sorry dglienna, I don't understand what are you asking me.

Thks

Hit F8 as it's booting, and try first Safe Mode, then Safe Mode with Networking.

You should have no problem without the networking, but might have with it.

This would indicate a driver conflict.

This has nothing to do with drivers. S_M_A was completely correct. You need to double check your BIOS settings.

EDIT: Don't disable the LAN. There is a feature to disable "Wake on LAN." That is what you need to turn off.

Based on the problem description, I'm still not sure that the machine is rebooting prior to starting up in Windows or while Windows is booting. If the later, try running in safe mode, look at the Run keys in each hive of the registry (Software/Microsoft/Windows/CurrentControlSet/Run). Make sure that there isn't a process set to run that is causing the reboot. Also, a Windows service can be set to reboot on error, so perhaps one of the services is faulting?

Quote:

---

Originally Posted by Arjay

Based on the problem description, I'm still not sure that the machine is rebooting prior to starting up in Windows or while Windows is booting. If the later, try running in safe mode, look at the Run keys in each hive of the registry (Software/Microsoft/Windows/CurrentControlSet/Run). Make sure that there isn't a process set to run that is causing the reboot. Also, a Windows service can be set to reboot on error, so perhaps one of the services is faulting?

---

The PC is not rebooting "while Windows is booting" or "prior to starting up in Windows".
Windows is up and running, the PC is working with no problems. Then, when we finish our working day, we shutdown it normally. It shutdowns without problems ... and when we think we can go home and take a beer calmly ... the PC boots itself as if someone hit the start button. But obviously no one did!

I don't think a service is rebooting on error, this would reboot the PC at once, but it's clear that it takes some time to do it. I mean, all lights are off for a while, it's not a smooth and inmediate reboot.

I suspect some other PC is asking him to boot (asking for a shared printer maybe?) ... but the incredible fact is that NO other PC on the LAN is on at the time. It boots itself even if there is no one else on.

Will double check all BIOS settings ...

Could it be a LAN printer that wakes up this PC? It's a multifunction (so, FAX) printer and we cannot stop it!
Could it be an USB printer that wakes up this PC? It's defined as shared, and maybe it want to be alive?

Thks for all your answer, will continue to investigate. Maybe I could have a PC on, with Ethereal but without the shared printer defined, so no request from it.

:cry: :cry:

OK. I was wrong on one point: Power on by PCI card is enabled.
Disabling it stops the PC "powering on".
My fault, I was confused with the "3rd booting device: LAN/disabled"

Anyway, my question remains ... who/what is powering it on?

We want to be able to power it on remotely, but we don't want it to power on by itself without us giving the order to do it.

What can cause it to power on?

Thks

What PCI devices are present? Maybe a PCI graphics card attached to a powered plug & play monitor can cause PC to boot? Have no clue actually just guessing at the moment...

Try disconnecting PCI devices one after another.

Quote:

---

Originally Posted by S_M_A

What PCI devices are present? Maybe a PCI graphics card attached to a powered plug & play monitor can cause PC to boot? Have no clue actually just guessing at the moment...

Try disconnecting PCI devices one after another.

---

It's a standard PC, nothing installed on our own. How can I identify PCI devices? No PCI devices show on Control Panel>>System>>Devices manager.
We are using W/Vista.

I tried setting the Ethernet card Wake up type from OS Controlled to Magic Packet. In theory this should only allow Magic Packets (FF FF FF FF FF FF followed by 16 times the MAC address) to wake it up .... but it still powers up without anyone's intervention.
Still have to test with all other PCs off ... this will have to wait until late, I cannot stop our people at working ours :D.

All my tests show the NBNS messages just before the PC wakes up, but I don't know what they mean, neither how can I prevent the PC to wake up on them :sick: .

Thks for all your answers.

Once again...The only thing that can cause a sleeping/shutdown computer to turn on is Wake on LAN. You will notice that even though your computer is turned off, the light(s) on the NIC still can flash or be lit up.

Find the Wake on Lan setting in the BIOS, and disable it.

Quote:

---

Originally Posted by PeejAvery

Once again...The only thing that can cause a sleeping/shutdown computer to turn on is Wake on LAN. You will notice that even though your computer is turned off, the light(s) on the NIC still can flash or be lit up.
Find the Wake on Lan setting in the BIOS, and disable it.

---

Thks PeejAvery. Maybe you didn't read all my posts (easy, there are too many :rolleyes: ). As I stated previously, yes, you are right. Wake on LAN is enabled and we want it to be enabled because we want to wake up the PC.

What we don't want is it waking up by itself. So I'm trying to discover who/what wakes it up.

Thks

I read all your posts...but that is the only way to keep it from turning on again. Unless you want to remove every other piece of hardware from your network.

Just a thought on Power on by PCI card. Isn't the USB bridge connected to PCI? Could it be the USB printer that wakes up the PC?

Here's what you can do.

When you turn the machine off at night, turn off the power strip or surge protector. :D

Quote:

---

Originally Posted by S_M_A

Could it be the USB printer that wakes up the PC?

---

No. If it's a USB printer, then that means it would have to receive its commands from the machine that is turned off. ;) Not gonna happen.

Quote:

---

Originally Posted by Arjay

When you turn the machine off at night, turn off the power strip or surge protector. :D

---

Now, that idea is brilliant. Why didn't I think of that!

You could stick the machine's network into a network HUB rather than a switch and have another machine on the same hub running something like Wireshark. If something on the net is sending "wakeup" packets that cause the insomnia to your machine then you should be able to see that.

Quote:

---

Originally Posted by PeejAvery

I read all your posts...but that is the only way to keep it from turning on again. Unless you want to remove every other piece of hardware from your network.

---

Probably you are right, but I would like to understand why and I don't. If there is no other PCs on the LAN, why /who wakes it up?

Quote:

---

Originally Posted by Arjay

Here's what you can do.

When you turn the machine off at night, turn off the power strip or surge protector. :D

---

No, it's not a brilliant idea. This PC is intended to be waked up without going into its room. If we turn off the power Wake up on LAN would be nonsense.

Quote:

---

Originally Posted by Edders

You could stick the machine's network into a network HUB rather than a switch and have another machine on the same hub running something like Wireshark. If something on the net is sending "wakeup" packets that cause the insomnia to your machine then you should be able to see that.

---

Will try. Thks.

Quote:

---

Originally Posted by PeejAvery

No. If it's a USB printer, then that means it would have to receive its commands from the machine that is turned off. Not gonna happen.

---

Unsure about understanding your point. As I see it, the USB printer (that's turned on) could send a message to the PC to wake it up. No?



The other only device active is a LAN printer ... could it be waking up the PC?

Will try stopping both printers.

Thks for all your answers. It could seem nonsense, but we would like to be able to wake up this PC in the morning ... and all we get is a never stoping PC! :sick: :confused:

I find this really interesting, if only because I leave my machines on 24x7 for days, weeks, months on a regular basis, and NEVER set them to go to sleep.....

The power differential with hard drives spun down is fairly negligable.

Hm, I googled a bit and came up with this http://lists.olug.org/pipermail/olug...er/006399.html

If I get this right it actually seems like some motherboards can wakeup system from USB activity.

Think I have to try if my MB can do that. Then I just have to wiggle the mouse when I get home. :)

Quote:

---

Originally Posted by TheCPUWizard

I find this really interesting, if only because I leave my machines on 24x7 for days, weeks, months on a regular basis, and NEVER set them to go to sleep.....

The power differential with hard drives spun down is fairly negligable.

---

mmm ... interesting ...
What worries me about letting unattended equipment on all night is the fire/electricity hazard, but maybe I will have to deal with that and let the PC on forever ... Will think about it.

Quote:

---

Originally Posted by S_M_A

Hm, I googled a bit and came up with this http://lists.olug.org/pipermail/olu...ber/006399.html

If I get this right it actually seems like some motherboards can wakeup system from USB activity.

Think I have to try if my MB can do that. Then I just have to wiggle the mouse when I get home.

---

Definitely it's not the USB printer ... when we disconnect the LAN cable, the PC doesn't wake up, if it was the USB printer, the PC would wake up.

So, will try the LAN printer ...

Thks (to be continued)

Quote:

---

Originally Posted by DeepButi

Definitely it's not the USB printer ... when we disconnect the LAN cable, the PC doesn't wake up, if it was the USB printer, the PC would wake up.

---

That's what I was saying with my previous post.

LAN is the only thing that can wake a computer up from sleep with the exception of physically removing USB from ports. The USB objects themselves (printer in this case), in order to wake a computer up, make have activity. Since the commands to USB come from the computer...and since the computer was asleep, the commands from the computer to the USB peripherals, would not be sent.

That being said, the only way that the LAN printer is going to wake up your computer is if it is being used constantly (receiving commands). Since you said your computer turns back on every 15-20 seconds, it is very unlikely that this is the case.

It is most likely, that you are looking for another computer, possibly computers, that are interacting with a network service running on your machine. Check your task manager and your services.

Quote:

---

Originally Posted by PeejAvery

It is most likely, that you are looking for another computer, possibly computers, that are interacting with a network service running on your machine. Check your task manager and your services.

---

I'm going to cry ;).

Let me put it clear: All PCs on the LAN are off. No task managers, no services anywere. Nothing on the LAN but:
* the router
* a hub
* a LAN multifunction printer
* an IP phone (just remembered that one!!!!)
* the unstoppable :cool: PC

We shut down the unstoppable PC. It shuts down orderly. We don't breath for a while ... and hop! the PC wakes up :sick: :sick:.

Will continue to test ...

I'm not talking about checking task manager on other machines. I mean, check your task manager on the computer that reboots. In order for it to turn back on, a network service must be initiated or referenced.

Why don't you post a screenshot of your current processes?

Quote:

---

Originally Posted by PeejAvery

I'm not talking about checking task manager on other machines. I mean, check your task manager on the computer that reboots. In order for it to turn back on, a network service must be initiated or referenced.

Why don't you post a screenshot of your current processes?

---

Ah .. I see. Ok, will do it when I can get all PCs off and this only one working (it's not easy! I have to wait until out of work time :().

But this would not be coherent with the PC not waking up when
a) Wake on LAN disabled, or
b) Wake on LAN enabled and LAN cable disconnected.

If something on the task manager wakes it up ... probably would do it regardless of WoL or cable status.

Anyway, will give it a try.

Thks

Wait a second...I just made a dumb move. I was thinking you were putting the computer to sleep. If you are shutting it down, Windows Task Manager has nothing to do with it.

Quote:

---

Originally Posted by PeejAvery

Wait a second...I just made a dumb move. I was thinking you were putting the computer to sleep. If you are shutting it down, Windows Task Manager has nothing to do with it.

---

Yes, I am shuting it down. Total stop.
And as now I can discard also the LAN printer ... (PC waked up with the LAN printer cable disconnected).
Devices alive are now only a couple of IP phones!!! :sick: :sick:

Tomorrow I will check:
a) disconnecting the IP phones :confused:
b) let my laptop alive with Ethereal ... and let's see what happens!

Cannot believe it. :mad:

Quote:

---

Originally Posted by Edders

You could stick the machine's network into a network HUB rather than a switch and have another machine on the same hub running something like Wireshark. If something on the net is sending "wakeup" packets that cause the insomnia to your machine then you should be able to see that.

---

OK. Everything disconnected (even the IP phones) but my laptop with Ethereal running ... and it seems that the router is waking up the PC:

Code:

---

No.    Time        Source                Destination          Protocol Info
    101 77.756653  192.168.1.1          Broadcast            ARP      Who has 192.168.1.37?  Tell 192.168.1.1

Frame 101 (60 bytes on wire, 60 bytes captured)
    Arrival Time: Jun 13, 2008 14:25:48.219095000
    Time delta from previous packet: 1.007566000 seconds
    Time since reference or first frame: 77.756653000 seconds
    Frame Number: 101
    Packet Length: 60 bytes
    Capture Length: 60 bytes
    Protocols in frame: eth:arp
Ethernet II, Src: 192.168.1.1 (00:50:7f:b5:c6:c8), Dst: Broadcast (ff:ff:ff:ff:ff:ff)
    Destination: Broadcast (ff:ff:ff:ff:ff:ff)
    Source: 192.168.1.1 (00:50:7f:b5:c6:c8)
    Type: ARP (0x0806)
    Trailer: 000000000000000000000000000000000000
Address Resolution Protocol (request)
    Hardware type: Ethernet (0x0001)
    Protocol type: IP (0x0800)
    Hardware size: 6
    Protocol size: 4
    Opcode: request (0x0001)
    Sender MAC address: 192.168.1.1 (00:50:7f:b5:c6:c8)
    Sender IP address: 192.168.1.1 (192.168.1.1)
    Target MAC address: 00:00:00_00:00:00 (00:00:00:00:00:00)
    Target IP address: 192.168.1.37 (192.168.1.37)

---

192.168.1.37 is the unstoppable PC, and it seems to be responding to the broadcast message.

Is this something I can stop?

Thks

What kind of incoming data do you have to your router? :confused:

Quote:

---

Originally Posted by PeejAvery

What kind of incoming data do you have to your router? :confused:

---

VPN connecting two small offices.

Before you ask: nothing on at the other office either.

Quote:

---

Originally Posted by DeepButi

OK. I was wrong on one point: Power on by PCI card is enabled.
Disabling it stops the PC "powering on".
My fault, I was confused with the "3rd booting device: LAN/disabled"

Anyway, my question remains ... who/what is powering it on?

We want to be able to power it on remotely, but we don't want it to power on by itself without us giving the order to do it.

What can cause it to power on?

Thks

---

If is not a LAN device, it looks like an energy BIOS setting.

By the way:

- What model of motherboard -exactly- do you have?
- Are you sure the PC is powered off?. It can be on suspend S1, S3, or hibernated. On those states, many things, even optical mouse vibrations can power up your PC. Check Windows power settings, and BIOS settings like "power from USB", power from keyboard, mouse, etc.
(After installing a new video card, when I suspend on S3 my computer, it power on when I hack the table. Is the USB mouse).
Even things that are not supossed to power up your PC, can do it when Wake on LAN is enabled, because BIOS are software, so crammed with bugs.
- Had you updated the BIOS? may be a BIOS bug.
- Some motherboards have wireless LAN integrated, so any casual nearby notebook can power up your PC.
- How many devices there are on the network?. Your PC is connected to a hub, switch, router, what? Your network runs on DHCP, Static IP, No Idea?
_

Quote:

---

Originally Posted by DeepButi

OK. Everything disconnected (even the IP phones) but my laptop with Ethereal running ... and it seems that the router is waking up the PC:

Code:

---

...
    Sender MAC address: 192.168.1.1 (00:50:7f:b5:c6:c8)
    Sender IP address: 192.168.1.1 (192.168.1.1)
    Target MAC address: 00:00:00_00:00:00 (00:00:00:00:00:00)
    Target IP address: 192.168.1.37 (192.168.1.37)

---

192.168.1.37 is the unstoppable PC, and it seems to be responding to the broadcast message.
...

---

I don't know much of networks protocols, but it looks like your MAC address is really weird!
Try changing it. Surely your card allows it.
Try switching between DHCP/Static, and changing your IP, or disconnecting the router WAN port, to see if the origin of the problem is out of the network.
_

To discard any Windows problem:
Boot from a Linux Live CD, power off your computer, and see if it wakes by itself.

A small life saver, Live CD ISO, can be downloaded from http://www.puppylinux.org/ (80 Mb)

Or try Knoppix, or Ubuntu. Don't need to install it.
_

Marraco,
the PC is shutted down. No suspended or hibernated states of any kind. Completely shutted down. No wireless. No other devices on the net but the router itself.

There is nothing wrong with its hardware. The MAC address of the ARP packet is 00:00:00:00 because it's a broadcast packet intended to be listened by every card on the LAN.

I cannot see any help on starting a Linux/Ubuntu/Whatever OS on this PC. I need to know what happens with our actual configuration. Let's assume it doesn't wake up if the last booted OS is Linux. So what? This will not help me at all to discover how to prevent it after a W/Vista boot.

It seems that the router is waking it up. I cannot understand why the router sends an ARP message by itself. I could understand a lost connection from another device (PC), so this second PC would try to recover the connection and so the router would need to know the MAC of the desired IP. But with every single PC shutted down (completely) I cannot see why the router keeps asking.

Unsure of my own laptop asking for some kind of service ... I had not any shared folder defined, neither the USB shared printer ... nothing that I can think of.
The test was made in the following order:
* all LAN PCs shutted down (not suspended, neither hibernated: shutted down)
* unplug IP phones power
* unplug WoL PC LAN cable
* shut down WoL PC
* wait 5 minutes ... It doesn't wake up.
* plug my laptop to the LAN. No shared folders (I deleted all references), no USB shared printer. In theory my laptop shouldn't know anything about the services previously offered by WoL PC.
* start Ethereal
* plug WoL PC LAN cable
... 35sec later the WoL PC wakes up and starts booting.
* stop Ethereal

Last messages on the sniffer are a couple of ARPs as the one I posted.

I'm definitely lost.

:sick: :sick:

I will try with the router WAN disconnected to discard a VPN request (request that I cannot either understand if nobody is on).

Thks for all support!

Quote:

---

Originally Posted by DeepButi

...

---

I`m out up to Tuesday. I still would check some things:

- Check Bios updates.
- Don't discard malware trying to connect your PC from outside. You can be victim of a worm trying to offer server services. It may configure your router.
- Maybe is a wrong router configuration. Try reseting it, or disabling DHCP. Also check for router firmware updates.

Good luck.