Share via

Full scan with Windows Defender, cause reboot of the machine without reason?

Anonymous
2021-01-14T20:42:37+00:00

I have a suspected issue happening when I run a Full System scan with Windows Defender anti-virus, part of the way thru my machine will reboot without any reason. I have run the update and am all caught up.

So my questions :

  1. Is there a logging file to find out why it was interrupted? or for the status of the scan?
  2. Is there a way to run the Windows Defender scan in Safe Mode?
  3. any suggestions on other actions to preform?

Thanks.

Windows for home | Windows 10 | Security and privacy

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments

Answer accepted by question author

  1. Rob Koch 25,875 Reputation points Volunteer Moderator
    2021-01-15T20:02:24+00:00

    If the logged times are correct for those two entries, it would appear the unexplained bluescreen event is almost immediate, though in your initial post you indicated "part of the way thru my machine will reboot", so which description is accurate?

    It doesn't matter whether the machine is old or even brand new out of the box, it can still have cooling system issues due to inadequate design or processor installation issues as simple as inappropriate thermal tape or paste.  However, this would obviously be unlikely if the shutdown occurs within the first minute or two after the scan begins.

    Once you get into interpreting events you're beyond the knowledge of most monitoring these specific forums, though there are other forums relating to Windows 10 where others frequently investigate these including the associated crash dump files.  Not saying no one will respond, just that it's less likely here.

    Whatever's going on might relate to either hardware or damaged operating system software, but unless the shutdown is immediate I still suspect it may relate to overheating, whether due to inadequate cooling or simply an improper configuration of the processor speed controlling portions of the BIOS, including settings relating to virtual machine operation that at least used to interact with these by disabling them, forcing the processor cores into high-speed operation.

    As I mentioned initially, there's a number of things that can cause this, but the most common when some usually variable time passes before the crash occurs is overheating.  If it always occurs in exactly the same time frame, it's more likely due to something like either damaged software or or other specific files being scanned, which can include malware, though the latter is extremely rare.

    The reason I suggested the processor thermal monitoring apps is that this is relatively easy to do on your own and completely rules that out if it's not already unlikely due to an immediate shutdown.  You can waste lots of time and effort by yourself and others if the problem is actually overheating, so I'd still try one of those apps first if the timeframe is long enough (at least a few minutes) to create some heating of the cores.

    The architecture of that i9-10980XE Extreme Edition processor in your system incudes 18 cores, operating at a base frequency of 3.00 GHz, with a Max Turbo Frequency of 4.60 Ghz and Turbo Boost Ma Technology 3.0 Frequency of 4.80 Ghz, dissipating 165 Watts when all cores are operating at base frequency.

    Intel® Core™ i9-10980XE Extreme Edition Processor 198017

    My point in including the above is that Intel stopped producing processors a couple decades ago that operated above 3 GHz, since these were known to be crash prone and require extreme cooling system designs that often didn't perform properly.  Obviously this processor indicates that they've returned to this unsuccessful practice of the past, likely believing that those producing machines using these will understand these issues and produce cooling systems that can manage the heating involved.

    I personally used to work for a white box manufacturer around the time those issues were prevalent and so understand how untrue it is that companies fully understand the thermal issues involved.  So personally I wouldn't take the system's design at the company's word and use this as an opportunity to confirm that their cooling system design works as expected.

    I didn't previously explain that Microsoft's highly efficient malware scanning software initially began creating problems with older systems running Windows XP due to its performing most operations in memory rather than being dependent on disk as had been common in earlier designs.  This and the later use of multiple cores by both the operating system and the scanning engines themselves led to far more heating than most processors experience during any other common application's typical operation.

    That's why it's often only when a long period of scanning due to the selection of a full scan is made that such a shutdown first occurs.  We often spent days at that time trying to convince people to test for this same issue of overheating, with only a relatively tiny number turning out to be something else.

    Rob

    2 people found this answer helpful.
    0 comments

5 additional answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Rob Koch 25,875 Reputation points Volunteer Moderator
    2021-01-23T05:27:39+00:00

    Thanks for taking the time to return and confirm that this was indeed the issue, since some never do and it adds value for others with similar issues when you take the time to confirm your answer.

    As an aside I'll also mention that in the last few days a different question relating to the operation of the Full scan came up that required me to find an older thread I recalled regarding the fact that manual scans don't perform processor throttling, while automated scans such as the regularly scheduled Quick scan do.

    What this means is that by manually running a Full scan, you're inherently telling it to run the processor cores flat out as fast as they'll operate, which is part of why this action can so often find any weaknesses in a system's cooling design or configuration.

    Another thing I should point out though is that along with the cooling system, both the configuration of the BIOS and other particulars relating to the design of a system can contribute to this issue.

    That's due to the fact that absolutely NO modern multi-core processor can continually operate a significant number of cores at high utilization for long periods without overheating.  That's a simple fact due to the act of packing so much heat-producing electronics into smaller and smaller packages, which makes getting rid of the heat a nearly impossible task.

    While investigating that new "Extreme" processor in your system I learned one of the new ways Intel is trying to improve processor performance while still operating within heating limits, which is one of the new features titled Intel® Turbo Boost Max Technology 3.0.

    If you read just the key items on that page, you'll find the following section titled:

    Factors That Impact Intel® Turbo Boost Max Technology 3.0

    The availability and frequency upside of Intel® Turbo Boost Max Technology 3.0 depends upon a number of factors including, but not limited to, the following:

    • Type of workload
    • Number of active cores
    • Estimated current consumption
    • Estimated power consumption
    • Processor temperature

    According to another paragraph there, with Intel® Turbo Boost Max Technology 3.0, lightly-threaded performance is optimized by identifying your processor's fastest cores and directing your most critical workloads to them.

    In other words, the processor identifies and selects the highest performing cores and when less threads are processing, it directs those to these specific cores to increase performance.

    If you think about it, that's a perfect description of running a Full scan, since it's running a single set of highly processor intensive tasks one right after another, with little else operating and as you mentioned you've typically left this running on its own, so the system is really doing nothing else.

    Thus you've created the ultimate test of this new system and technology, since it's the perfect app that requires lots of processor time, with little disk or other activity required over a significant time span.  And if as I suspect at least some of the drives you're scanning are SSD, these have minimal latency which means the scan will operate even faster with no read delays accessing files.

    In theory though, unless the processor configuration in BIOS is incorrect, the cooling system is functioning incorrectly or something else within the processor itself such as the temperature monitoring isn't functioning properly, the system should appropriately throttle the cores as required to maintain the temperature below the thresholds at which they'll cause overheating.

    So it's valid to take this issue to your computer's manufacturer to determine where this is going wrong, especially since it's so new.

    Good luck,

    Rob

    2 people found this answer helpful.
    0 comments
  2. Anonymous
    2021-01-15T17:06:05+00:00

    Thank you for the reply on things to try, but we can eliminate any "old" version or dusty conditions : my Machine is 3 months old, water cooled tower =>

    Next, I started using the Event Viewer to see if I could get some information this is what I came up with. I found the entry for the Security starting, then when the reboot happened it would be the next entry that got captured. 

    Now my question is how to decipher what has happened when my reboot occurred? NOTICE : Security-SPP is the start of the scan, then the Window Error Reporting entry with Details.

    1 person found this answer helpful.
    0 comments
  3. Rob Koch 25,875 Reputation points Volunteer Moderator
    2021-01-14T22:12:37+00:00

    Several possibilities, but the simplest is also often the easiest to determine.

    During the full scan, is the computer's fan apparently running at very high speed and the device itself getting hot in areas near where the processor chip is located?

    If so, it's likely your device is shutting down due to overheating, which used to be relatively common with Windows XP or with older devices including those first upgraded to Windows 10 a few years ago, but generally happens less often today.

    What was typically recommended back when this was more common was to insure that there wasn't dust build-up around the processor heat sink, as well as that the cooling system of the device was performing as expected.  There used to be several online tools available to monitor the processor thermal condition, though I'm not certain which might be around any longer, but here's an article from a year ago that should help.

    How to Monitor Your CPU Temperature | Tom's Hardware

    Other issues that can cause a shutdown are less common and more difficult to trouble-shoot, so I recommend confirming this isn't the issue first, then return to this thread with whatever you learn.

    Rob

    1 person found this answer helpful.
    0 comments
  4. Anonymous
    2021-01-22T21:50:52+00:00

    I want to thank you for your second reply, and I accept it as the Answer, after I preformed some scientific method on the problem, it did conclude your facts. You are also correct that I did mention the reboot happened some time in the process, this was because when I start a Full scan I tend to go make coffee or get a snack, only to find the reboot has happened on my return. Upon my investigation (based on your answer,) the fault is intermittent but will be reproduce 95% of each scan. So, I dug a little deeper and really put the screws to the CPU and found that I can cause 100 CPU usage which leads directly to the overheat condition.

    Since it was hard to imagine my "Ferrari" fresh of the boat was in such drama, that is why my post requested some fact find tools. I am under warrantee and have contacted the support for further evaluation and were able to provide the facts.

    I appreciate your second answer and thank you for the details that I needed to troubleshoot and agree with your diagnosis. I needed the tools to understand, because what is the point of having a "Ferrari" of a computer without keeping her healthy?

    Peace out.

    0 comments