Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Mysterious laptop wake up (logon 5)


  • Please log in to reply
5 replies to this topic

#1 resertedlab

resertedlab

  • Members
  • 143 posts
  • OFFLINE
  •  
  • Local time:02:10 PM

Posted 17 November 2016 - 11:49 PM

Friends i've been off for sometime but here is what happened. About month ago i reseted my laptop back to factory settings which returned it to Windows 8, i tried to updated it back to Windows 8.1 in order to reinstall it later but the upgrade failed. I was adviced from other forum members for possible reasons and solutions but i am way to bussy in the last few weeks and i keep working on Win 8 state, although windows warns me it's outdated. Since i dont 100% trust my machine i usually shut it down when i go to sleep. But few days ago i i just logged out and let it sleep, and a half an hour later i saw that the battery light was on, which indicated that the battery was charging, although the charger was constantly on and there was no power shutdown or anything like that. I woke up the machine and saw that it said its on 99% and reamined like that for couple of minutes till it reached 100. Apart from that, i notice that recently when i close the lid and let the laptop in sleep mode, the mouse lights remain active (its cable connected mouse), i believe in the past it was shutting the mouse light off. Anyway last night i decided not to shut down but just let it in sleep mode again and in the middle of the night i heard the power sound that starts when you start the machine. The laptop started and fell alseep on its own again at the moment, but this time the small light that usually is bleeping, indicating the machine is in sleeping, was completely off. I thought the machine had shut down itself, but when i opened the lid and pressed the start button it turned on without showing the start Dell logo, as if it was only asleep. I started to worry that i was remotely accessed but Remote assisstance was not allowed, also the net cable was plugged off and wifi turned off as well. I checked the even viewer and it showed that in 2:02 am there was logon 5 attempt? Usually its logon 2, and i found in the web that logon 3 is responsible for network waking, while logon 5 is something with the system? Anyone aware what could have happened? Is it something with the outdated windows, because that have never happened to me before? Thanks :)


Edited by resertedlab, 17 November 2016 - 11:54 PM.


BC AdBot (Login to Remove)

 


#2 technonymous

technonymous

  • Members
  • 2,520 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:04:10 AM

Posted 18 November 2016 - 12:27 AM

It sounds like it was just an important wake timer and nothing to be concerned about. You can disable that....

 

Go to search type powercfg.cpl.

Next, you will see your performance plan your system is using.

Click on "change plan settings".

Next, click on "change advanced power settings". 

Next, scroll down and open Sleep and then open Allow wake timers.

From there you can select enable/disable/important Wake Timers Only.



#3 Didier Stevens

Didier Stevens

  • BC Advisor
  • 2,753 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:01:10 PM

Posted 18 November 2016 - 06:50 AM

Logon type 5 is a service that logs on with its credentials, e.g. a service that starts.


Didier Stevens
http://blog.DidierStevens.com
http://DidierStevensLabs.com

SANS ISC Senior Handler
Microsoft MVP 2011-2016 Consumer Security, Windows Insider MVP 2016-2019
MVP_Horizontal_BlueOnly.png

 

If you send me messages, per Bleeping Computer's Forum policy, I will not engage in a conversation, but try to answer your question in the relevant forum post. If you don't want this, don't send me messages.

 

Stevens' law: "As an online security discussion grows longer, the probability of a reference to BadUSB approaches 1.0"


#4 techghost

techghost

  • Members
  • 191 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:05:10 PM

Posted 18 November 2016 - 07:27 AM

Logon Type 5 is related to Service

Similar to Scheduled Tasks, each service is configured to run as a specified user account. When a service starts, Windows first creates a logon session for the specified user account which results in a Logon/Logoff event with logon type 5. Failed logon events with logon type 5 usually indicate the password of an account has been changed without updating the service but there’s always the possibility of malicious users at work too. However this is less likely because creating a new service or editing an existing service by default requires membership in Administrators or Server Operators and such a user, if malicious, will likely already have enough authority to perpetrate his desired goal.



#5 resertedlab

resertedlab
  • Topic Starter

  • Members
  • 143 posts
  • OFFLINE
  •  
  • Local time:02:10 PM

Posted 18 November 2016 - 08:47 AM

Hm, i seem unable to understand exactly what this logon 5 is about. What usually triggers this service or wake timer? What are the most common reasons for that to happen? And why it only lasted a few seconds and then the laptop, as i mentioned, stopped indicating that it is in sleep mode rather went blank as if shut down, but again it wasnt? Could it be some hardware problem, and if it was something like malware/spyware, how could it execute its orders when the internet connection was disabled? It just surprised me beacuse it never happened before, i am pretty sure that aftet that Factory reset most of the options are messed up right now.

Are there any risks if i disable this WakeUp timer?


Edited by resertedlab, 18 November 2016 - 08:48 AM.


#6 technonymous

technonymous

  • Members
  • 2,520 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:04:10 AM

Posted 19 November 2016 - 01:02 AM

Here is well done article all about troubleshooting all this. http://www.ghacks.net/2013/12/31/find-pc-wakes-stop/ The culprit is typically going to be MSFT tasks and services or keyboards, mouse, nic etc.






0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users