Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

2am Wake-up


  • Please log in to reply
14 replies to this topic

#1 EmbraFella

EmbraFella

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:03:14 AM

Posted 25 September 2017 - 02:19 PM

I've noticed my PC will wake up at 2am sometimes. Not a huge problem, but a mystery none the less. I put it into sleep mode, and in the morning it's chugging away. Over the months, and late night working, I've found it wakes up at 2am on the dot.

 

Anyone want to help me diagnose what's triggering this? I've not got a clue where to start.



BC AdBot (Login to Remove)

 


#2 hamluis

hamluis

    Moderator


  • Moderator
  • 56,272 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:10:14 PM

Posted 25 September 2017 - 03:19 PM

The default time for downloading updates for your AV or Windows Update...would be my guess.  I would take a look at scheduled tasks.

 

Louis



#3 EmbraFella

EmbraFella
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:03:14 AM

Posted 25 September 2017 - 05:27 PM

How would I check that so I don't miss any hidden in an account?



#4 hamluis

hamluis

    Moderator


  • Moderator
  • 56,272 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:10:14 PM

Posted 26 September 2017 - 04:50 AM

Please Publish a Snapshot using Speccy taking care to post the link of the snapshot in your next post.

   Go to Piriform's website, and download the free version on the left.  Click Download from Piriform.com (the FileHippo link requires an extra click). Or if you want to use a portable version of Speccy (which doesn't require installation), click the builds page link and download the portable version. You will now be asked where you want to save the file. The best place to put it is the Desktop, as it will be easy to find later.

    After the file finishes downloading, you are ready to run Speccy. If you downloaded the installer, simply double-click on it and follow the prompts until installation is complete. If you downloaded the portable version, you will need to unzip it before use. Right-click the ZIP file and click Extract all. Click Next. Open up the extracted folder and double-click on Speccy.
 
     Once inside Speccy, it will look similar to this (with your computer's specifications, of course):
 
post-33068-0-86653600-1480692866_thumb.j

     Now, at the top, click File > Publish Snapshot.

     Click Yes > then Copy to Clipboard

Now, once you are back in the forum topic you are posting in, click the ADD REPLY or REPLY TO THIS TOPIC button. Right-click in the empty space of the Reply box and click Paste. Then, click Add Reply below the Reply box.

Louis



#5 EmbraFella

EmbraFella
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:03:14 AM

Posted 26 September 2017 - 07:30 AM

Thanks, there ya go.

 

http://speccy.piriform.com/results/ajhNLzo0HhHnKQlABSAvsi8



#6 hamluis

hamluis

    Moderator


  • Moderator
  • 56,272 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:10:14 PM

Posted 26 September 2017 - 09:08 AM

Your scheduled tasks:

 

26/09/2017 13:33;: GoogleUpdateTaskMachineUA
26/09/2017 13:56;: DropboxUpdateTaskUserS-1-5-21-3817140114-3010455988-3021792809-1001UA
26/09/2017 14:04;: Adobe Flash Player Updater
26/09/2017 14:08;: GoogleUpdateTaskUserS-1-5-21-3817140114-3010455988-3021792809-1000UA
26/09/2017 14:09;: DivXUpdate
26/09/2017 14:17;: G2MUpdateTask-S-1-5-21-3817140114-3010455988-3021792809-1001
26/09/2017 14:22;: G2MUploadTask-S-1-5-21-3817140114-3010455988-3021792809-1001
26/09/2017 15:56;: DropboxUpdateTaskUserS-1-5-21-3817140114-3010455988-3021792809-1001Core
27/09/2017 00:00;: Adobe Acrobat Update Task
27/09/2017 00:33;: GoogleUpdateTaskMachineCore
27/09/2017 02:07;: GoogleUpdateTaskUserS-1-5-21-3817140114-3010455988-3021792809-1000Core
30/09/2017 00:51;: Adobe Flash Player PPAPI Notifier
0615tbUpdateInfo
0715tbUpdateInfo
CCleanerSkipUAC
CreateChoiceProcessTask
GlaryInitialize 5
GMHSkipUAC
GU5SkipUAC
Opera scheduled Autoupdate 1434968847
Spybot - Search & Destroy - Scheduled Task

 

Louis



#7 EmbraFella

EmbraFella
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:03:14 AM

Posted 26 September 2017 - 06:09 PM

Well nothing there scheduled for 02:00 on the nose or am I missing something?



#8 hamluis

hamluis

    Moderator


  • Moderator
  • 56,272 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:10:14 PM

Posted 26 September 2017 - 06:43 PM

Well...some things don't reflect the times that they are scheduled.

 

IMO, you have a ton of scheduled tasks but that's your option.  If it were me...I would change the scheduled times for those which are known...and remove the others.

 

I fail to see the point of a scheduled task which takes place when I am not on the system.  I turn my system off when I go to bed, since no one is going to be using it (I live alone).

 

Anyway...scheduled tasks would be my best guess...nothing else makes any sense at all.

 

I don't see Windows Update on that list...but, in my location, the default time used by Windows for autoupdates is 0300/3 a.m.

 

Louis


Edited by hamluis, 26 September 2017 - 06:43 PM.


#9 joseibarra

joseibarra

  • Members
  • 1,257 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Downstairs
  • Local time:11:14 PM

Posted 26 September 2017 - 06:46 PM

What is the condition of your system prior to these incidents?

 

The only way it could be a Scheduled Task is if your system was in Sleep mode.

 

If it is hibernating or powered off (shutdown) it is impossible to be a Scheduled Task but could be a BIOS alarm (unlikely).

 

Anybody that thinks it might be a Scheduled Task, just try to set up a Scheduled Task on your own system to wake it up when it is shutdown and you will see what I mean, then tell us how that works out for you.  Can you get it to work?

It is more likely that your system is getting a "magic packet" from your Internet Service provider (ISP).

That means that even if the system is turned off, some systems have a feature that will wake them up when there is some activity on their Internet connection - even if the machine is powered off (that is by design and can be useful).

Sometimes this can be referred to as receiving a "magic packet" that is just what the system needs to see on the Internet connection to wake itself up.   Often these things seem to happen shortly after midnight when your Internet Service Provide (ISP) might be sending out these magic packets.

You can read some about it here:

http://support.microsoft.com/kb/810719

http://en.wikipedia.org/wiki/Wake-on-LAN

Wake on LAN (WoL) support is sometimes implemented in the motherboard of the computer.  Most modern motherboards with an embedded Ethernet controller support WoL so you need to find that option/feature and disable it.

To test the WoL theory, the next time you turn off your computer for the day, physically unplug the Internet connection from the computer and then wait (as long as you think it takes to convince you) and see if the system turns itself on or not when the cable is unplugged at the time you suspect - after waiting longer than it usually takes for it to turn on by itself (which may be overnight).  That means you may have to wait a day or two to test this idea.

There could be a setting in your system BIOS to enable/disable this feature or in your network card, but since we don't know anything about your system, that is just a guess.  You can look around in your system BIOS and see if you can spot this feature and disable it, save the setting and see how things look.

You might visit the manufacturers web site for your system of unspecified make and model to see how to disable this feature.

There could also be a setting to disable in the Properties of your network interface card to not allow the system to be started or come out of hibernation or standby/sleep on a signal from the device or router.  You can look in Device Manager and the Properties of your device for those settings and disable those features.

Look for a "Power Management" tab.

 

[attachment=198263:Untitled.jpg]

 

On my motherboard in the system BIOS settings under Power Management is a section called "Wake Up Setup Event" and under that are the various ways that one could configure the system to wake up from some event.  Under that section are things like keyboard, mouse and one is "Resume by Onboard LAN" which if I enable that, and the correct "magic packet" comes into the built in Ethernet connection, my system would startup by itself.

In Device Manager, Network adapter, for a NVIDIA network controller under Properties, Advanced there are settings called "Wake on Magic Packet" and "Wake on pattern Match" that can be disabled.

Try not to think of it as a Windows thing you need to change - it is more of a hardware thing that has to do with your motherboard and/or network interface and the way you connect to the Internet.

 

Another possibility is that if you have your system configured to allow a device (mouse or keyboard) to wake the computer with a click or key press and if you have cats they might be walking on your devices and waking the computer.


Edited by joseibarra, 26 September 2017 - 06:49 PM.

The mediocre teacher tells. The good teacher explains. The superior teacher demonstrates.


#10 hamluis

hamluis

    Moderator


  • Moderator
  • 56,272 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:10:14 PM

Posted 26 September 2017 - 08:34 PM

I've noticed my PC will wake up at 2am sometimes. Not a huge problem, but a mystery none the less. I put it into sleep mode, and in the morning it's chugging away. Over the months, and late night working, I've found it wakes up at 2am on the dot.

 

Anyone want to help me diagnose what's triggering this? I've not got a clue where to start.

 

Louis



#11 joseibarra

joseibarra

  • Members
  • 1,257 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Downstairs
  • Local time:11:14 PM

Posted 27 September 2017 - 03:23 AM

Ah-ha - Louis shows me I am negligent in my reading of details.

 

You can use the 'powercfg' command from a command prompt window and the Event Viewer System log to get clues about why the system last woke up from sleep.

 

If it is a Scheduled Task the powercfg command and the Event Viewer System log will tell you what task woke the computer.

 

Here are some examples:

 

Open a Command Prompt windows as Administrator like this:

 

[attachment=198282:3.jpg]

 

Then type this command followed by the Enter key:

 

powercfg   -lastwake

 

I created a Scheduled Task called 'Command Prompt' and it woke my system from Sleep so the powercfg command reveals:

 

[attachment=198280:1.jpg]

 

Then you can look in the Event Viewer System log for an Event from source Power-Troubleshooter and where the Event ID is 1:

 

[attachment=198281:2.jpg]

 

If the system woke from a keyboard stroke the information will read like this:

 

Wake History Count - 1
Wake History [0]
  Wake Source Count - 1
  Wake Source [0]
    Type: Device
    Instance Path: ACPI\PNP0C0C\aa
    Friendly Name:
    Description: ACPI Power Button
    Manufacturer: (Standard system devices)

System Event ID 1 from Source Power-Troubleshooter says:

The system has resumed from sleep.
Sleep Time: ?2017?-?09?-?27T07:50:51.457200000Z
Wake Time: ?2017?-?09?-?27T07:50:58.732400000Z
Wake Source: Device -ACPI Power Button

 

If the system woke from a mouse click the information will read like this:

 

Wake History Count - 1
Wake History [0]
  Wake Source Count - 1
  Wake Source [0]
    Type: Device
    Instance Path: HID\VID_046D&PID_C077\6&28d66f47&0&0000
    Friendly Name:
    Description: HID-compliant mouse
    Manufacturer: Microsoft

 

The system has resumed from sleep.
Sleep Time: ‎2017‎-‎09‎-‎27T08:56:52.249400000Z
Wake Time: ‎2017‎-‎09‎-‎27T08:56:57.780200000Z
Wake Source: Device -HID-compliant mouse

 

 

So when you find your system running from Sleep you need to use the powercfg command and/or Event Viewer System log to tell you what woke it.
 

 


Edited by joseibarra, 27 September 2017 - 04:00 AM.

The mediocre teacher tells. The good teacher explains. The superior teacher demonstrates.


#12 EmbraFella

EmbraFella
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:03:14 AM

Posted 29 September 2017 - 06:31 AM

Thanks. That looks like a more specific means of diagnosis.

 

I'll leave my PC sleeping these next few nights and see if I can catch it, then report back.



#13 joseibarra

joseibarra

  • Members
  • 1,257 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Downstairs
  • Local time:11:14 PM

Posted 29 September 2017 - 06:57 AM

Sounds like a plan.

 

You might still have some of those events in your event log if you click the Event ID column header once or twice so all the ones are at the top:

 

[attachment=198359:Untitled.jpg]

 

 

For completeness I wish I had an example of a "Magic Packet" wake up but don't know how to simulate that.

 

I have all that stuff disabled but I could enable it all again and see if my poor system will wake up some night.

 

It would be nice to have a reusable copy/paste that handled all the "What woke my computer from sleep" conditions but three is better than none.


Edited by joseibarra, 29 September 2017 - 06:59 AM.

The mediocre teacher tells. The good teacher explains. The superior teacher demonstrates.


#14 EmbraFella

EmbraFella
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:03:14 AM

Posted 13 November 2017 - 06:40 AM

Well after a period of peace and quiet, it happened again this morning.

 

Ran powercfg -lastwake and got

 

Wake History Count - 1
Wake History [0]
  Wake Source Count - 1
  Wake Source [0]
    Type: Wake Timer
    Owner: [PROCESS] \Device\HarddiskVolume1\Windows\System32\svchost.exe
    Owner Supplied Reason: Task Scheduler will execute '\SUPERAntiSpyware Scheduled Task 3067663d-a69a-4a50-a338-50ea3b4efe71' task.
 
Looked in Event Viewer for the "1" event and found
 
The system has resumed from sleep.
 
Sleep Time: 2017-11-13T01:02:42.015700000Z
Wake Time: 2017-11-13T01:59:37.143500000Z
 
Wake Source: Timer - Task Scheduler will execute '\SUPERAntiSpyware Scheduled Task 3067663d-a69a-4a50-a338-50ea3b4efe71' task.

 

 

But I noticed another "1" just below it that 

 

The system time has changed to ‎2017‎-‎11‎-‎13T01:59:34.500000000Z from ‎2017‎-‎11‎-‎13T01:02:57.156700000Z.

 

There were no entries below it after I'd put the PC into sleep mode.

 

What triggered the time change? Would it be the system time being updated by the BIOS ie the hardware telling the OS what the time was?

 

Next puzzle is what's "SUPERAntiSpyware" since I can't find it as an installed program and it doesn't appear in the list of scheduled tasks. But it gets worse. When I scanned the registry for "SUPERAntiSpyware" I got several entries and it eventually pointed me to C:\Users\Administrator\AppData\Roaming\SUPERAntispyware.com\SUPERAntiSpyware so I logged in as admin and tried to dig down via Windows Explorer. No joy. The AppData folder wasn't visible which is a puzzle. Opened a DOS box and dug down. Again, AppData isn't listed but I could cd into it. Dir listing had several folders, but no SUPERAntiSpyware.com one. Tried cd'ing into it but no folder.

 

So by now I'm doubting my ability to spell and type. Back into regedit, scan for "SUPERAntiSpyware" and nothing found.

 

Have I gone barking mad? Had SUPERAntiSpyware half uninstalled and finished the job when I logged in as admin? Something I very rarely do.



#15 Guest_Joe C_*

Guest_Joe C_*

  • Guests
  • OFFLINE
  •  

Posted 13 November 2017 - 08:59 AM

You could install Super Antispyware

http://www.superantispyware.com/download.html

and then after a reboot remove it with Revo Uninstaller,

https://www.revouninstaller.com/revo_uninstaller_free_download.html

that should get everything out, especially that scheduled task.

(get the free versions)

You can also use Autoruns to check your scheduled task list and control those tasks through Autoruns

https://docs.microsoft.com/en-us/sysinternals/downloads/autoruns

(be sure to read all documentation before using Autoruns)

 

If the clock on your pc is set to use internet time, then that might be the reason for the time change

The "App Data" folder is a hidden folder, you can use the folder options in the control panel to show hidden files/folders


Edited by Joe C, 13 November 2017 - 09:11 AM.





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users