My T60p shutsdown every night

[o1sowise]

I leave my T60p on all the time, I hardly ever shutdown (unless installing new software or crashes).

For the past few weeks, most days when I come down to my office, the T60p is powered off. Some days it stays up, but most days not. I cannot figure out what's causing it. Can anyone suggest where I could start looking to find out what is causing it?

I looked in the System Event log and in the Symantec/Norton log, but nothing sticks out as obvious.

HELP!

[ryengineer]

1. Look into Power options and see if something needs to be changed.

2. If the machine entirely runs on your adapter, make sure it's working properly.

3. Ask your co-workers (if any) about any possible wiring problem in the place.

4. Lastly if someone else has access to your office (like friends, co-workers, janitors), make sure they aren't fooling around.

[dsalyers]

A few somewhat stupid questions:

1) Is the power manager set to shut off the machine after a period of inactivity?

2) Is the battery level drained when you come in? I ask this because I diagnosed a similar problem were an employee had plugged their desktop into an outlet that was controlled by a switch. When the cleaning people left for the night they would turn off all of the switches, which included the one his machine was plugged in.

[o1sowise]

1. Look into Power options and see if something needs to be changed.

Nothing needs to be changed nor has anything been changed from what I always run.

2. If the machine entirely runs on your adapter, make sure it's working properly.

I have two batteries in, both are fully charged.

3. Ask your co-workers (if any) about any possible wiring problem in the place.

I'm in my home office, no elec problems that I know, and the batteries would take over if there were...

4. Lastly if someone else has access to your office (like friends, co-workers, janitors), make sure they aren't fooling around.

Nope. But I like the way you think

[o1sowise]

1) Is the power manager set to shut off the machine after a period of inactivity?

How do I do that? I didn't see that option in any power settings...

2) Is the battery level drained when you come in? I ask this because I diagnosed a similar problem were an employee had plugged their desktop into an outlet that was controlled by a switch. When the cleaning people left for the night they would turn off all of the switches, which included the one his machine was plugged in.

Good idea. I think they were 100% yesterday and they now show 99%. I don't know this is a clue or if they just flux between 100% and 99% normally.

[mitchellst]

I'm betting it's a hardware issue. If you can't find a solution, I'd send it somewhere to get it repaired (assuming it's under warranty). I'm not really sure what would cause that. I guess it could be overheating. It may just need a new fan.

[jeffm]

When you restart in the morning does windows say anything about an unusual shutdown? If not, your computer is not losing power.

In one of the companies I used to work for, they would send out software updates at night and remotely shutdown or reboot all the computers.

[tomh009]

Two things: first, in Administrative Tools > Local Security Policy, turn on process auditing at night before you leave. When you arrive in the morning, you can then check the security log to see whether the various processes on the system were shut down, and at what time. (Turn off auditing at this point.)

If you see that the processes did get shut down, the shutdown is almost certainly software-induced, and something is causing the system to do a shutdown. The timestamp for those process exit messages should help you track down what was going on (and there may be a process start event just before those that relates to the shutdown).

If there process exit messages were not there, then something hardware-related may be doing it. Create a small batch file, something like timestamp.cmd:

Code: Select all

:top
time /t >> timestamp.log
ping 127.0.0.2 -n 60 -w 1000 > nul
goto :top

Start it running at night, and in the morning examine the timestamp.log file to see what time your system stopped running. You can now start tracking down whether there is an external environmental event at that time of night ...

[o1sowise]

I'm betting it's a hardware issue. If you can't find a solution, I'd send it somewhere to get it repaired (assuming it's under warranty). I'm not really sure what would cause that. I guess it could be overheating. It may just need a new fan.

It's fairly new, <3 months. I only noticed it after I went thru a metal detector that I've never been thru before.

[o1sowise]

When you restart in the morning does windows say anything about an unusual shutdown? If not, your computer is not losing power.

Nope. Outlook does tell me that my PSTs were not closed properly, but that's expected with a sudden crash.

[jeffm]

Outlook does tell me that my PSTs were not closed properly...

That's not definitive proof that you had a power loss. It just means outlook wasn't shutdown properly.

If you had a power loss Windows would prompt during re-boot to use safe mode or continue with a normal boot. If you're not seeing that, then I wouldn't suspect a sudden power loss.

[GomJabbar]

Two other things that might cause this. This assumes however that your ThinkPad is running on batteries and not on AC power.

If your ThinkPad is in Suspend mode when you leave it, the timer might be set to Hibernate after a period of time. Sometimes when a ThinkPad wakes up from Suspend to go into Hibernation, it does not enter Hibernation, and it does not reenter Suspend so it is left on. In this case it would shut off when the batteries were drained either to the critical level setting in Power Options, or just drained to the point the ThinkPad could no longer run.

If your ThinkPad is in Suspend mode and you have a Scheduled task to run whether in Control Panel > Scheduled Tasks, or Away Manager, or somewhere else, that may be waking up your computer which will again drain the batteries.
--------------------

One possible solution or work around for you could be to leave your ThinkPad in Hibernation mode when you leave the office. Resuming from Hibernation should be somewhat faster than booting up cold.

If your ThinkPad is left plugged in, you might be losing AC power sometime during the night for whatever reason (as mentioned above). Another possibility I suppose, could be some program that runs itself and tells the computer to shut down when it is finished. Or maybe some program is set to run, such as a Virus scan, that causes something to overheat after a period of time, shutting down your laptop.

[o1sowise]

Two other things that might cause this...

I leave my T60p lid open with Windows XP running.
It's also plugged-in with two fully-charged batteries.
When I left the laptop last night, the batteries showed 99%, and they still show 99% this morning.
I disabled Hibernation two days ago and it still failed last night around 9pm.
I know Symantec/Norton AntiVirus runs then.
My backups do not run until much later in the night...

[tomh009]

Is it always shutting down at around 9 PM?

Did you try turning on the process auditing to determine whether it's software doing it?

[Zeus]

what applications do you leave running?

[smugiri]

Maybe the laptop has a wake up / turn off time scheduled in the BIOS?

You can see it in the T60 BIOS simulator here under 'Config' -> 'Power' menu items.

[o1sowise]

I run NAV (AntiVirus) @ 9pm, Connected (Backup) @ 10:45p and Ghost (Backup) @ midnight.

I just changed NAV to 4am, to see if that does anything...

Strange...
It turned off last night @ 10:30p, before any of the three processes mentioned above even started.
Back to square one.

Just now, I ran all three of the above processes simultaneously, and the T60p did not power-off.

[o1sowise]

I found a clue.
I run BOINC. Looking in stdoutgui.txt, I found this error each time my PC shutsdown:

Code: Select all

[02/22/07 22:28:11] TRACE [5176][02/24/07 08:30:13] TRACE [2184]: RPC_CLIENT::init connect 2: Winsock error '10061'

I'm not yet sure if this is the problem or a symptom.

[jeffm]

Winsock error 10061 is WSAECONNREFUSED:

No connection could be made because the target computer actively refused it. This usually results from trying to connect to a service that is inactive on the foreign host—that is, one with no server application running.

So, your computer is trying to make a network connection to another computer and then shutting down because the connection failed. That sounds like really bad software.

Try removing or disabling BOINC. Actually, BOINC requries a logged in user (I think), so you could just try logging out at night to see if the problem stops. If so, I would just remove it.

[o1sowise]

Winsock error 10061 is WSAECONNREFUSED:

No connection could be made because the target computer actively refused it. This usually results from trying to connect to a service that is inactive on the foreign host—that is, one with no server application running.

Thanks for looking up the error.
I've been running BOINC for years, so I know it's not really bad software. It may be a bug, but it's not really bad stuff.
I'll follow-up with the BOINC people.
Thanks again.

[GomJabbar]

Here are some possible things I think might be causing this.

1st: you have been infected with a Virus such as Sassar.
2nd: you are not running a good Firewall, or else it is not properly configured.
3rd: you have not kept your copy of Windows thoroughly up to date with the security updates.
4th: you do not have a good AntiVirus program, or you haven't been keeping it up to date.

Take a gander at the following thread I pulled up on a quick Google search.

http://www.experts-exchange.com/OS/Micr ... 58211.html

[o1sowise]

Here are some possible things I think might be causing this.

Thanks

1st: you have been infected with a Virus such as Sassar.

Interesting. Symantec/NAV didn't find it, but I'll search their DB for that specific virus.

2nd: you are not running a good Firewall, or else it is not properly configured.

Do you consider the Windows Firewall good?

3rd: you have not kept your copy of Windows thoroughly up to date with the security updates.

Weekly.

4th: you do not have a good AntiVirus program, or you haven't been keeping it up to date.

NAV. Weekly.

Take a gander at the following thread I pulled up on a quick Google search.

http://www.experts-exchange.com/OS/Micr ... 58211.html

Looks interesting. Are you a member? Is the answer good enough to pay for?

btw - I cannot seem to fix the bad e-mail error under my name in the left pane...

[GomJabbar]

No, I'm not a member of that forum.

I am thinking that you might be under attack for reasons other than the thread I posted above. For instance, the other day I was on AT&T's site downloading some files related to the federal excise tax refund. As soon as I clicked the download link, I received an incoming connection alert from my Kerio firewall. Normally I deny ALL incoming connections, but I got fooled this time thinking it was from AT&T and I allowed the incoming connection. Immediately I got a BSOD. Evidently someone was launching a DOS (Denial of Service) attack on me. AFAIK, no harm was done, but I did have to restart the computer. I receive these incoming connection alerts virtually every week. Where would I be without a firewall running to stop them and warn me? Windows firewall may be sufficient (I have it turned off), but I like a little more protection than it offers.

For my Anti-Virus protection, I use Kaspersky which checks online for updates every 3 hours by default. In addition, I always install the security updates from Windows Update whenever they are available. I take internet security seriously. Also I do not logon as Administrator for browsing the internet and routine tasks. I only log on as Administrator when I need to.

The Code you posted above with the Winsock error makes me think that your computer is trying to connect with the internet, or someone on the internet is trying to connect to your computer. This could be a possible indication of a Virus infection or a DOS attack.

[o1sowise]

... The Code you posted above with the Winsock error makes me think that your computer is trying to connect with the internet, or someone on the internet is trying to connect to your computer. This could be a possible indication of a Virus infection or a DOS attack.

Thank you very much, for the detailed explaination.

Do you know how I can tell which program is doing this RPC call, and if it's inbound or outbound?

[jeffm]

That's a WinSock client error - meaning your computer was attempting to make the connection.

I believe that stdoutgui.txt is BOINC specific - so BOINC was trying to make the connection and reported the error.

[o1sowise]

That's a WinSock client error - meaning your computer was attempting to make the connection.

I believe that stdoutgui.txt is BOINC specific - so BOINC was trying to make the connection and reported the error.

True, you're right on both accounts. It's BOINC specific and I was trying to connect.
Next questions are, "to whom" and "why did it crash"

[jeffm]

You might be able to answer the first question by turning on firewall logging:

http://support.microsoft.com/kb/875357

[o1sowise]

You might be able to answer the first question by turning on firewall logging:

http://support.microsoft.com/kb/875357

Perfect!

Thank you very much!

[o1sowise]

One think I did notice that was weird.

On Sat, right in front of me, the laptop went into Stand-by.
This morning, when I came down to the office, it was in Stand-by.

This begs two questions:
1. What's causing the auto Stand-by
2. Can too long in Stand-by mode, shutdown?

I checked all power settings and I do not have auto or timed stand-by...

[foxchi]

try to update ur BIOS