Which Process/Service Keeps Restarting My PC Daily?

[LanceX]

The computers we use at my job run Windows XP Professional. The computers restart at exactly the same time each morning at 5am. What I'm trying to do is learn as much as possible about what is causing the restart so that I can prevent it.

There have been times where I'll be working on a very important project, the computer will restart, and I will lose significant progress. It isn't the sort of work where you can just hit "Save" and continue where you left off after the restart.

If there is a process running that is causing the restart, I want to be able to identify it so that I can "End" it when necessary. If the restart is being caused by a Windows service then I want to be able to identify it so I can "Stop" and/or "Disable" it when necessary.

I will tell you what steps I've taken and what I've learned. I'm hoping that someone can provide some insight or advice on what I should try next.

Note: I have administrative rights. All steps taken were done with admin privileges active.

a) I've tried the "Start>Run>shutdown -a" method in an attempt to halt the restart when it begins. It didn't work. The restart still occurred at 5am.


b) I tried changing the Windows clock in an attempt to delay the restart. It didn't work. The restart still occurred at 5am.


c) I tried disabling the Windows Time service in Control Panel>Administrative Tools>Services. It didn't work. The restart still occurred at 5am.


d) I tried methods b and c simultaneously. It didn't work. The restart still occurred at 5am.


e) I thought that the restart might be triggered remotely so I disconnected the Ethernet cable from the computer. It didn't work. The restart still occurred at 5am.


f) I tried looking into Control Panel>Task Scheduler to see if the restart was a scheduled task. It wasn't.


g) I tried looking more deeply into the Task Scheduler via the command prompt to see if perhaps there was a scheduled task that was being hidden from the Task Scheduler GUI. There wasn't.


h) I tried looking through the list of running processes (over 50) in Task Manager to see if any of the names seemed like they might be related to restarting or shutting down etc. but nothing stood out.


i) I tried making a list of all processes running before 4:30am to see if any new processes were started between 4:30am and 5am. This wasn't helpful.


j) I tried downloading and using Process Explorer in the hope that it might be able to identify the process that's causing the restart. If the program is capable of doing this then I'm not sure how. Process Explorer seemed to provided a lot of information on each process but nothing that helped me uncover what the intended function of said process was.


I've been trying to solve this puzzle for weeks now. The more time I invest in it, the harder it is for me to give up. Any help would be greatly appreciated. Thank you so much!

 

[Emerald]

anything in the log files?

 

[LanceX]

Thank you for your response!

I tried checking through all the different logs available in Event Viewer. I looked for events that had taken place between 4am and 5am on various days to see if any processes were started or any services were activated etc. but there was nothing relevant. This leads me to believe that the process/service is always running in the background from the point that the PC starts up. It's a Startup service/process.

Here is some additional information that may be helpful:


a) The computer will not restart at 5am when in Safe Mode.

b) There is a separate application that notifies you about the computer's upcoming restart. The process in Task Manager is "SysNotifier.exe." A window titled "Auto-Restart" will pop up in the lower right corner of the screen starting 30 minutes prior to the actual shutdown and every five minutes after that. So it will appear at 4:30, 4:35, 4:40, 4:45, 4:50, and 4:55. But killing the "SysNotifier.exe" process does not prevent the restart. I wonder if there's a way for me to find out what other processes SysNotifier is related to or communicating with or dependent upon. Maybe I can uncover the shutdown application's identity that way.

 

[Emerald]

have you ran a full scan with Malwarebytes in Safe Mode with Networking?

if not first run Rkill and then Malwarebytes

 

[LanceX]

Malwarebytes? Would that really help in this situation? I'm not looking for malware. I'm looking for a legitimate process/service installed on the computer intentionally by my employer. The restart occurs each night so the computers can receive crucial updates. I understand that these updates are important and I'm not trying to prevent them from happening. I just want to be aware of which process/service is causing the restarts to that in the rare case that I'm in the middle of working on something important, I can delay the restart. Then when I finish my work I'll just restart the machine manually.

Do you still think a Malwarebytes scan would help with that?

 

[Emerald]

http://www.file.net/process/sysnotifier.exe.html

http://www.superantispyware.com/definition/sysnotifier/

 

[LanceX]

Both of the pages you reference state that sysnotifier.exe MAY not be safe. Neither one of those pages definitively labels it as threat. Malware and viruses are the least of my concerns. Our company takes substantial defensive measures against such threats with our firewall and anti-virus services. I assure you that if sysnotifier.exe is running on our machines it's because our company wants it to be there.

 

[Emerald]

have you talked to your IT department?

there are settings in the Domain Group policies or update services that could cause this behavior, and there is nothing you can do about it as a local admin since that is set by the server when you log on to the domain network account.

 

[LanceX]

Well if that's the case how would I go about determining that for sure? How would I go about checking what the domain group policies currently are? I understand that I may not be able to change them but can I at least see them? And these "update services" that you mentioned, can I find out if one or more of them are active on the machine?

I don't think my IT department would help me. They would just tell me that the restarts are in place for a reason and shouldn't be circumvented. They would just tell me to be more cautious about what I was working on when the restart time was drawing close.