Kaspersky is restarting my Computer

[advancedUser]

When I lookup the restart reason of my computer in “eventvwr.msc” I see the following:

avp.exe has initiated the restart of computer on behalf of user NT AUTHORITY\SYSTEM for the following reason: No title for this reason could be found

(Event ID 1074)

I’m quiet unhappy about this cause I had important stuff open and I can’t find settings regarding this issue.

If there is no easy solution to this I will stop recommending kaspersky and will not buy it anymore

[Wesly.Zhang]

Hello,

Was klflt.sys involve in this issue ?

Have you installed 2021 mr3 ?

Regards.

 

[advancedUser]

Thank you for your fast answere

I didn’t find anything according to “klflt.sys”

I don’t think (if this is a windows update, the last one is 2021-02, but this should not affect kaspersky in anyway)

 

 

[Wesly.Zhang]

Thank you for your fast answere

I didn’t find anything according to “klflt.sys”

I don’t think (if this is a windows update, the last one is 2021-02, but this should not affect kaspersky in anyway)

 

 

Hello,

There are maybe have a problem or log event with syetem using System API InitiateSystemShutdown* functions or shutdown command. It’s callback reason result is

https://docs.microsoft.com/en-us/windows/win32/shutdown/system-shutdown-reason-codes

Does this event often occur ? Reason code is 0x40000, it means the reboot requirment is from avp itself (Application issue).

Right-click on Start icon

Select Windows Powershell (Admin) from the menu

Copy and Paste the following command below and press Enter

Copy and paste the contents or upload the text file to your reply

Get-WinEvent @{LogName="System"; ID=1074} | Format-List | out-file c:\events.txt
Notepad c:\events.txt

If I guess corrctly. AVP (Product) want to upgrade itself after a system reboot or doing a  advanced disinfection operation to deal with malware and registered a system reboot plan.

Regards.

[advancedUser]

I don’t think avp did anything after a restart cause I didn’t restart and I also disabled auto restarts after windows updates (this is the reason why I investigated on this issue)

 

 

[Wesly.Zhang]

Hello,

I see the 1074 event id related to avp is the only one? You’d better create a support ticket to KL. Let them explain the event log for avp if you don’t trust my post.

Regards.

[advancedUser]

Hello,

I just googled where to find shutdown/restart reasons and the event I found contained information about avp. I will look at events in the same timeframe and check if there is something about avp there too.

I didn’t want to say that I don’t trust your statement, but I have a strong feeling that avp has something to do with it since it is namely mentioned in the shutdown event.

If another unexpected restart/shutdown happens I will post here.

Do you know If I can use my “Kaspersky Internet Security” License for “Kaspersky Anti Virus”?

[advancedUser]

I checked the Event log and there is no event shortly before the 1074 event, all are afterwards (likely connected to shutdown, but I don’t have much windows experience)

The error which happend before is “Unable to start a DCOM Server” which I think is unrelated.

 

[Schulte]

Hello @advancedUser,

is 'Kaspersky Safe Kids' installed?
Patch ‘h’ is currently being distributed for this, which prompts for a restart after 24 hours.

[advancedUser]

@Schulte no, it is greyed out in the overview and has a download symbol next to it, when I press it it asks me if I want to install it for free

So there is a chance that some other components of Kaspersky trigger a reboot?

I’m looking for a way to disabled this without deinstallieren Kaspersky since I think it is a good piece of software. However I mainly need file antivirus and maybe ram antivirus.

[Duff]

I got the same issue today, no warning:
________________________________________
TimeCreated  : 5/20/2021 3:28:58 PM
ProviderName : User32
Id           : 1074
Message      : The process C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 21.3\avp.exe (MYPCNAME) has 
               initiated the restart of computer MYPCNAME on behalf of user NT AUTHORITY\SYSTEM for the following 
               reason: No title for this reason could be found
                Reason Code: 0x40000
                Shutdown Type: restart
                Comment: 
________________________________________

There are no events prior to this in the same timeframe. This is very discouraging as I was working at the time.

[KarDip]

I got the same issue today, no warning:
________________________________________
TimeCreated  : 5/20/2021 3:28:58 PM
ProviderName : User32
Id           : 1074
Message      : The process C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 21.3\avp.exe (MYPCNAME) has 
               initiated the restart of computer MYPCNAME on behalf of user NT AUTHORITY\SYSTEM for the following 
               reason: No title for this reason could be found
                Reason Code: 0x40000
                Shutdown Type: restart
                Comment: 
________________________________________

There are no events prior to this in the same timeframe. This is very discouraging as I was working at the time.

Hi @Duff 

Maybe you can stop Kaspersky rebooting by "command prompt”

Look below URL for all the "commands” to how use Kaspersky "command prompt

https://support.kaspersky.com/KAV/2017/en-EN/83989.htm

Thank you