Twice now I've had issues while running a full system scan. The first time I set my computer to run a full system scan with Norton Security. When I came back to my computer either the system restarted or Norton crashed and restarted.
Today I was running a full system scan again and when I got back to my computer it was turned off. I checked my power plan options and none of them are set to turn off the system. "When items are complete, computer should stay on" is set.
Here is something I found in the event log;
Log Name: System
Source: EventLog
Date: 1/3/2016 11:01:38 PM
Event ID: 6008
Task Category: None
Level: Error
Keywords: Classic
User: N/A
Computer: SGFC
Description:
The previous system shutdown at 10:50:07 PM on 1/3/2016 was unexpected.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="EventLog" />
<EventID Qualifiers="32768">6008</EventID>
<Level>2</Level>
<Task>0</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2016-01-04T05:01:38.737269300Z" />
<EventRecordID>10665</EventRecordID>
<Channel>System</Channel>
<Computer>SGFC</Computer>
<Security />
</System>
<EventData>
<Data>10:50:07 PM</Data>
<Data>1/3/2016</Data>
<Data>
</Data>
<Data>
</Data>
<Data>309</Data>
<Data>
</Data>
<Data>
</Data>
<Binary>E007010000000300160032000700C801E007010001000400040032000700C8013C0000003C000000000000000000000000000000000000000100000000000000</Binary>
</EventData>
</Event>
Here is an article about Event ID 6008; https://support.microsoft.com/en-us/kb/326564 It sounds like this might be caused by Norton. Since I believe Norton uses "InitiateSystemShutdownEx" to shut down from "When items are complete, computer should".
Here is the event log from the first time I noticed the problem;
Log Name: System
Source: Service Control Manager
Date: 12/30/2015 10:50:36 PM
Event ID: 7031
Task Category: None
Level: Error
Keywords: Classic
User: N/A
Computer: AMDFXWIN10
Description:
The Norton Security service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
<EventID Qualifiers="49152">7031</EventID>
<Version>0</Version>
<Level>2</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x8080000000000000</Keywords>
<TimeCreated SystemTime="2015-12-31T04:50:36.287780400Z" />
<EventRecordID>10229</EventRecordID>
<Correlation />
<Execution ProcessID="736" ThreadID="840" />
<Channel>System</Channel>
<Computer>SGFC</Computer>
<Security />
</System>
<EventData>
<Data Name="param1">Norton Security</Data>
<Data Name="param2">1</Data>
<Data Name="param3">120000</Data>
<Data Name="param4">1</Data>
<Data Name="param5">Restart the service</Data>
<Binary>4E0053000000</Binary>
</EventData>
</Event>