Why did my PC crash? Questions and short answers

Most "random" crashes come from one of four things: a driver (often graphics), unstable memory or overclock, overheating, or the power supply. Windows records which one it saw — a blue screen leaves a bug check code (Event 1001), while a sudden power-off leaves only Kernel-Power Event 41. CrashWhy reads those records and tells you which kind of crash it was and what to check first.

By default Windows restarts automatically after a blue screen, so a crash often looks like a sudden restart. If a bug check code was saved (Event 1001), it was a blue screen; if only Event 41 or 6008 is there, the PC lost power or froze hard without writing a dump.

Repeated crashes with the same bug check code or the same driver usually point to that driver or to hardware (memory, GPU, power supply). Repeats with no blue screen point to power or heat. Keep a history: CrashWhy counts repeats so you can see whether a fix actually helped.

Games put the GPU, CPU and power supply under full load, so they expose weak power delivery, overheating, unstable overclocks and graphics driver problems. GPU driver resets show up as live kernel events; full power-offs show up as Kernel-Power Event 41 with no blue screen.

The most common reason is Windows Update finishing an install outside your active hours. Windows logs who started a restart in Event 1074 (for example, TrustedInstaller or a specific program). If there is no 1074 entry, the restart was not planned — look for a crash or power loss instead.

Overnight restarts are usually Windows Update: it waits until you are inactive and outside your active hours, then restarts to finish installing. Event 1074 and the Windows Update history show the exact update. CrashWhy shows the restart reason and the update installed just before it.

A restart with no blue screen and no error usually means the PC lost power or hung so hard it could not write a crash dump. Windows records this as Kernel-Power Event 41 with bug check code 0. Typical causes are the power supply, a loose power cable, overheating or unstable memory settings. Dump-file viewers have nothing to show in this case; the event log does.

A sudden shut-off with no message is almost always power or heat: the power supply cutting out, a thermal shutdown, or a hardware fault. Windows logs Event 41 and Event 6008 ("the previous system shutdown was unexpected") on the next boot. If it happens mostly under load, suspect the power supply or cooling first.

Kernel-Power Event 41 means Windows restarted without shutting down cleanly first. It is a symptom, not a cause. If the event includes a bug check code, there was a blue screen; if the code is 0, the PC lost power or stopped responding. CrashWhy reads this event together with the others around it to tell those cases apart.

Windows keeps crash information in three places: the System event log (Event Viewer → Windows Logs → System; look for Event 41, 6008, 1001 and 1074), Reliability Monitor (search "reliability history"), and dump files in C:\Windows\Minidump and C:\Windows\MEMORY.DMP. CrashWhy reads these for you and puts the answer in one place.

Both analyse crash dump files from blue screens: BlueScreenView (NirSoft, freeware) lists each dump with its bug check code and the drivers involved; WhoCrashed (Resplendence) reports which driver is likely responsible. Neither is built for crashes that leave no dump. CrashWhy focuses on the event logs, so it also explains power-offs and restarts. See the BlueScreenView and WhoCrashed comparisons.

CrashWhy analyses your PC on your PC — crash records, event logs and the process list are not uploaded. Only three things ever go over the internet: the Pro license check, the update check (which sends the version number), and an optional crash report that is off by default. There is no account. Details are in the privacy policy.

Yes, CrashWhy is free to download and use, and the free version checks every crash, shutdown and restart Windows has already logged. Pro is a one-time $19 for up to three PCs and adds a 30-day history that CrashWhy keeps itself (so it survives after Windows clears its logs) with repeat detection, alerts by Telegram, Discord or email, warnings when a new program sets itself to start with Windows, and one-click fixes. See pricing.

Yes. CrashWhy is built for Windows 10 and Windows 11 (64-bit). There is no Mac version yet.

Microsoft Defender SmartScreen shows this for new programs that have not yet been downloaded by many people. Check the SHA-256 checksum on the download page; if it matches, choose More info → Run anyway.

No — CrashWhy is not an antivirus. It shows whether Microsoft Defender is on, whether potentially unwanted app blocking is enabled and when the last scan ran, and it lists programs that start with Windows (Pro warns when a new one appears). Removal is done by Defender or another security tool.