|
Posted by news.rcn.com on October 1, 2006, 10:31 am
If you were Registered and logged in, you could reply and use other advanced thread options
I am having a known problem in an unknown area: My Windows 2000 1.6 GHz AMD
K6 Compaq machine is continuously rebooting. The new problem appears to be
that it doesn't revolve in a continuous loop, the machine works for anything
from a few seconds to a few minutes before automatically rebooting. I
haven't found any reference to this on line
And it DOES connect to the Internet. I did manage to download multi_av and
run Trend and Kaspersky. Trend and Kaspersky found nothing, both in normal
and safe modes. I then tried to run Sophos and was running when I went to
bed, after which I woke up the next morning and found the computer at the
log in screen again, which indicates either that it found nothing or that it
simply rebooted before Sophos could find anything
Has anyone seen this before?
|
|
Posted by David H. Lipman on October 1, 2006, 10:54 am
If you were Registered and logged in, you could reply and use other advanced thread options
From: "news.rcn.com" <news.rnc.com>
| I am having a known problem in an unknown area: My Windows 2000 1.6 GHz AMD
| K6 Compaq machine is continuously rebooting. The new problem appears to be
| that it doesn't revolve in a continuous loop, the machine works for anything
| from a few seconds to a few minutes before automatically rebooting. I
| haven't found any reference to this on line
|
| And it DOES connect to the Internet. I did manage to download multi_av and
| run Trend and Kaspersky. Trend and Kaspersky found nothing, both in normal
| and safe modes. I then tried to run Sophos and was running when I went to
| bed, after which I woke up the next morning and found the computer at the
| log in screen again, which indicates either that it found nothing or that it
| simply rebooted before Sophos could find anything
|
| Has anyone seen this before?
|
Worms such as Lovsan/Blaster and DSasser and their successors; SDBot, RBot,
GAOBot, MyTob,
RadeBot, etc... would generate a 60 sec. NT AUTHORITY\SYSTEM shutdown message
such as...
NT AUTHORITY\SYSTEM
'c:\windows\system32\lsass.exe' terminated unexpectedly with status code
-1073741819
or
NT AUTHORITY\SYSTEM
Windows must now restart becuase the Remote Procedure Call (RPC) service
terminated
unexpectiedly.
With the RPC message, you can get that for "other" reasons not realted to worm
activity.
In all the above casees TCP protocols are exploited. TCP port 135 for RPC/RPCSS
DCOM and
TCP port 445 for the LSASS module. Using a simple NAT Router such as the
Linksys BEFSR41
greatly mitigates such internet worm port exploitations.
You have NOT shown any substantiating information to show this is worm
exploitation.
Most system aut-reboots are caused by hardware problems. CPU, RAM modules, CPU
fan, etc.
--
Dave
http://www.claymania.com/removal-trojan-adware.html
http://www.ik-cs.com/got-a-virus.htm
|
|
Posted by Phil Weldon on October 1, 2006, 12:02 pm
If you were Registered and logged in, you could reply and use other advanced thread options
| I am having a known problem in an unknown area: My Windows 2000 1.6 GHz
AMD
| K6 Compaq machine is continuously rebooting.
_____
Have you considered a hardware problem? That seems more likely than malware
since scans have found nothing.
Phil Weldon
"news.rcn.com" <news.rnc.com> wrote in message
|I am having a known problem in an unknown area: My Windows 2000 1.6 GHz AMD
| K6 Compaq machine is continuously rebooting. The new problem appears to be
| that it doesn't revolve in a continuous loop, the machine works for
anything
| from a few seconds to a few minutes before automatically rebooting. I
| haven't found any reference to this on line
|
| And it DOES connect to the Internet. I did manage to download multi_av and
| run Trend and Kaspersky. Trend and Kaspersky found nothing, both in
normal
| and safe modes. I then tried to run Sophos and was running when I went
to
| bed, after which I woke up the next morning and found the computer at the
| log in screen again, which indicates either that it found nothing or that
it
| simply rebooted before Sophos could find anything
|
| Has anyone seen this before?
|
|
|
|
Posted by news.rcn.com on October 1, 2006, 12:13 pm
If you were Registered and logged in, you could reply and use other advanced thread options
> Have you considered a hardware problem? That seems more likely than
> malware
> since scans have found nothing.
I was a bit scared to think about that as I wouldn't know how to isolate it.
But I was suspicious as there is never an error message, just a simple shut
down and restart. Does the OS generate a log anywhere which might enlighten
me?
|
|
Posted by Rhonda Lea Kirk on October 1, 2006, 12:49 pm
If you were Registered and logged in, you could reply and use other advanced thread options
>> Have you considered a hardware problem? That seems more likely than
>> malware
>> since scans have found nothing.
>
> I was a bit scared to think about that as I wouldn't know how to
> isolate it. But I was suspicious as there is never an error message,
> just a simple shut down and restart. Does the OS generate a log
> anywhere which might enlighten me?
XP, I assume, otherwise you'll need to google for instructions:
System Properties-->Advanced-->Startup and Recovery (click "Settings").
Under "System Failure," untick the "Automatically Restart" box. You'll
then be able to get a look at the BSOD.
You might also want to check Event Viewer for error messages.
--
Rhonda Lea Kirk
Happiness limits the amount of suffering one is
willing to inflict on others. Phèdre nó Delaunay
|
| Similar Threads | Posted | | Is this blaster or sasser | March 11, 2007, 12:12 am |
| Spyware blaster query......... | August 27, 2005, 7:05 pm |
| Variation on the blaster viruses? | October 17, 2007, 1:24 pm |
| Avast and Spyware Blaster | July 17, 2008, 10:12 pm |
| Spyware Blaster keeps launching MS Office Pro | May 28, 2006, 8:13 pm |
| What is latest version of F-Prot for DOS free version? | June 28, 2006, 1:56 am |
| Re: New version of Avira now also available as free version | April 24, 2008, 11:15 pm |
| Re: New version of Avira now also available as free version | April 25, 2008, 12:49 am |
| Attention new worm ! W32/Rizalof.B.worm | March 4, 2006, 4:30 pm |
| New version of AVG now also available as free version | April 24, 2008, 11:26 am |
|
XML site map