Unexpected System Shutdown

Recently the W2K server -well patched- had two unexpected
system shutdowns. The only trace is the entry in the
System event log with Event ID:6008.

It could not be power related; the other machines sharing
from the same power source did not reboot.

Could it be a hidden worm, or a new attack? I know you
could shutdown local area network machines remotely. Maybe
the command can be sent over IP to any unauthorized
network?

Thanks.

rezamirvahabi
Tue Aug 26 10:03:11 CDT 2003


>-----Original Message-----
>Recently the W2K server -well patched- had two
unexpected
>system shutdowns. The only trace is the entry in the
>System event log with Event ID:6008.
>
>It could not be power related; the other machines
sharing
>from the same power source did not reboot.
>
>Could it be a hidden worm, or a new attack? I know you
>could shutdown local area network machines remotely.
Maybe
>the command can be sent over IP to any unauthorized
>network?
>
>Thanks.
>.
>

Nick
Fri Aug 29 18:28:54 CDT 2003

I have reinstalled MS03-026 patch, updated DAT file from
McAfee, scaned it and could not find any virus.

Still, the system will reboot by itself once a day.
Randomly.

Firewall installed. From the traffice log could not find
any special traffice/activity before the machine reboot.

Highly think it is a undiscovered virus or attack.

Thanks.



>-----Original Message-----
>You may want to reinstall the MS03-026 blaster worm
patch from
>www.microsoft.com/technet/security [or confirm it's
installed in the first
>place]. It may be that the patch did not install
correctly. The best way
>to confirm whether it's installed is to run the free
DCOM RPC scanner from
>www.eeye.com or Microsoft also makes one, probably
listed on the above site
>or go to www.microsoft.com and click on Blaster.
>
>

Bill
Fri Aug 29 20:00:15 CDT 2003

I think your problem is more likely hardware, given that a/v raises no
alarms, and you have a firewall in place.

How about the event logs---anything related to the reboots there?

"Nick" <feb1117@hotmail.com> wrote in message
news:05ee01c36e85$4ffea4e0$a301280a@phx.gbl...
> I have reinstalled MS03-026 patch, updated DAT file from
> McAfee, scaned it and could not find any virus.
>
> Still, the system will reboot by itself once a day.
> Randomly.
>
> Firewall installed. From the traffice log could not find
> any special traffice/activity before the machine reboot.
>
> Highly think it is a undiscovered virus or attack.
>
> Thanks.
>
>
>
> >-----Original Message-----
> >You may want to reinstall the MS03-026 blaster worm
> patch from
> >www.microsoft.com/technet/security [or confirm it's
> installed in the first
> >place]. It may be that the patch did not install
> correctly. The best way
> >to confirm whether it's installed is to run the free
> DCOM RPC scanner from
> >www.eeye.com or Microsoft also makes one, probably
> listed on the above site
> >or go to www.microsoft.com and click on Blaster.
> >
> >
>

Nick
Tue Sep 09 16:01:34 CDT 2003

Later on I found the problem is not related to any virus
or attack. It is because of the memory upgrade did a
couple weeks ago. Somehow the new memory are not 100%
stable. Replace with the old memory and the upexpected
reboot never happened.

Thanks all.
>-----Original Message-----
>I have reinstalled MS03-026 patch, updated DAT file from
>McAfee, scaned it and could not find any virus.
>
>Still, the system will reboot by itself once a day.
>Randomly.
>
>Firewall installed. From the traffice log could not find
>any special traffice/activity before the machine reboot.
>
>Highly think it is a undiscovered virus or attack.
>
>Thanks.
>
>
>
>>-----Original Message-----
>>You may want to reinstall the MS03-026 blaster worm
>patch from
>>www.microsoft.com/technet/security [or confirm it's
>installed in the first
>>place]. It may be that the patch did not install
>correctly. The best way
>>to confirm whether it's installed is to run the free
>DCOM RPC scanner from
>>www.eeye.com or Microsoft also makes one, probably
>listed on the above site
>>or go to www.microsoft.com and click on Blaster.
>>
>>
>
>.
>

Bill
Fri Sep 12 09:10:34 CDT 2003

Thanks for letting us know how it came out. I have a large stick of ram
I've never put in a new server. It is properly specc'd, and I read all the
vendors instructions about ram placement order, etc. When in place, the
(system) vendors newest ram test passes it with flying colors, even with the
most in-depth test choices. However, Windows 2000 install blue-screens
consistently with the ram in place.

"Nick" <feb1117@hotmail.com> wrote in message
news:06d301c37715$8d606830$3101280a@phx.gbl...
> Later on I found the problem is not related to any virus
> or attack. It is because of the memory upgrade did a
> couple weeks ago. Somehow the new memory are not 100%
> stable. Replace with the old memory and the upexpected
> reboot never happened.
>
> Thanks all.
> >-----Original Message-----
> >I have reinstalled MS03-026 patch, updated DAT file from
> >McAfee, scaned it and could not find any virus.
> >
> >Still, the system will reboot by itself once a day.
> >Randomly.
> >
> >Firewall installed. From the traffice log could not find
> >any special traffice/activity before the machine reboot.
> >
> >Highly think it is a undiscovered virus or attack.
> >
> >Thanks.
> >
> >
> >
> >>-----Original Message-----
> >>You may want to reinstall the MS03-026 blaster worm
> >patch from
> >>www.microsoft.com/technet/security [or confirm it's
> >installed in the first
> >>place]. It may be that the patch did not install
> >correctly. The best way
> >>to confirm whether it's installed is to run the free
> >DCOM RPC scanner from
> >>www.eeye.com or Microsoft also makes one, probably
> >listed on the above site
> >>or go to www.microsoft.com and click on Blaster.
> >>
> >>
> >
> >.
> >