[kbrearey]

Hi!

I was wondering if anyone out there can give me some advice regarding a Windows 2000 shutdown problem. My problem is a little different than the ones I have been reading about, in that I have no trouble shutting Windows down myself. However, at seemingly random times, Windows 2000 shuts down and restarts itself. When the machine finishes the reboot, a message appears on the desktop asking me to Restore the Active Desktop.

At first I thought that this might be due to the worm that circulated last week, so I downloaded the patch to fix that problem. All was well for a few days, but my recurring problem just struck twice within 10 minutes of each other.

Does anyone have any ideas/suggestions?

Thanks so much!

[Advertisements]

Good evening,

does a message appear immediately before the reboot telling you something like this?

"The system is shutting down. Please save all work in progress and log off. Any unsaved changes will be lost. This shutdown was initiated by NT AUTHORITY\SYSTEM.

The system process C:\WINNT\SYSTEM32\SERVICES.EXE terminated unexpectedly with status code 128. The system will shut down and restart."

If so, I am having exactly the same problem and there are actually some other people reporting this probleme, for example here: http://www.geekstogo...128-t54811.html

Somewhere I don't remember, somebody recently wrote that he is experiencing that problem only when he is connected to the Internet without any kind of firewall. So I think this might actually be a worm symptome as well.

Can you tell me which worm circulated last week? I was not home. Thanks in advance.

I'm sorry I can't solve or fix your (our) problem (yet).

[Seb.Albert]

Good evening,

does a message appear immediately before the reboot telling you something like this?

"The system is shutting down. Please save all work in progress and log off. Any unsaved changes will be lost. This shutdown was initiated by NT AUTHORITY\SYSTEM.

The system process C:\WINNT\SYSTEM32\SERVICES.EXE terminated unexpectedly with status code 128. The system will shut down and restart."

If so, I am having exactly the same problem and there are actually some other people reporting this probleme, for example here: http://www.geekstogo...128-t54811.html

Somewhere I don't remember, somebody recently wrote that he is experiencing that problem only when he is connected to the Internet without any kind of firewall. So I think this might actually be a worm symptome as well.

Can you tell me which worm circulated last week? I was not home. Thanks in advance.

I'm sorry I can't solve or fix your (our) problem (yet).

[boylin]

hi,
it sounds like you have the sasser virus, download an anti-virus off the internet and run a full scan.

[boylin]

hi,
it sounds like you have the sasser virus, download an anti-virus off the internet and run a full scan.

[kbrearey]

I actually thought that it might be a virus, so I ran anti-viral software and came up clean. I'm also not getting the message listed in the second post above.

Basically, I am just in the middle of something, and all of a sudden, the machine shuts down and then instantly restarts itself. Since my post yesterday, I haven't had a problem, but I could go a few days or even a week before this happens again. Before the 2 times it happened yesterday, it had been about a week and a half since it last happened.

Is there anything else that it could be?

Edited by kbrearey, 24 August 2005 - 05:47 AM.

[RockyIV]

Which tool did you use there are heaps of good tools depending on your problem! You might get more help if you post this topic in the 'Malware Removal' Problems!
Regards RockyIV

[dsenette]

when the machine boots up enter your bios and look for your processor temps...post those here....also run http://www.memtest86.com/
on your ram one stick at a time.....also
start > run, type
eventvwr.msc
<enter>

Look under systems and applications for items with red Xs that happened at the SAME time as your problem...list them here.

[Seb.Albert]

I'm sorry again for being wrong.

One cause may, as mentioned above, be high temperature, but then the CPU would rather just freeze than reboot. One other reason could be low power. Maybe you have too many devices for your (how-do-you-call-the-thing-where-you-plug-the-electricity-cable-in?).

[dsenette]

seb.albert - the thingie is a power supply or a PSU, and depending on the set up of the motherboard the thermal sensor will sometimes either reboot or just shutdown the machine usually it will completely shut down the machine.

kbreary - make sure that your cpu fan is plugged in to the right connector because some boards will shut down if it's not connected right (though it will usually do this every time you turn the machine on so...i'm pretty sure this isn't the issue)

[dana340]

I have a similar problem with a desktop PC. we are running an thlon processor, windows XP SP2.

this is what i ahve tried.

checked add/remove programs for spyware, only found new.net. sucessfully uninstalled.
checked running processes, nothing out of the ordinary.
ran MSCONFIG, disabled all programs but the sound card monitor and the McAffe AntiVirus components (recently resubscribed)
ran HiJackThis, found nothing out of teh ordinary (on another computer now or i'd post the log)
ran antivirus check.

removed 2 instnaces of shutdown.exe (one in system32, and one with a utility program that includes it). Both connected to teh internet and not connected it shuts down at unexpected times. it actually dispalys teh log off/saving settings/shutting down routine, whcih is atypical.

it also wakes up unexpectely. the lan card is hooked up to an SBC DSL modem. I also checked to be sure that wake on LAN is disabled.

i have disabled mcaffe as as last ditch effort, and that jsut failed as i was typing this message

-Dana

PS one thing to look into is the "automaticlly restart on error" perameter.
right click "my computer" and go to properties. the gotot the "advnaced" tab. click on "settings" for start up and recovery, and clcik the checkbox for "automaticlly restart". now whent the computer bluescreens, you can see the bluescreen, get the error code, and google that to get to the root of your problem.