Computers in network shut down simultaneously.

[Sven Stian]

Hi all.

I really need some help. We have about 10-15 computers
with Win2000 installed. They have now started restarting,
randomly, with this error message:

The system is shutting down. Please save all work in
progress and log off. Any unsaved changes will be lost.
This shutdown was initiated by NT AUTHORITY\SYSTEM.

The system process C:\WINNT\SYSTEM32\SERVICES.EXE
terminated unexpectedly with status code 128. The system
will shut down and restart.

I have all computers patched for Blaster, I have done
scans with blaster removal tools, and my antivirus
patterns and engines are up to date.

Have also checked the issue about wrong or missing share
paths in the registrystring:
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Lanman
server\Shares

I can not find anything wrong anywhere... but the fact
remains, the computers restart 1 to 2 times almost every
day. Some days nothing happens....

Help would be much appreciated.

 

[paisher]

Hello,

Try to isolate one of those pc's from the network, try
cleaning as much as u can, check if that one is still
rebooting...

 

[TopCat]

I have the same problem and have done the same things to resolve. I
appears that if I take the Internet router down, the reboots stop.
This changes the IPs to locals and the network can no longer access th
Internet.

I completely wiped and reinstalled the OS on all six machines on th
network about a month ago


-
TopCa

 

[Steven L Umbach]

If you still have the problem then I would make sure that all these computers have
been checked for virus/worm infections with your antivirus program using updated
virus definitions and something like the free Stinger tool from McAfee which is a
stand alone compact tool that scans and removes many of the current common viruses.
Your antivirus program also needs to scan all emails as that is where a lot of
infections can come from and bypass the firewall. Often the emails with attachments
will appear to come from trusted sources such as friends, family, work, or Microsoft.
It is best to isolate a computer from the rest of the network to check for infection
and install critical updates before connecting to the internet again.

http://vil.nai.com/vil/stinger/

In addition you should check your router to make sure it is blocking all inbound
uninitiated traffic. There are many free sites available that can do that such as
http://scan.sygatetech.com/. That should be done before you check for infections on
any machines. Ideally use a firewall/router that can block all outbound traffic by
default and then create rules for the authorized exceptions such as http, https, dns,
mail, newsgroups.

A reinstalled operating system can be compromised very quickly if it is exposed to
the internet without proper firewall protection or from another computer on the lan
if it is not current with critical updates. make sure you install critical updates
only from Microsoft and never an email attachment. --- Steve