virus restarting machines

[adrian_smith]

anyone has ever experienced this kind of problem, probably due to virus/spyware, causing server and pc to reboot ( wondows2003)... i post the message i've found in log:"The process GL_<random_number>.exe has initiated the restart of computer SERVER on behalf of user NT AUTHORITY\SYSTEM for the following reason: No title for this reason could be foundReason Code: 0x0Shutdown Type: restart" thx

[Shenk, Jerry A]

If you have enough logging turned on, you can track down what started
the process id associated with the process the shut down.  You might try
looking into any files starting with GL on your machine....maybe it's
part of an accounting application or something.

-----Original Message-----
From: adrian_smith@... [mailto:adrian_smith@...]
Sent: Thursday, January 24, 2008 2:44 AM
To: incidents@...
Subject: virus restarting machines

anyone has ever experienced this kind of problem, probably due to
virus/spyware, causing server and pc to reboot ( wondows2003)... i post
the message i've found in log:"The process GL_<random_number>.exe has
initiated the restart of computer SERVER on behalf of user NT
AUTHORITY\SYSTEM for the following reason: No title for this reason
could be foundReason Code: 0x0Shutdown Type: restart" thx

**DISCLAIMER
This e-mail message and any files transmitted with it are intended for the use of the individual or entity to which they are addressed and may contain information that is privileged, proprietary and confidential. If you are not the intended recipient, you may not use, copy or disclose to anyone the message or any information contained in the message. If you have received this communication in error, please notify the sender and delete this e-mail message. The contents do not represent the opinion of D&E except to the extent that it relates to their official business.

[ViersOnline]

the one I know, having such a gross behavior is called windows update :)

adrian_smith@... wrote:
> anyone has ever experienced this kind of problem, probably due to virus/spyware, causing server and pc to reboot ( wondows2003)... i post the message i've found in log:"The process GL_<random_number>.exe has initiated the restart of computer SERVER on behalf of user NT AUTHORITY\SYSTEM for the following reason: No title for this reason could be foundReason Code: 0x0Shutdown Type: restart" thx
>
>
>  

[Worrell, Brian]

I thought Windows Update was a feature to make sure your PC / Server was
rebooted at the exact time it thought you should take a break from the
critical project you were working on.  ;-)

-----Original Message-----
From: ViersOnline [mailto:viers@...]
Sent: Thursday, January 24, 2008 12:03 PM
To: adrian_smith@...
Cc: incidents@...
Subject: Re: virus restarting machines

the one I know, having such a gross behavior is called windows update :)

adrian_smith@... wrote:
> anyone has ever experienced this kind of problem, probably due to
> virus/spyware, causing server and pc to reboot ( wondows2003)... i
> post the message i've found in log:"The process GL_<random_number>.exe

> has initiated the restart of computer SERVER on behalf of user NT
> AUTHORITY\SYSTEM for the following reason: No title for this reason
> could be foundReason Code: 0x0Shutdown Type: restart" thx
>
>
>  

[Dustin Larmeir]

I have definitely seen this behavior before. I have found that even safe
mode would not stop this though booting into last known good config may work
if it is related to a recent software installation. Your system is most
likely compromised and with windows that is always a really bad thing. I
would use a PE environment and see what you can find.

-----Original Message-----
From: ViersOnline [mailto:viers@...]
Sent: Thursday, January 24, 2008 11:03 AM
To: adrian_smith@...
Cc: incidents@...
Subject: Re: virus restarting machines

the one I know, having such a gross behavior is called windows update :)

adrian_smith@... wrote:
> anyone has ever experienced this kind of problem, probably due to
virus/spyware, causing server and pc to reboot ( wondows2003)... i post the
message i've found in log:"The process GL_<random_number>.exe has initiated
the restart of computer SERVER on behalf of user NT AUTHORITY\SYSTEM for the
following reason: No title for this reason could be foundReason Code:
0x0Shutdown Type: restart" thx
>
>
>  

[eazy-4]

You can abort the shutdown by typing shutdown -a on the run line or your
command window before the time has elapsed. You can then continue to
remove the malware.

[Miha Pihler]

> Your system is most likely compromised and with windows that is always a
really bad thing.

And with all other operating systems, being compromised, would be a good
thing? :-D

Mike

-----Original Message-----
From: Dustin Larmeir [mailto:dustin@...]
Sent: Thursday, January 24, 2008 7:30 PM
To: 'ViersOnline'; adrian_smith@...
Cc: incidents@...
Subject: RE: virus restarting machines

I have definitely seen this behavior before. I have found that even safe
mode would not stop this though booting into last known good config may work
if it is related to a recent software installation. Your system is most
likely compromised and with windows that is always a really bad thing. I
would use a PE environment and see what you can find.

-----Original Message-----
From: ViersOnline [mailto:viers@...]
Sent: Thursday, January 24, 2008 11:03 AM
To: adrian_smith@...
Cc: incidents@...
Subject: Re: virus restarting machines

the one I know, having such a gross behavior is called windows update :)

adrian_smith@... wrote:
> anyone has ever experienced this kind of problem, probably due to
virus/spyware, causing server and pc to reboot ( wondows2003)... i post the
message i've found in log:"The process GL_<random_number>.exe has initiated
the restart of computer SERVER on behalf of user NT AUTHORITY\SYSTEM for the
following reason: No title for this reason could be foundReason Code:
0x0Shutdown Type: restart" thx
>
>
>