Security

Ask something
Discussion Locked

Servers/workstations keep shutting down!

0 helpful
4 replies

by p.hernandez

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
I really need some advice here. I have users and servers that shut down without notice. I am sure it's some sort of virus but NAV doesn't detect anything. So far, all of my servers have shut down at least 3 times. When I go over to them, they are at the screen that says "It is now safe to turn off your computer. I've tried searching everywhere but can't seem to find an answer. All of the Windows updates as well as the NAV updates are done on all workstations and servers. I appreciate your help!

4 replies

by california dead head

Try scanning your servers from
http://housecall.trendmicro.com/
It has found viruses for me in the past that NAV did not.

Also, check the processes running on your servers (CTRL+ALT+DELETE) with task manager. Turn off any that seem weird and search google for any that are weird.

Check your event viewers at the time just before shutdown for any clues what is making them shutdown.

by gh0ztalarm

Actually, what i would do is update windows as much as possible, and get a firewall installed. due to network settings and the like or what not, and is now shutting down, and has a timmer, if thats it, i hope it helps.

by lmayeda

In addition to Answer 1, I generally check my registry for unusual executables that start up automatically. Be careful of backing up your registry before making changes. HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CurrentVersion\Run. If I don't recognize any of these processes, I look them up on the internet. If you have a virus or worm, it will tell you and you can delete the Registry entry or make further inquiries via McAfee or Semantic re: best method of deleting/cleaning. I also like Lavasoft's Adaware to ferret out spyware that the virus programs often will not catch. Hope this helps.

by mart h

When the Lovsan/ Blaster worms where at the peak I experienced a similar issue. The AV does not detect the Worm - or at least it has removed it but the symptoms persist I.E. The machine shuts down randomly as the worm(s) are still prevalant on your network somewhere and utilising the exploits required for them to work.

My advice is to update all machines to the latest SP and apply all patches, you can either do this manually or cantrol the updates using SUS from Microsoft.

Use a free scanner (trend) or McAfee's free scanner (stinger) found here: http://vil.nai.com/vil/averttools.asp

This discussion is closed to new replies.