Spontaneous Reboot

[Guest]

Archived from groups: microsoft.public.win2000.advanced_server (More info?)

I have a Compaq ML370 G3 that will spontaneously reboot
every few days. So far we have replaced everything except
the hard drives. It's running Win2k Adv Svr, SP3, 8 gig
ram with /PAE. The only message we get is the one in the
event log about the previous shutdown being unexpected.
The Software on the box is Weblogic 7.0.2, Veritas agent
9.0, Symantec AV 8.0, AHM remote monitor Agent. Any
suggestions how to troubleshoot this further?

 

[Guest]

Archived from groups: microsoft.public.win2000.advanced_server (More info?)

"Stephan Fix" <sfix@cybershift_nospam_.com> wrote in message news:<11fab01c44265$21fd1220$a601280a@phx.gbl>...
> I have a Compaq ML370 G3 that will spontaneously reboot
> every few days. So far we have replaced everything except
> the hard drives. It's running Win2k Adv Svr, SP3, 8 gig
> ram with /PAE. The only message we get is the one in the
> event log about the previous shutdown being unexpected.
> The Software on the box is Weblogic 7.0.2, Veritas agent
> 9.0, Symantec AV 8.0, AHM remote monitor Agent. Any
> suggestions how to troubleshoot this further?

You have all patches and fixes for Sasser don't ya?

 

[Guest]

Archived from groups: microsoft.public.win2000.advanced_server (More info?)

Sounds like Sasser to me check this out: http://securityresponse.symantec.com/avcenter/venc/data/w32.sasser.removal.tool.html

 

[steve]

Archived from groups: microsoft.public.win2000.advanced_server (More info?)

Not Sasser, unfortunately.

 

[ad]

Archived from groups: microsoft.public.win2000.advanced_server (More info?)

Stephan Fix wrote:
> I have a Compaq ML370 G3 that will spontaneously reboot
> every few days. So far we have replaced everything except
> the hard drives. It's running Win2k Adv Svr, SP3, 8 gig
> ram with /PAE. The only message we get is the one in the
> event log about the previous shutdown being unexpected.
> The Software on the box is Weblogic 7.0.2, Veritas agent
> 9.0, Symantec AV 8.0, AHM remote monitor Agent. Any
> suggestions how to troubleshoot this further?


Have you got the automatic reboot switched off in:

My Computer->Properties
Advanced->Startup and Recovery?

Is the event log option checked as well? I *think* that will write info
about any STOP errors into the event log.

Do you know what date it started happening? Was it since a recent patch
from Microsoft or any other program running on the server?

Also keep in mind someone might be doing it on purpose - the server
could be compromised, have a rouge admin or someone with enough rights
to the machine to cause it.

HTH,


aD