Re: Port scan and scvhost overload

["Salvador III Manaois" <badzmanaois () gmail com>]

I'm quite interested in and would likely focus on the svchost.exe
invoked services as one of them, most probably, caused the reboot.
Furthermore,I suggest you check if any crash dump was generated when
the machine rebooted; if there is, you can run this against a debugger
(windbg) to identify the faulting application/service.

Back on the svchost.exe instances, I would suggest running tasklist or
Sysinternals' Process Explorer to isolate which service/process is
linked to which scvhost.exe instance. It could very well be a malware
or a leaky application which caused the reboot. The following links
provide more detailed information on using tasklist and Process
Explorer in isolating processes/applications/services/DLLs tagging on
a svchost.exe instance.

Regards,

Salvador Manaois III
MCSE MCSA CEH MCITP | Enterprise/Server Admin
Bytes & Badz : http://badzmanaois.blogspot.com