Re: Windows rebooting problem.

["Lutzen, Karl F." <kfl () UMR EDU>]

Most likely spyware. We had a similar problem with look2me spyware
causing similar problems. If you can check you network traffic to see if
they are communicating with 69.20.20.161 autonomously, then that is most
likely your culprit. Here are several removal links if it is:


http://www.kephyr.com/spywarescanner/library/look2me/index.phtml


Indicating that the UnInstaller for the Look2Me application can be found
at: 

http://www.look2me.com/cgi-bin/UnInstaller

 

http://securityresponse.symantec.com/avcenter/venc/data/spyware.look2me.
html


http://www.pchell.com/support/look2me.shtml


After this, you should probably run spyware removal tools as well.


-----Original Message-----
From: The EDUCAUSE Security Discussion Group Listserv
[mailto:SECURITY () LISTSERV EDUCAUSE EDU] On Behalf Of Mark Wilson
Sent: Wednesday, May 26, 2004 11:57 AM
To: SECURITY () LISTSERV EDUCAUSE EDU
Subject: [SECURITY] Windows rebooting problem.

We have had a problem with XP (and maybe 2000) systems rebooting.  We
use McAfee and all "infected" systems come up clean when scanned in safe
mode/no network.   Most times the system crashes either prior to the
Windows Logon Screen or just seconds after someone logs in.

The dreaded "Blue Screen of Death" appears with the following error:
STOP

Fatal systems error
Windows logon process system process terminated unexpectedly.
Status 0xc0000005

There is some mention that perhaps only networked systems experienced
this problem.  Seems to boot up and run in Safe Mode/No Network.

Any ideas/suggestions?  I will do my best to answer any questions about
this as I am getting this info piecemeal.

Thanks,



Mark Wilson
GCIA, CISSP #53153
Network Security Specialist
Auburn University
(334) 844-9347

**********
Participation and subscription information for this EDUCAUSE Discussion
Group discussion list can be found at http://www.educause.edu/cg/.

**********
Participation and subscription information for this EDUCAUSE Discussion Group discussion list can be found at 
http://www.educause.edu/cg/.