Computeren rebooter konstant

Det lyder som om du har fået sasser virus: http://securityresponse.symantec.com/avcenter/venc/data/w32.sasser.b.worm.html

Den får man hvis man ikke har de nyeste Microsoft windows opdateringer!

Removal using the W32.Sasser Removal Tool
Symantec Security Response has developed a removal tool to clean the infections of W32.Sasser.B.Worm. Use this removal tool first, as it is the easiest way to remove this threat.

Manual Removal
The following instructions pertain to all current and recent Symantec antivirus products, including the Symantec AntiVirus and Norton AntiVirus product lines.


End the malicious process (Windows NT/2000/XP).
Disable System Restore (Windows XP).
Update the virus definitions.
Run a full system scan and delete all the files detected as W32.Sasser.B.Worm.
Reverse the change made to the registry.

For details on each of these steps, read the following instructions.

1. To end the malicious process
On Windows NT/2000/XP computers, you must first end the malicious process:
Press Ctrl+Alt+Delete once.
Click Task Manager.
Click the Processes tab.
Double-click the Image Name column header to alphabetically sort the processes.
Scroll through the list and look for the following processes:
avserve2.exe
any process with a name consisting of four or five digits, followed by _up.exe (for example, 74354_up.exe).


If you find any such process, click it, and then click End Process.
Exit the Task Manager.

Removal tool finder du her: http://securityresponse.symantec.com/avcenter/venc/data/w32.sasser.removal.tool.html

så kan du jo finde ud af om det er Sasser der er dit problem.

citerer arlet igen:
Gå i start og skriv shutdown -a
så skulle den stoppe med at genstarte

Hent denne patch : http://www.microsoft.com/technet/security/bulletin/ms04-011.mspx

Fjern ormen med stinger: http://www.arlet.dk/special.htm

Til sidst henter du alle opdateringerne på microsoft update, så det ikke sker igen..

Okay altså: Dette har intet med Sasser at gøre. INGEN af de ovenstående tricks virkede.

Update: Jeg skrottede distributed.net

Jeg har prøvet at højreklikke på Denne Computer og vælge "Administrer" dermed kom jeg ind i "Computeradministration" hvor jeg i Systemværktøjer >> Logbog >> System fandt en meddelelse som kun kommer efter de gange hvor PC'en rebooter, den lyder:

Hændelsestype:    Oplysninger
Hændelseskilde:    Save Dump
Hændelseskategori:    Ingen
Hændelses-id:    1001
Dato:        03-06-2004
Klokkeslæt:        19:07:53
Bruger:        Ikke tilgængelig
Computer:    GUATEMAL-9YZ1BH
Beskrivelse:
Computeren blev genstartet efter et bugcheck. Bugchecket var: 0x0000001e (0xc0000005, 0xbc86b027, 0x00000000, 0x000000b5). Microsoft Windows 2000 [v15.2195] Et dump blev gemt i : C:\WINNT\Minidump\Mini060304-03.dmp.


Hvad i alle rigers navn betyder det?

http://www.arlet.dk/spybothjt.htm - hent de programmer og kør dem - smid så indholdet af Hijackthis loggen herind, så fjerner vi skidtet hvis der er noget!

Sorry John.
Så sender jeg også HijackThis loggen her:

Logfile of HijackThis v1.97.7
Scan saved at 18:53:14, on 08-06-2004
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\system32\cusrvc.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
C:\WINNT\System32\nvsvc32.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\ZoneLabs\vsmon.exe
C:\WINNT\Explorer.EXE
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\Programmer\Ahead\InCD\InCD.exe
C:\Programmer\Fælles filer\Real\Update_OB\realsched.exe
C:\Programmer\Keyboard-stuff\Logitech\iTouch\iTouch.exe
C:\Programmer\Java\j2re1.4.2_04\bin\jusched.exe
C:\WINNT\system32\NWTRAY.EXE
C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
C:\Programmer\Keyboard-stuff\Logitech\MouseWare\system\em_exec.exe
C:\Programmer\Messenger Plus! 2\MsgPlus.exe
C:\Programmer\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINNT\system32\internat.exe
C:\Programmer\Keyboard-stuff\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
C:\Programmer\Internet Explorer\IEXPLORE.EXE
C:\My Downloads\hijackthis.exe
C:\Programmer\Internet Explorer\IEXPLORE.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.dk/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = ;localhost;<local>
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O1 - Hosts: 172.16.65.250 aplic
O1 - Hosts: 172.16.128.61 div_licens
O1 - Hosts: 172.16.128.40 Concorde
O1 - Hosts: 172.16.128.62 nfsserver
O1 - Hosts: 172.16.128.54 Virum1
O1 - Hosts: 172.16.128.53 BKfax1
O1 - Hosts: 172.16.128.55 Virum_admin
O1 - Hosts: 172.16.128.101 Vakselo
O1 - Hosts: 172.16.128.2 Virum-1
O1 - Hosts: 172.16.128.3 Virum_2
O1 - Hosts: 172.16.128.5 Virum_data
O1 - Hosts: 172.16.200.10 CadVirum
O1 - Hosts: 172.16.200.20 ProgVirum
O1 - Hosts: 172.16.200.30 SagerVirum
O1 - Hosts: 172.16.200.40 UsersVirum
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmer\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {41353F8B-78CE-48A5-BE44-153ED293D192} - C:\Programmer\PopupPopper\PopLib.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programmer\Spybot - Search & Destroy\SDHelper.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\WINNT\Downloaded Program Files\googlenav.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\Msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [Anvshell] anvshell.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINNT\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [LiveNote] livenote.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINNT\System32\NeroCheck.exe
O4 - HKLM\..\Run: [InCD] C:\Programmer\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Programmer\Fælles filer\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Programmer\Keyboard-stuff\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programmer\Java\j2re1.4.2_04\bin\jusched.exe
O4 - HKLM\..\Run: [NWTRAY] NWTRAY.EXE
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
O4 - HKLM\..\Run: [MessengerPlus2] "C:\Programmer\Messenger Plus! 2\MsgPlus.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmer\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Programmer\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [Internat.exe] internat.exe
O4 - HKCU\..\Run: [LDM] C:\Programmer\Keyboard-stuff\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
O4 - Startup: PowerReg Scheduler.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Programmer\Keyboard-stuff\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programmer\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: &Google Search - res://C:\WINNT\Downloaded Program Files\googlenav.dll/cmsearch.html
O8 - Extra context menu item: Add to filterlist (WebWasher) - http://-Web.Washer-/ie_add
O8 - Extra context menu item: Backward &Links - res://C:\WINNT\Downloaded Program Files\googlenav.dll/cmbacklinks.html
O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\WINNT\Downloaded Program Files\googlenav.dll/cmcache.html
O8 - Extra context menu item: Si&milar Pages - res://C:\WINNT\Downloaded Program Files\googlenav.dll/cmsimilar.html
O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
O9 - Extra button: PopupPopper Kontrol Panel (HKLM)
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
O16 - DPF: {27527D31-447B-11D5-A46E-0001023B4289} (CoGSManager Class) - http://gamingzone.ubisoft.com/dev/packages/GSManager.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab
O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} - http://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/20030530/qtinstall.info.apple.com/bonnie/us/win/QuickTimeInstaller.exe
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://207.188.7.150/295f252ce5b9626a8b05/netzip/RdxIE601.cab
O16 - DPF: {6CB5E471-C305-11D3-99A8-000086395495} (Google Activate) - http://toolbar.google.com/data/da/big/1.1.62-big/GoogleNav.cab
O16 - DPF: {70BA88C8-DAE8-4CE9-92BB-979C4A75F53B} (GSDACtl Class) - https://www.gamespyid.com/alaunch.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab
O16 - DPF: {90C9629E-CD32-11D3-BBFB-00105A1F0D68} (InstallShield International Setup Player) - http://www.installengine.com/engine/isetup.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37910.0476967593
O16 - DPF: {A8658086-E6AC-4957-BC8E-7D54A7E8A78E} (SassCln Object) - http://www.microsoft.com/security/controls/Sasser/20/SassCln.CAB
O16 - DPF: {C3DFA998-A486-11D4-AA25-00C04F72DAEB} (MSN Photo Upload Tool) - http://sc.groups.msn.com/controls/PhotoUC/MsnPUpld.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} (QDiagHUpdateObj Class) - http://h30043.www3.hp.com/hpdj/en/check/qdiagh.cab?316
O16 - DPF: {F54C1137-5E34-4B95-95A5-BA56D4D8D743} (Secure Delivery) - http://www.gamespot.com/KDX/kdx.cab

Hallo? Er I der?

Jeg kan ikke lige se noget der skulle genstarte computeren i den log der..

Så check din RAM med memtest86 og aflæs din cpu temperatur i bios..
Hvis du har lavet noget hw opgradering på det seneste så er det også interessant.

Ved ikke om det kan skyldes-cusrvc.exe, som sandsynligvis er en trojaner, men tag en onlinescan: http://uk.trendmicro-europe.com/enterprise/products/housecall_launch.php
Du kan tjekke din cpu i Everest home, under Pc-sensor: http://www.lavalys.com/index.php?page=product&view=1&subpage=1

strych9 >> Tal dansk!

magictouch >> HouseCall fandt intet og jeg aner ikke hvad jeg skal bruge Everest til.

Min lokale PC-dealer skiftede processoren ud og jeg formaterede skidtet så jeg lukker...