Shutdown on http problem?

Discussion in 'A+ Certification' started by lanceman, Jun 5, 2004.

  1. lanceman

    lanceman Guest

    HELP, I teach A+ certification in HS and have a perplexing problem. My
    room is set up with a private LAN containing10 PC's (with XP) and a unix
    based server box connected with a switch. One of the PCs started rebooting
    at the first access of the server from Internet explorer using a http URL.
    There was some sort of virus floating around the school at that time (about
    3 weeks ago) which exhibited similiar symptoms, so I suspected that the PC
    had somehow got infected. I repartitioned the hard drive followed by a re
    format and a clean install of Win 98SE. (just to be different) I installed
    NetBEUI and TCP/IP protocols (with fixed IP address), tried ping to check
    continuity, and fired up my browser and whamo the same thing happened. The
    PC rebooted as soon as the the browser tried to access the server. What's
    the story?

    Some things I've tried:
    If I use an invalid URL, there is no problem, since nothing on the network
    responds
    Microsoft networking seems to work OK. I can access other folders on other
    PC's including those in the server.
    The server also supports ftp. If I ftp the server, no problem.
    I looked in CMOS for some sort of wake -on-LAN setting that might be bad -
    didn;t see anything.
    I ran Norton antivirus but it didn't find anything ( although it is not
    current to the last 6 mos). Don't know if it checks the MBR.

    I haven't swapped out the ethernet card yet, I am still holding out for a
    software problem. Or is the virus still there?

    Any suggestions?

    Lanceman
    lanceman, Jun 5, 2004
    #1
    1. Advertising

  2. lanceman

    Geoff Guest

    lanceman wrote:
    > HELP, I teach A+ certification in HS and have a perplexing problem.
    > My room is set up with a private LAN containing10 PC's (with XP) and



    <snip>

    in which case why isn't it fixed already :)

    what virus name exactly, find out, look for it, what method of infection
    does it use

    run memtest86 (stick it in google)
    and test the memory in that, memory is number 1 suspect of unstable pc's
    Geoff, Jun 5, 2004
    #2
    1. Advertising

  3. lanceman

    Ben Guest

    Sounds like the SASSER worm to me. I had it hit both my networks. My bad
    for not installing the patch prior to.

    Check this info may help.....

    http://securityresponse.symantec.com/avcenter/venc/data/w32.sasser.worm.html


    My fix was; unplug from the network and install the patch

    Good luck!


    "lanceman" <> wrote in message
    news:...
    > HELP, I teach A+ certification in HS and have a perplexing problem. My
    > room is set up with a private LAN containing10 PC's (with XP) and a unix
    > based server box connected with a switch. One of the PCs started

    rebooting
    > at the first access of the server from Internet explorer using a http URL.
    > There was some sort of virus floating around the school at that time

    (about
    > 3 weeks ago) which exhibited similiar symptoms, so I suspected that the PC
    > had somehow got infected. I repartitioned the hard drive followed by a

    re
    > format and a clean install of Win 98SE. (just to be different) I

    installed
    > NetBEUI and TCP/IP protocols (with fixed IP address), tried ping to check
    > continuity, and fired up my browser and whamo the same thing happened.

    The
    > PC rebooted as soon as the the browser tried to access the server. What's
    > the story?
    >
    > Some things I've tried:
    > If I use an invalid URL, there is no problem, since nothing on the network
    > responds
    > Microsoft networking seems to work OK. I can access other folders on

    other
    > PC's including those in the server.
    > The server also supports ftp. If I ftp the server, no problem.
    > I looked in CMOS for some sort of wake -on-LAN setting that might be bad -
    > didn;t see anything.
    > I ran Norton antivirus but it didn't find anything ( although it is not
    > current to the last 6 mos). Don't know if it checks the MBR.
    >
    > I haven't swapped out the ethernet card yet, I am still holding out for a
    > software problem. Or is the virus still there?
    >
    > Any suggestions?
    >
    > Lanceman
    >
    >
    Ben, Jun 5, 2004
    #3
  4. lanceman

    Nildram Guest

    If you don't have up-to-date antivirus then you don't know that the network
    is in fact healed?

    Do the easy stuff first like swap the network card, switch memory with
    another machine etc. Rule out all this basic stuff and the virus situation
    then you will have a problem worthy of asking people about.

    This coming from someone of TEACHES A+. !!

    M.


    "lanceman" <> wrote in message
    news:...
    > HELP, I teach A+ certification in HS and have a perplexing problem. My
    > room is set up with a private LAN containing10 PC's (with XP) and a unix
    > based server box connected with a switch. One of the PCs started

    rebooting
    > at the first access of the server from Internet explorer using a http URL.
    > There was some sort of virus floating around the school at that time

    (about
    > 3 weeks ago) which exhibited similiar symptoms, so I suspected that the PC
    > had somehow got infected. I repartitioned the hard drive followed by a

    re
    > format and a clean install of Win 98SE. (just to be different) I

    installed
    > NetBEUI and TCP/IP protocols (with fixed IP address), tried ping to check
    > continuity, and fired up my browser and whamo the same thing happened.

    The
    > PC rebooted as soon as the the browser tried to access the server. What's
    > the story?
    >
    > Some things I've tried:
    > If I use an invalid URL, there is no problem, since nothing on the network
    > responds
    > Microsoft networking seems to work OK. I can access other folders on

    other
    > PC's including those in the server.
    > The server also supports ftp. If I ftp the server, no problem.
    > I looked in CMOS for some sort of wake -on-LAN setting that might be bad -
    > didn;t see anything.
    > I ran Norton antivirus but it didn't find anything ( although it is not
    > current to the last 6 mos). Don't know if it checks the MBR.
    >
    > I haven't swapped out the ethernet card yet, I am still holding out for a
    > software problem. Or is the virus still there?
    >
    > Any suggestions?
    >
    > Lanceman
    >
    >



    ---
    Outgoing mail is certified Virus Free.
    Checked by AVG anti-virus system (http://www.grisoft.com).
    Version: 6.0.698 / Virus Database: 455 - Release Date: 02/06/2004
    Nildram, Jun 5, 2004
    #4
  5. On Sat, 5 Jun 2004 10:36:37 +0100, "Nildram" <yesright@nonospamo.4me>
    wrote:

    >If you don't have up-to-date antivirus then you don't know that the network
    >is in fact healed?
    >
    >Do the easy stuff first like swap the network card, switch memory with
    >another machine etc. Rule out all this basic stuff and the virus situation
    >then you will have a problem worthy of asking people about.
    >
    >This coming from someone of TEACHES A+. !!
    >
    >M.


    There are probably people who teach medicine who aren't/weren't
    necessarily good doctors. There are Major League Baseball batting
    coaches, good ones, who couldn't hit worth a darn. In this case there
    have been some steps that should'be been taken, but there were also
    steps taken which indicate a level of competence. We don't know why
    certain things haven't been done that should have been. IMHO

    Tom

    >
    >
    >"lanceman" <> wrote in message
    >news:...
    >> HELP, I teach A+ certification in HS and have a perplexing problem. My
    >> room is set up with a private LAN containing10 PC's (with XP) and a unix
    >> based server box connected with a switch. One of the PCs started

    >rebooting
    >> at the first access of the server from Internet explorer using a http URL.
    >> There was some sort of virus floating around the school at that time

    >(about
    >> 3 weeks ago) which exhibited similiar symptoms, so I suspected that the PC
    >> had somehow got infected. I repartitioned the hard drive followed by a

    >re
    >> format and a clean install of Win 98SE. (just to be different) I

    >installed
    >> NetBEUI and TCP/IP protocols (with fixed IP address), tried ping to check
    >> continuity, and fired up my browser and whamo the same thing happened.

    >The
    >> PC rebooted as soon as the the browser tried to access the server. What's
    >> the story?
    >>
    >> Some things I've tried:
    >> If I use an invalid URL, there is no problem, since nothing on the network
    >> responds
    >> Microsoft networking seems to work OK. I can access other folders on

    >other
    >> PC's including those in the server.
    >> The server also supports ftp. If I ftp the server, no problem.
    >> I looked in CMOS for some sort of wake -on-LAN setting that might be bad -
    >> didn;t see anything.
    >> I ran Norton antivirus but it didn't find anything ( although it is not
    >> current to the last 6 mos). Don't know if it checks the MBR.
    >>
    >> I haven't swapped out the ethernet card yet, I am still holding out for a
    >> software problem. Or is the virus still there?
    >>
    >> Any suggestions?
    >>
    >> Lanceman
    >>
    >>

    >
    >
    >---
    >Outgoing mail is certified Virus Free.
    >Checked by AVG anti-virus system (http://www.grisoft.com).
    >Version: 6.0.698 / Virus Database: 455 - Release Date: 02/06/2004
    >
    Tom MacIntyre, Jun 5, 2004
    #5
  6. On Sat, 5 Jun 2004 00:29:04 -0700 , "Ben" <>
    wrote:

    >Sounds like the SASSER worm to me. I had it hit both my networks. My bad
    >for not installing the patch prior to.
    >
    >Check this info may help.....
    >
    >http://securityresponse.symantec.com/avcenter/venc/data/w32.sasser.worm.html
    >
    >
    >My fix was; unplug from the network and install the patch
    >
    >Good luck!



    Actually, Sasser doesn't hit W98 machines....although it may still be
    a virus, that's not it.






    >"lanceman" <> wrote in message
    >news:...
    >> HELP, I teach A+ certification in HS and have a perplexing problem. My
    >> room is set up with a private LAN containing10 PC's (with XP) and a unix
    >> based server box connected with a switch. One of the PCs started

    >rebooting
    >> at the first access of the server from Internet explorer using a http URL.
    >> There was some sort of virus floating around the school at that time

    >(about
    >> 3 weeks ago) which exhibited similiar symptoms, so I suspected that the PC
    >> had somehow got infected. I repartitioned the hard drive followed by a

    >re
    >> format and a clean install of Win 98SE. (just to be different) I

    >installed
    >> NetBEUI and TCP/IP protocols (with fixed IP address), tried ping to check
    >> continuity, and fired up my browser and whamo the same thing happened.

    >The
    >> PC rebooted as soon as the the browser tried to access the server. What's
    >> the story?
    >>
    >> Some things I've tried:
    >> If I use an invalid URL, there is no problem, since nothing on the network
    >> responds
    >> Microsoft networking seems to work OK. I can access other folders on

    >other
    >> PC's including those in the server.
    >> The server also supports ftp. If I ftp the server, no problem.
    >> I looked in CMOS for some sort of wake -on-LAN setting that might be bad -
    >> didn;t see anything.
    >> I ran Norton antivirus but it didn't find anything ( although it is not
    >> current to the last 6 mos). Don't know if it checks the MBR.
    >>
    >> I haven't swapped out the ethernet card yet, I am still holding out for a
    >> software problem. Or is the virus still there?
    >>
    >> Any suggestions?
    >>
    >> Lanceman
    >>
    >>




    I resisted 'till I couldn't take it anymore.

    (sigh) Address altered against Spam.

    Replace the -at- and put the "spring-mind" in the correct order
    mhaase-at-springmind.com, Jun 5, 2004
    #6
  7. lanceman

    Thumper Guest

    On Sat, 05 Jun 2004 14:50:10 GMT, Tom MacIntyre
    <> wrote:

    >On Sat, 5 Jun 2004 10:36:37 +0100, "Nildram" <yesright@nonospamo.4me>
    >wrote:
    >
    >>If you don't have up-to-date antivirus then you don't know that the network
    >>is in fact healed?
    >>
    >>Do the easy stuff first like swap the network card, switch memory with
    >>another machine etc. Rule out all this basic stuff and the virus situation
    >>then you will have a problem worthy of asking people about.
    >>
    >>This coming from someone of TEACHES A+. !!
    >>
    >>M.

    >
    >There are probably people who teach medicine who aren't/weren't
    >necessarily good doctors. There are Major League Baseball batting
    >coaches, good ones, who couldn't hit worth a darn. In this case there
    >have been some steps that should'be been taken, but there were also
    >steps taken which indicate a level of competence. We don't know why
    >certain things haven't been done that should have been. IMHO
    >
    >Tom
    >


    People ought to give the guy credit for admitting that he teaches. he
    could just as easily made up a story. It isn't really relevant to
    helping him.
    Thumper
    >>
    >>
    >>"lanceman" <> wrote in message
    >>news:...
    >>> HELP, I teach A+ certification in HS and have a perplexing problem. My
    >>> room is set up with a private LAN containing10 PC's (with XP) and a unix
    >>> based server box connected with a switch. One of the PCs started

    >>rebooting
    >>> at the first access of the server from Internet explorer using a http URL.
    >>> There was some sort of virus floating around the school at that time

    >>(about
    >>> 3 weeks ago) which exhibited similiar symptoms, so I suspected that the PC
    >>> had somehow got infected. I repartitioned the hard drive followed by a

    >>re
    >>> format and a clean install of Win 98SE. (just to be different) I

    >>installed
    >>> NetBEUI and TCP/IP protocols (with fixed IP address), tried ping to check
    >>> continuity, and fired up my browser and whamo the same thing happened.

    >>The
    >>> PC rebooted as soon as the the browser tried to access the server. What's
    >>> the story?
    >>>
    >>> Some things I've tried:
    >>> If I use an invalid URL, there is no problem, since nothing on the network
    >>> responds
    >>> Microsoft networking seems to work OK. I can access other folders on

    >>other
    >>> PC's including those in the server.
    >>> The server also supports ftp. If I ftp the server, no problem.
    >>> I looked in CMOS for some sort of wake -on-LAN setting that might be bad -
    >>> didn;t see anything.
    >>> I ran Norton antivirus but it didn't find anything ( although it is not
    >>> current to the last 6 mos). Don't know if it checks the MBR.
    >>>
    >>> I haven't swapped out the ethernet card yet, I am still holding out for a
    >>> software problem. Or is the virus still there?
    >>>
    >>> Any suggestions?
    >>>
    >>> Lanceman
    >>>
    >>>

    >>
    >>
    >>---
    >>Outgoing mail is certified Virus Free.
    >>Checked by AVG anti-virus system (http://www.grisoft.com).
    >>Version: 6.0.698 / Virus Database: 455 - Release Date: 02/06/2004
    >>
    Thumper, Jun 7, 2004
    #7
  8. lanceman

    A Guest

    Hi, How about a quick Fdisk /MBR to get rid of a boot sector virus. I have
    Norton & McAfee on different PCs and the former failed to spot a virus that
    the latter found and cleaned. As for being up to date - yes every day sir
    together with McAfee Firewall and daily Scumware removal using two
    applications. Passed the Core exam this week but not looking forward to the
    OS exam!
    "lanceman" <> wrote in message
    news:...
    > HELP, I teach A+ certification in HS and have a perplexing problem. My
    > room is set up with a private LAN containing10 PC's (with XP) and a unix
    > based server box connected with a switch. One of the PCs started

    rebooting
    > at the first access of the server from Internet explorer using a http URL.
    > There was some sort of virus floating around the school at that time

    (about
    > 3 weeks ago) which exhibited similiar symptoms, so I suspected that the PC
    > had somehow got infected. I repartitioned the hard drive followed by a

    re
    > format and a clean install of Win 98SE. (just to be different) I

    installed
    > NetBEUI and TCP/IP protocols (with fixed IP address), tried ping to check
    > continuity, and fired up my browser and whamo the same thing happened.

    The
    > PC rebooted as soon as the the browser tried to access the server. What's
    > the story?
    >
    > Some things I've tried:
    > If I use an invalid URL, there is no problem, since nothing on the network
    > responds
    > Microsoft networking seems to work OK. I can access other folders on

    other
    > PC's including those in the server.
    > The server also supports ftp. If I ftp the server, no problem.
    > I looked in CMOS for some sort of wake -on-LAN setting that might be bad -
    > didn;t see anything.
    > I ran Norton antivirus but it didn't find anything ( although it is not
    > current to the last 6 mos). Don't know if it checks the MBR.
    >
    > I haven't swapped out the ethernet card yet, I am still holding out for a
    > software problem. Or is the virus still there?
    >
    > Any suggestions?
    >
    > Lanceman
    >
    >
    A, Jun 11, 2004
    #8
  9. lanceman

    lanceman Guest

    All youse helpers, thanks for the comments on my http problem and my
    debugging/teaching skills.

    The virus the school had was indeed the Sasser virus, which according to my
    research does not affect Win 98 (which I have installed on this PC -
    although I did have XP earlier and maybe it stuck around dispite my
    repartition and reformat). Also no other PCs on my network have exhibited
    any of the same symptoms.

    I downloaded a memory testing program per suggestion and ran it overnight on
    the PC but did not get any errors. I'm not sure what I was supposed to find
    anyhow. If there is a bad memory location, can't the software live through
    it? Why would the PC restart instead of someother software error?

    My last resort is to change the NIC which I have saved for last in the hope
    of finding a more elegant cause, not because I didn't consider it earlier.
    I do teach my students to check the more obvious (and sometimes easiest)
    things first when troubleshooting. I just haven't found the time, but know
    that finals are over and classes are over, it will give me a summer project.

    I'll let y'all know what I find - if U care.

    lanceman



    "Thumper" <> wrote in message
    news:...
    > On Sat, 05 Jun 2004 14:50:10 GMT, Tom MacIntyre
    > <> wrote:
    >
    > >On Sat, 5 Jun 2004 10:36:37 +0100, "Nildram" <yesright@nonospamo.4me>
    > >wrote:
    > >
    > >>If you don't have up-to-date antivirus then you don't know that the

    network
    > >>is in fact healed?
    > >>
    > >>Do the easy stuff first like swap the network card, switch memory with
    > >>another machine etc. Rule out all this basic stuff and the virus

    situation
    > >>then you will have a problem worthy of asking people about.
    > >>
    > >>This coming from someone of TEACHES A+. !!
    > >>
    > >>M.

    > >
    > >There are probably people who teach medicine who aren't/weren't
    > >necessarily good doctors. There are Major League Baseball batting
    > >coaches, good ones, who couldn't hit worth a darn. In this case there
    > >have been some steps that should'be been taken, but there were also
    > >steps taken which indicate a level of competence. We don't know why
    > >certain things haven't been done that should have been. IMHO
    > >
    > >Tom
    > >

    >
    > People ought to give the guy credit for admitting that he teaches. he
    > could just as easily made up a story. It isn't really relevant to
    > helping him.
    > Thumper
    > >>
    > >>
    > >>"lanceman" <> wrote in message
    > >>news:...
    > >>> HELP, I teach A+ certification in HS and have a perplexing problem.

    My
    > >>> room is set up with a private LAN containing10 PC's (with XP) and a

    unix
    > >>> based server box connected with a switch. One of the PCs started
    > >>rebooting
    > >>> at the first access of the server from Internet explorer using a http

    URL.
    > >>> There was some sort of virus floating around the school at that time
    > >>(about
    > >>> 3 weeks ago) which exhibited similiar symptoms, so I suspected that

    the PC
    > >>> had somehow got infected. I repartitioned the hard drive followed by

    a
    > >>re
    > >>> format and a clean install of Win 98SE. (just to be different) I
    > >>installed
    > >>> NetBEUI and TCP/IP protocols (with fixed IP address), tried ping to

    check
    > >>> continuity, and fired up my browser and whamo the same thing happened.
    > >>The
    > >>> PC rebooted as soon as the the browser tried to access the server.

    What's
    > >>> the story?
    > >>>
    > >>> Some things I've tried:
    > >>> If I use an invalid URL, there is no problem, since nothing on the

    network
    > >>> responds
    > >>> Microsoft networking seems to work OK. I can access other folders on
    > >>other
    > >>> PC's including those in the server.
    > >>> The server also supports ftp. If I ftp the server, no problem.
    > >>> I looked in CMOS for some sort of wake -on-LAN setting that might be

    bad -
    > >>> didn;t see anything.
    > >>> I ran Norton antivirus but it didn't find anything ( although it is

    not
    > >>> current to the last 6 mos). Don't know if it checks the MBR.
    > >>>
    > >>> I haven't swapped out the ethernet card yet, I am still holding out

    for a
    > >>> software problem. Or is the virus still there?
    > >>>
    > >>> Any suggestions?
    > >>>
    > >>> Lanceman
    > >>>
    > >>>
    > >>
    > >>
    > >>---
    > >>Outgoing mail is certified Virus Free.
    > >>Checked by AVG anti-virus system (http://www.grisoft.com).
    > >>Version: 6.0.698 / Virus Database: 455 - Release Date: 02/06/2004
    > >>

    >
    lanceman, Jun 12, 2004
    #9
    1. Advertising

Want to reply to this thread or ask your own question?

It takes just 2 minutes to sign up (and it's free!). Just click the sign up button to choose a username and then you can ask your own questions on the forum.
Similar Threads
  1. Gerhard Vogler
    Replies:
    1
    Views:
    2,223
    Gerhard Vogler
    Jan 29, 2004
  2. a.nonny mouse
    Replies:
    2
    Views:
    1,096
  3. Replies:
    0
    Views:
    655
  4. Scott
    Replies:
    1
    Views:
    8,873
    ScottF
    Aug 4, 2004
  5. milan_9211

    HTTP SOAP/HTTP GET/HTTP POST

    milan_9211, Jan 10, 2011, in forum: Software
    Replies:
    0
    Views:
    3,089
    milan_9211
    Jan 10, 2011
Loading...

Share This Page