I am having a problem where my computer randomly shuts down. It will
be on for a short amount of time then all of a sudden it closes all
programs, tells me windows is shutting down and then it goes into safe
mode and says you may now shutdown your computer.

The computer is an IBM T30 laptop. The op system is Windows 2000. 

The virus definitions software is up to date and has been run. I  have
also run scandisk and found everything to be fine.

The program causes no damage, everything runs fine except I lose any
unsaved work when it randomly shuts down and it has become extremely
annoying. It will shut down maybe twice an hour then another four
hours later will do it again.

Additionally, it only appears to happen when I'm at the office. The IT
folks have been unable to resolve the issue (although a couple other
people in the office have encountered the same problem).

Any help, suggestions, explanations etc would be extremely helpful.

Thank you! Meghan Corbett

---

Request for Question Clarification by hummer-ga on 19 Jul 2004 08:49 PDT

Hi Meghan Corbett,

Since other computers on the network are experiencing the same
problem, it's likely that the network has picked up some spyware or
virus somewhere and I think all of you should download and run the
following programs.

1) Adaware (check for updates before running):
http://www.spychecker.com/program/adaware.html

2) Sybot Search and Destroy (check for updates before running):
http://www.safer-networking.org/

Run them again until they come back clean.

You should also run HouseCall, a very thorough online virus scan which
often finds things that others miss.

HouseCall:
http://housecall.trendmicro.com/

Please let me know how that goes -
hummer

---

Request for Question Clarification by tisme-ga on 19 Jul 2004 16:53 PDT

Hello mlcduke-ga,

Here is what I want you to do: 

Click on Start, Settings, Control Panel, Administrative Tools and then
Event Viewer.

Have a look at some of the events right after this happened and give
me the Event ID numbers. I am especially interested in events under
the System heading, but Application and Security events numbers might
also be useful.

Most events classified as Information are probably not important
(except if they happen right before the computer shuts down).

I look forward to your response,

tisme-ga

---

Clarification of Question by mlcduke-ga on 27 Jul 2004 11:23 PDT

To Tisme-ga

Thanks for your help. Everyone else's answers are not helping. My
computer is still shutting down. The event #s directly preceeding my
computer shut off are: 6005, 6006, 6009 and 105.

Can you help me? Thank you.

On XP, NT, or 2000 as Administrator, do this:

First do this:

Go to Start->Run

Type in "Services.msc"

Click on the first Service

It should be something like Alerter.  Double Click it.

Click on Recovery Tab

Where it says first failure, Make sure it says "Take No Action" or on
"Restart The Service."  If it is on "Restart the Computer", change it
to "Take No Action".  Check this for Second and Third Failure and for
all other services.

Common one messed up by a virus is Remote Procedure Call.

If that doesn't work, go to Start->Run and type in Regedit.

Open the tree so you see
HKEY_CURRENT_USER->SOFTWARE->MICROSOFT->WINDOWS->CURRENTVERSION->RUN

Click on it.  You'll see a bunch of programs to the left.  Many of
them, I bet you didn't install.  Delete the ones that you have no clue
what they are.  You probably don't need them and they are probably a
spyware or a virus.  Click on the ones you want to delete and press
the "delete key", right above the arrow keys.  Close the registry and
reboot the computer.  Hopefully the program that caused your computer
to crash is gone.

Now go download ZoneAlarm.  It is a free firewall program that will
prevent unsolicited programs from accessing the internet and others
from accessing your computer on the network. 
http://www.download.com/3000-2092-10039884.html?part=zonealarm&subj=dlpage&tag=button.

Hi, since you've mentioned that this problem only occurs when you're
at the office, it's reasonable to assume that you're connected to a
local area network.  While you are connected to the network, you are
usually able to share files, folders, printers, etc... with other
computers also connected.

This file sharing service is prone to many security issues, including
some viruses taking advantage of one of the RPC vulnerabilities fixed
by Microsoft not so long ago.  The vast majority of up-to-date
antivirus scanners will detect these worms trying to exploit this
hole, so it isn't likely to be a virus causing your problem.

It is possible however, that someone is using a program similar to one
called 'SMBdie', which actually does the same thing as these RPC
viruses (restarting or shutting down your computer) are programed to
do, only without it trying to replicate itself, so this action would
not trigger any antivirus alerts.

To ensure that neither of these are the problem, you should make sure
that all critical patches issued by Microsoft are applied to your
laptop.  This can be easily accomplished by running 'Windows Update',
which can be found at the top of the 'start menu'.

Another possibility if you're connected to a network, is someone using
a remote shutdown program.  Again, this works over the same set of
services used by file and print sharing.

These programs are free and easy to come by on the internet - it could
just be someone in your office playing a practical joke.  A remote
shutdown program requires the remote user to know your administrator
password for your computer (or else they would need to have an account
that supercedes your own).  As such, i would recommend changing the
password to something that would be hard for someone else to guess and
that only you know.

I hope that these ideas help, even if they only serve to eliminate the possibility.

It could be the problem with cooling system ( by some reason, laptop's
fan is not run well as it supposed to ) and it may cause your laptop
shutdown randomly.
You can check if your laptop is too hot or no air blowed out at all.good luck

Hello!

It clearly seems that in your office's network is invaded by viruses.
Like someone else said, viruses messing up RPC service (Blaster-like
worm).

You do not have this virus yourself (you checked it up latest
antivirus software) somebody in your network has.

These are solutions:

You can install personal firewall software (just like sombody earlier said):
http://www.microsoft.com/athome/security/protect/windows2000/firewall.aspx
then download microsoft updates:
http://www.microsoft.com/athome/security/protect/windows2000/updates.aspx

In fact the firewall software is needed to give you time (before
shutdown) to download microsoft updates.

You can try install updates before shutdown occur yourself.
If the shutdown window appears you can break shutdown process by
running command "shutdown -a":
 go to start menu, choose run, type:
      shutdown -a
 then press enter.

This will give you time to end installing updates. Shutdown window
will not appear again. But some Windows functionalities may not work.

Install this patch:

http://www.microsoft.com/downloads/details.aspx?FamilyId=F4F66D56-E7CE-44C3-8B94-817EA8485DD1&displaylang=en

This is CLEARLY the work of the infamous BLASTER WORM,

use the following tool by symantec (download it, and then disconnect
your laptop from the internet)
run this tool
http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.removal.tool.html

THEN when that is done (might not find anything as this specific virus
removes and hides itself sometimes)
then download the following W2K patch (KB823980)
http://www.microsoft.com/downloads/details.aspx?FamilyID=c8b8a846-f541-4c15-8c9f-220354449117&displaylang=en

PS: if you tried to fix a windows XP computer with this virus, you
must first disable system restore by going into Control Panels, switch
to classic View, Systems, and then the system restore tab, then check
the disable system restore on all drives box

One more note on my answer, you need to install Service Pack 3 for W2k
Before apply the KB823980 patch