Intrusion from web?

[GetCarter]

Hi chaps

Computer was running last night - logged on, and for some reason I'd left the speakers on. 0300 I hear the computer do a restart. Weird. Computer would have had to shut down progs to restart (?)

Firewall on etc, but have been getting a lot of 'trojan horse' attacks recently.

Just checked the log from 0300 and it reads (all within about 2 mins):
Firewall configuration updated
2.0.0.50707 is monitoring 531 signatures
svchost.exe is trying to access the internet
lsass.exe is trying to access the internet
ccProxey.exe is trying to access the internet
BackWeb.exe is trying to access the internet
ccApp.exe is trying to access the internet

The computer then restarted.

Is that spooky or normal? (It felt spooky at 0300!)

Ta

Steve

[JonRB]

Do you have Windows Automatic Updates turned on?

Edit: Or, indeed, any type of automatically updating software like Norton or whatever?

>> Edited by JonRB on Saturday 7th January 09:17

[GetCarter]

I have 'automatically update my firewall' checked. I guess that must have been it... twas mainly strange as normally it lets me save data, quit programmes and then restart. Not come accross it closing all progs (outlook etc) logging off the net and restarting by itself before.

ta

[JonRB]

GetCarter said:

I have 'automatically update my firewall' checked.

Well that might explain why the first line of your log was "firewall configuration updated".

[BliarOut]

03:00 is the default time for automatic updates to be installed. The recently released one required an automatic restart, so I would say it was normal. If you search for WindowsUpdate.log in your Windows directory there will be an entry about "Content Install Reboot completed" towards the end. That will confirm our suspicions. I suspect the firewall rules are a result of some core windows file signatures changing after the event.

[fredd1e]

There was an critical MS patch release on the 5th which on mine auto installed and rebooted around 19:00 last nite.

[agent006]

BliarOut said:

03:00 is the default time for automatic updates to be installed. The recently released one required an automatic restart, so I would say it was normal.

WMF patch was released yesterday.