Ok, remember the movie Gremlins? Well a gremlin is also a “ghost in the machine”, a quirk or bug in the system. So when computers are doing weird stuff, tech guys would say “there is a gremlin in the system”. Well, I hope I just fixed a gremlin in my system (webserver).
What’s the case? Well, for some weird reason my webserver kept rebooting or shutting down on itself. Now, my first thought was: I’ve been hacked and some guy whose pubic hair hasn’t started to grow yet finds my PC a interesting target for whatever obscure reason.
And there did my search start.
First I scanned my PC, then I updated all my anti-spyware tools, blocked some more ports (I already had moved my PC out of the DMZ and just use port forwarding). I looked at my eventlog: nothing there. I turned on this obscure setting in my registry that logs all shutdowns and restarts and requires you to give a reason. Then I truend the packet logging of my firewall on. Still: I found nothing, zilch, nada. No shred of evidence (although the packetlog generated so much traffic my PC almost choked on that).
However: low and behold, while I was sitting behind my PC looking for a hacker, my restart screen suddenly appeared! As is if someone was playing a trick on me and trying to show me that “he” (or “them” – its always “them” isn’t it?) was on to me! So I just clicked cancel like 5-6 times! Then suddenly the PC just shut down even before I could click cancel.
So, I rebooted again. Now, I figured, if some guy has remote control of my PC, I can just block him, by blocking all network traffic. So I pressed “block all” on my firewall. To my big surpise: again comes up the shutdown/restart window! “Wow, did they hack my firewall too?” was my first thought.
Time for desparate measures! I janked out my network cable! There! That would keep them out for sure! So I thought! Once again: a couple of restart screens appeared! How the hell could that happen?
So, in the words of Sherlock Holmes:
“When you have eliminated all which is impossible, then whatever remains, however improbable, must be the truth.”
He also said: “It is a capital mistake to theorize before one has data. Insensibly one begins to twist facts to suit theories, instead of theories to suit facts.”
Ok, with that in mind I went on. So, the only logical explanation to me would be: it’s not a hacker or a virus. My attention was drawn to my network card light (I opened my PC in a effort to find out if it would shutdown because of overheating of the CPU).
Hmm, what if… So next I rebooted and went into the bios. I looked at the page that managed the so called WOL (wake up on lan) and that also does the reverse (shutdown/reboot). I remembered that there was update for my network driver a few days before and I installed that.
What if there was some problem with that? Anyway: I turned it all off in my bios and so far I haven’t had any unexpected reboots (that I am aware of).
So did I kill the gremlin? Who knows. Time will tell.
ps: while I was writing this blog suddenly my router rebooted on its own and my whole network went down! WTF? Another gremlin?