7031 doesn't have to be Code Red, this can be the result of many DoS attacks as well. Can you check that the DLLs on the FEP are indeed updated with the latest security patch:
>From Q273877 The English version of this fix should have the following file attributes or later: Date Time Version Size File name Platform ------------------------------------------------------------- 09/12/2000 07:37p 5.0:2195.2194 357,136 W3svc.dll x86 I have also seen this once or twice when the machine was isolated from the DNS/GC as the result of a bad LAN segment (intermittent outage). Any chance that the FEP is not on the same switch as the DNS? Try some pings from the FEP console to the configured machines and check the other event logs for warnings/errors. Is your FEP using static IP's - not DHCP - just thinking about lease renewals. Mark Plus Pack for OWA SecureLogoff for OWA http://www.messageware.net -----Original Message----- From: Helen Best [mailto:hbest@;bournemouth.ac.uk] Sent: Tuesday, October 29, 2002 7:08 AM To: Exchange Discussions Subject: RE: Ex2k and IIS Problem These are all clean - thanks > -----Original Message----- > From: Mark Harford [SMTP:[EMAIL PROTECTED]] > Sent: Tuesday, October 29, 2002 11:18 AM > To: Exchange Discussions > Subject: RE: Ex2k and IIS Problem > > And there's definitely no trace on the BE servers either? > > http://microsoft.com/technet/treeview/default.asp?url=/technet/security/ > tools/tools/redfix.asp > > -----Original Message----- > From: Helen Best [mailto:hbest@;bournemouth.ac.uk] > Sent: 29 October 2002 09:14 > To: Exchange Discussions > Subject: RE: Ex2k and IIS Problem > > > No - simply Windows, Exchange and the compaq tools > > I read that it is best to only install virus software on the back end > servers in a FE/BE situation > > Helen > > > -----Original Message----- > > From: Ed Crowley [SMTP:[EMAIL PROTECTED]] > > Sent: Tuesday, October 29, 2002 5:44 AM > > To: Exchange Discussions > > Subject: RE: Ex2k and IIS Problem > > > > Are you running anything else, like a virus scanner, on the machine? > > > > Ed Crowley MCSE+I MVP > > Technical Consultant > > hp Services > > "There are seldom good technological solutions to behavioral > > problems." > > > > > > -----Original Message----- > > From: [EMAIL PROTECTED] > > [mailto:bounce-exchange-94760@;ls.swynk.com] On Behalf Of Helen Best > > Sent: Monday, October 28, 2002 7:25 AM > > To: Exchange Discussions > > Subject: Ex2k and IIS Problem > > > > > > We installed EX2k in August for our Students > > > > 2 back end servers - Ex2k with SP2 on Advanced Server with SP3 - this > > holds the 17000 student mailboxes - all appears to be fine here. > > Compaq Utilities installed on both - These are connected to a SAN. > > > > Originally 1 front end server - dual PIII processors with 1Gb RAM, > > EX2k SP2 with Advanced Server SP3 - this is/was for Incoming External > > mail (via our Sendmail server) and OWA. > > This server would regularly stop its IIS and Exchange Services > with > > error code 7031 - This believes that there is a code red worm on the > > server > > - but the server has been patched from Windows Update. > > > > So a second Front end server was put in place for OWA - same build but > > > was stable until the 1st FE was rebuilt. Everything was put through to > > > the 2nd FE. 1st FE came up with no problems but 2nd FE then started > > having the same problem as the 1st before the rebuild. > > > > SMTP mail put back to 1st Server - everything was stable until 2nd FE > > was rebuilt - 2nd now stable but 1st no longer. > > > > The 2nd was rebuilt without the Compaq Utilities and with additional > > RAm > > - now 1.75GB > > > > 1st server also started having other problems which have all been > > resolved apart from the original 7031 - services termintating > > unexpectedly. > > > > Has anyone seen this problem, know of a fix, or can point me in the > > right direction Please??? > > > > Thanks in advance > > Helen Best > > Bournemouth University > > > > _________________________________________________________________ > > List posting FAQ: http://www.swinc.com/resource/exch_faq.htm > > Archives: http://www.swynk.com/sitesearch/search.asp > > To unsubscribe: mailto:leave-exchange@;ls.swynk.com > > Exchange List admin: [EMAIL PROTECTED] > > > > > > _________________________________________________________________ > > List posting FAQ: http://www.swinc.com/resource/exch_faq.htm > > Archives: http://www.swynk.com/sitesearch/search.asp > > To unsubscribe: mailto:leave-exchange@;ls.swynk.com > > Exchange List admin: [EMAIL PROTECTED] > > _________________________________________________________________ > List posting FAQ: http://www.swinc.com/resource/exch_faq.htm > Archives: http://www.swynk.com/sitesearch/search.asp > To unsubscribe: mailto:leave-exchange@;ls.swynk.com > Exchange List admin: [EMAIL PROTECTED] > > > BBCi at http://www.bbc.co.uk/ > > This e-mail (and any attachments) is confidential and may contain > personal views which are not the views of the BBC unless specifically > stated. > If you have received it in error, please delete it from your system, do > not use, copy or disclose the information in any way nor act in > reliance on it and notify the sender immediately. Please note that the > BBC monitors e-mails sent or received. Further communication will > signify your consent to this. > > > _________________________________________________________________ > List posting FAQ: http://www.swinc.com/resource/exch_faq.htm > Archives: http://www.swynk.com/sitesearch/search.asp > To unsubscribe: mailto:leave-exchange@;ls.swynk.com > Exchange List admin: [EMAIL PROTECTED] _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:leave-exchange@;ls.swynk.com Exchange List admin: [EMAIL PROTECTED] _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:leave-exchange@;ls.swynk.com Exchange List admin: [EMAIL PROTECTED]
