For those of you who don't know, Microsoft has a utility that allows you to
install multiple hotfixes with only one reboot.
http://support.microsoft.com/support/kb/articles/Q296/8/61.ASP
I searched the archives to see if this was already discussed and I couldn't
find anything. I'm hoping that this can help some of you who have been
forced to do a "do over".
-----Original Message-----
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]]On Behalf Of Steve Polyak
Sent: Tuesday, August 07, 2001 4:22 PM
To: [EMAIL PROTECTED]
Subject: RE: [IMail Forum] New CodeRed like virus
Ok, I thought I was not on glue. I am right now rebuilding the server. I
have moved all the websites off to another server that seems to be
unaffected by the attacks. I have one other server that seems to have this
problem every now and then but not as bad as the main server. I also have
seen in the log files
GET /x.ida XXXXXXXX
GET /default.ida aaaaaaaa
I have done so many repatches just incase I missed something but it is no
good. Are you running SQL server on the same machine or any other software?
I have noticed that my SQL server usually starts being busy right as the
sites crash.
Steve
-----Original Message-----
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]]On Behalf Of Domain
Administrator
Sent: August 7, 2001 9:51 AM
To: [EMAIL PROTECTED]
Subject: Re: [IMail Forum] New CodeRed like virus
I am having the EXACT same problems... and I KNOW I have the patch on ALL my
servers.
I have noticed that the "CodeRed" attack IS different this time...
Last time it was: GET /default.ida NNNNNNN...
This time it is: GET /default.ida XXXXXXXX...
Sure would like to figure it out!
----- Original Message -----
From: "Steve Polyak" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Monday, August 06, 2001 3:37 PM
Subject: [IMail Forum] New CodeRed like virus
> Has anyone been running into what seems to be a CodeRed Virus. I have my
> IIS web services stopping anywhere from a minute to an hour after reboot.
> FTP services seem to be unaffected. I have the patches installed from
> Microsoft since the last attack and have installed it a number of times
> since. I have tested the server using the CodeRed test from Norton and it
> says everything is ok. I do see the new Code Red getting logged into my
log
> files as GET /default.ida XXXXXXXX and so forth but the server does not
> really seem to crash. But when I try to restart the computer or restart
web
> services the Events log says Also I have noticed that sometimes when
> Inetinfo.exe Dr. Watson's the computer with blue screen and reboot. Also
> sometimes I will see my SQL 7 server which is on the same machine become
> busy. I have the latest Norton installed and up to date and also have now
> install IIS Secure and the problem still occurs. It only started on
Friday
> like this and I am running out of ideas. Anyone else been having the same
> problem? I have had one server do it a couple time in the last couple
days
> and it did run SQL 7 at one point. The other servers seem to be fine.
>
> Thanks
>
> Steve
>
>
> Please visit http://www.ipswitch.com/support/mailing-lists.html
> to be removed from this list.
>
> An Archive of this list is available at:
> http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
>
>
Please visit http://www.ipswitch.com/support/mailing-lists.html
to be removed from this list.
An Archive of this list is available at:
http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
Please visit http://www.ipswitch.com/support/mailing-lists.html
to be removed from this list.
An Archive of this list is available at:
http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
Please visit http://www.ipswitch.com/support/mailing-lists.html
to be removed from this list.
An Archive of this list is available at:
http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
