I am also having code red iis shutdowns also 3 in two days. I applied
the latest SRP patches and rebooted again and am waiting before calling
MSFT as John Cesta did below...
I am running NT4.0 Dual Pentium III IIS 4.0 fully patched with the same
box running SQL 7.0
John Cesta's Microsoft fix!
For over two weeks, a couple of shared web servers have been going nuts.
Dr Watson locks Inetinfo, W3SVC stops, cycling all services usually did
the trick. This trend escalated over the weekend with all of the
probing going round.
I gave in last night and called MSFT for help. He looked at my Dr
Watson and quickly knew the problem, HTTPRedirect s in IIS after
applying the CodeRed patch. I used MDUTIL.exe to dump IIS to a text
file and searched for HTTPRedirect. Found a total of three across the
two of them. Opened IIS, reset IIS to point to a directory, put a
Default.asp in that directory with a single line <% RESPONSE.REDIRECT
"HTTP://[IP]"; %> . Cycled IIS and the problem was solved.
MSFT did not charge as this is a bug in the IIS / CodeRed patch.
-----Original Message-----
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of John Cesta -
Lists
Sent: Wednesday, August 08, 2001 8:29 AM
To: [EMAIL PROTECTED]
Subject: RE: [IMail Forum] New CodeRed like virus
> -----Original Message-----
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED]]On Behalf Of Steve Polyak
> Sent: Monday, August 06, 2001 6:38 PM
> To: [EMAIL PROTECTED]
> Subject: [IMail Forum] New CodeRed like virus
>
>
> Has anyone been running into what seems to be a CodeRed Virus. I have
> my IIS web services stopping anywhere from a minute to an hour after
> reboot. FTP services seem to be unaffected. I have the patches
> installed from Microsoft since the last attack and have installed it a
> number of times since. I have tested the server using the CodeRed
> test from Norton and it says everything is ok. I do see the new Code
> Red getting logged into my log
There is actually a bug in the code red patch from microsoft. Read this:
It may be a solution for the inetinfo crashes:
For over two weeks, a couple of shared web servers have been going nuts.
Dr Watson locks Inetinfo, W3SVC stops, cycling all services usually did
the trick. This trend escalated over the weekend with all of the
probing going round.
I gave in last night and called MSFT for help. He looked at my Dr
Watson and quickly knew the problem, HTTPRedirect s in IIS after
applying the CodeRed patch. I used MDUTIL.exe to dump IIS to a text
file and searched for HTTPRedirect. Found a total of three across the
two of them. Opened IIS, reset IIS to point to a directory, put a
Default.asp in that directory with a single line <% RESPONSE.REDIRECT
"HTTP://[IP]"; %> . Cycled IIS and the problem was solved.
MSFT did not charge as this is a bug in the IIS / CodeRed patch.
> files as GET /default.ida XXXXXXXX and so forth but the server does
> not really seem to crash. But when I try to restart the computer or
> restart web
> services the Events log says Also I have noticed that sometimes
when
> Inetinfo.exe Dr. Watson's the computer with blue screen and reboot.
> Also sometimes I will see my SQL 7 server which is on the same machine
> become busy. I have the latest Norton installed and up to date and
> also have now install IIS Secure and the problem still occurs. It
> only started on Friday like this and I am running out of ideas.
> Anyone else been having the same problem? I have had one server do it
> a couple time in the last couple days
> and it did run SQL 7 at one point. The other servers seem to be fine.
>
> Thanks
>
> Steve
>
>
> Please visit http://www.ipswitch.com/support/mailing-lists.html
> to be removed from this list.
>
> An Archive of this list is available at:
> http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
>
Please visit http://www.ipswitch.com/support/mailing-lists.html
to be removed from this list.
An Archive of this list is available at:
http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
Please visit http://www.ipswitch.com/support/mailing-lists.html
to be removed from this list.
An Archive of this list is available at:
http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
