RE: IIS stopping without reason

[Witt, Michael S]

Title: Message

Wasn't there an article about how, even if you were fully patched against Code Red, that the mere act of an infected box attacking some IIS servers could cause that server to lock up.  The victum wouldn't get infected, but the attempted attack would cause something to lock.  I've read so many Code Red related new articles that I can't remember the reference...

-----Original Message-----
From: Erik Sojka [mailto:[EMAIL PROTECTED]]
Sent: Monday, August 20, 2001 3:53 PM
To: NT System Admin Issues
Subject: RE: IIS stopping without reason

Fmuuh?  I'll ask again.

 

It's possible that another internal machine is infected and is reinfecting the box in question.

 

Check your IIS logs for any entries that were logged at or before the times the boxes rebooted.  Or any log entries that might be CodeRed-related.

 

 

-----Original Message-----
From: Eric Peeters [mailto:[EMAIL PROTECTED]]
Sent: Monday, August 20, 2001 4:32 PM
To: NT System Admin Issues
Subject: RE: IIS stopping without reason

No, it's a perfectly normal boot, no red flag at all. All other servers are at least similarly protected as this one, or as badly, if you want to argue that point...

Eric Peeters
Network Administrator
TexLoc Ltd

-----Original Message-----
From: Erik Sojka [mailto:[EMAIL PROTECTED]]
Sent: Monday, August 20, 2001 3:25 PM
To: NT System Admin Issues
Subject: RE: IIS stopping without reason

Perhaps another internal box is infected.  Is there anything from the IIS logs from the times when the box goes belly up?

-----Original Message-----
From: Eric Peeters [mailto:[EMAIL PROTECTED]]
Sent: Monday, August 20, 2001 4:24 PM
To: NT System Admin Issues
Subject: RE: IIS stopping without reason

It can't be Code Red... Until that machine actually goes live, port 80 is blocked to outside traffic (and I am toying with the idea of not using port 80 when it goes live anyways), besides the Index Server service is disabled. Not patched (not my choice, people higher up make decisions I can't argue with) doesn't mean totally abandonned. I update the McAfee virus scan definition list whenever a new comes out, I have GroupShield running on Exchange (updated just as lovingly), I ran three all-files virus checks, on top of the on-access scan, since having this problem, I've rebooted twice (which should have taken care of Code Red if it had been an issue) and I've also ran the Code Red scanner, all to no avail.

Eric Peeters
Network Administrator
TexLoc Ltd

-----Original Message-----
From: Kevin Lundy [mailto:[EMAIL PROTECTED]]
Sent: Monday, August 20, 2001 3:06 PM
To: NT System Admin Issues
Subject: RE: IIS stopping without reason

The "no patch" is the clue.  My betting money is on Code Red - you have heard the news the past month?

-----Original Message-----
From: Eric Peeters [mailto:[EMAIL PROTECTED]]
Sent: Monday, August 20, 2001 4:09 PM
To: NT System Admin Issues
Subject: IIS stopping without reason

Hello,

My IIS4 server has been behaving strangely for the past four days. It is not a mission-critical unit (yet) as it runs only the users' default home page when they start IE though it was supposed to go live in a week as the IIS for OWA. On to the problem...

All IIS services (NNTP, FTP, HTTP) are stopped. I click on one of them at random and hit Start. Nothing happens. I click Start again after a few seconds. The service in question will start and function normally, however anywhere from 5 to 15 minutes later, it'll stop again. There is no message in the log file other than a notice in the Security log that the IIS account logged in and out at start/stop.

Besides IIS, that box is running Win NT 4 SP6a Server (no patch) and Exchange 5.5 SP1 (no patch) and it acts as the BDC.

I've roamed through the Microsoft KB (not easy, what keywords do you use to describe this when there's no message in the log) to no avail. Anyone out there with a suggestion ?

Eric Peeters
Network Administrator
TexLoc Ltd

http://www.sunbelt-software.com/ntsysadmin_list_charter.htm

http://www.sunbelt-software.com/ntsysadmin_list_charter.htm

http://www.sunbelt-software.com/ntsysadmin_list_charter.htm

http://www.sunbelt-software.com/ntsysadmin_list_charter.htm

http://www.sunbelt-software.com/ntsysadmin_list_charter.htm

http://www.sunbelt-software.com/ntsysadmin_list_charter.htm

http://www.sunbelt-software.com/ntsysadmin_list_charter.htm