Are there any entries in the IIS log around this time frame call for CMD with a bunch of ..\..'s
I know of a hacking tool called ROOT with an exe at the end that was placed in by one of those code red variants. Version 054 is still susceptible to the cookie buffer over run issue, can you go to 062 Just E:Thinking out loud Ben Johansen - http://www.pcforge.com Authorized Witango Reseller http://www.pcforge.com/WitangoGoodies.htm Authorized MDaemon Mail Server Reseller http://www.pcforge.com/AltN.htm -----Original Message----- From: Dave Machin [mailto:[EMAIL PROTECTED] Sent: Wednesday, August 13, 2003 1:36 PM To: [EMAIL PROTECTED] Subject: Witango-Talk: IIS Suddenly Errors Suddenly this afternoon, IIS generates a 500 error (HTTP 500 - Internal server error ) on every third(!) click on my WiTango applications. Hitting refresh brings the expected page up, but two clicks later it generates an error. The event log shows the following when this happens: 'Out of process application '/LM/W3SVC/1/ROOT' terminated unexpectedly. ' WiTango makes no new log entries when the error appears. Rebooting has no effect. I'm running W2K SP3, IIS5, and WiTango 5.0.1.054. Two other similar servers are unaffected. The machine is hidden behind our firewall and unavailable to the outside world (in theory :-) Any ideas? Dave Machin E-Mail. [EMAIL PROTECTED] Tel. 805.614.0123 x 30 Address: 3130 Skyway Drive #702 Santa Maria, CA 93455 ________________________________________________________________________ TO UNSUBSCRIBE: Go to http://www.witango.com/maillist.taf ________________________________________________________________________ TO UNSUBSCRIBE: Go to http://www.witango.com/maillist.taf
