Yes, this exact thing was happening to our server. IIS would shut down 55 times
a day, but so would all the other services (FTP, etc.), but the system itself
would not crash that often. But after we installed the patch for Code Red, then
everything has been fine since. Be sure to reboot right after you install the
patch to wipe the virus from RAM.
Domain Administrator wrote:
> ----- Original Message -----
> From: "Steve Polyak" <[EMAIL PROTECTED]>
> To: <[EMAIL PROTECTED]>
> Sent: Monday, August 06, 2001 3:37 PM
> Subject: [IMail Forum] New CodeRed like virus
>
> > Has anyone been running into what seems to be a CodeRed Virus. I have my
> > IIS web services stopping anywhere from a minute to an hour after reboot.
> > FTP services seem to be unaffected. I have the patches installed from
> > Microsoft since the last attack and have installed it a number of times
> > since. I have tested the server using the CodeRed test from Norton and it
> > says everything is ok. I do see the new Code Red getting logged into my
> log
> > files as GET /default.ida XXXXXXXX and so forth but the server does not
> > really seem to crash. But when I try to restart the computer or restart
> web
> > services the Events log says Also I have noticed that sometimes when
> > Inetinfo.exe Dr. Watson's the computer with blue screen and reboot. Also
> > sometimes I will see my SQL 7 server which is on the same machine become
> > busy. I have the latest Norton installed and up to date and also have now
> > install IIS Secure and the problem still occurs. It only started on
> Friday
> > like this and I am running out of ideas. Anyone else been having the same
> > problem? I have had one server do it a couple time in the last couple
> days
> > and it did run SQL 7 at one point. The other servers seem to be fine.
> >
> > Thanks
> >
> > Steve
> >
> >
> > Please visit http://www.ipswitch.com/support/mailing-lists.html
> > to be removed from this list.
> >
> > An Archive of this list is available at:
> > http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
> >
> >
>
> Please visit http://www.ipswitch.com/support/mailing-lists.html
> to be removed from this list.
>
> An Archive of this list is available at:
> http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
Please visit http://www.ipswitch.com/support/mailing-lists.html
to be removed from this list.
An Archive of this list is available at:
http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
