> -----Original Message-----
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED]]On Behalf Of Steve Polyak
> Sent: Monday, August 06, 2001 6:38 PM
> To: [EMAIL PROTECTED]
> Subject: [IMail Forum] New CodeRed like virus
>
>
> Has anyone been running into what seems to be a CodeRed Virus. I have my
> IIS web services stopping anywhere from a minute to an hour after reboot.
> FTP services seem to be unaffected. I have the patches installed from
> Microsoft since the last attack and have installed it a number of times
> since. I have tested the server using the CodeRed test from Norton and it
> says everything is ok. I do see the new Code Red getting logged
> into my log
There is actually a bug in the code red patch from microsoft. Read this:
It may be a solution for the inetinfo crashes:
For over two weeks, a couple of shared web servers have been going nuts. Dr
Watson locks Inetinfo, W3SVC stops, cycling all services usually did the
trick. This trend escalated over the weekend with all of the probing going
round.
I gave in last night and called MSFT for help. He looked at my Dr Watson
and quickly knew the problem, HTTPRedirect s in IIS after applying the
CodeRed patch. I used MDUTIL.exe to dump IIS to a text file and searched
for HTTPRedirect. Found a total of three across the two of them. Opened
IIS, reset IIS to point to a directory, put a Default.asp in that directory
with a single line <% RESPONSE.REDIRECT "HTTP://[IP]"; %> . Cycled IIS and
the problem was solved.
MSFT did not charge as this is a bug in the IIS / CodeRed patch.
> files as GET /default.ida XXXXXXXX and so forth but the server does not
> really seem to crash. But when I try to restart the computer or
> restart web
> services the Events log says Also I have noticed that sometimes when
> Inetinfo.exe Dr. Watson's the computer with blue screen and reboot. Also
> sometimes I will see my SQL 7 server which is on the same machine become
> busy. I have the latest Norton installed and up to date and also have now
> install IIS Secure and the problem still occurs. It only started
> on Friday
> like this and I am running out of ideas. Anyone else been having the same
> problem? I have had one server do it a couple time in the last
> couple days
> and it did run SQL 7 at one point. The other servers seem to be fine.
>
> Thanks
>
> Steve
>
>
> Please visit http://www.ipswitch.com/support/mailing-lists.html
> to be removed from this list.
>
> An Archive of this list is available at:
> http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
>
Please visit http://www.ipswitch.com/support/mailing-lists.html
to be removed from this list.
An Archive of this list is available at:
http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
