Go to the CISCO web site and block it at the router. We did and it markedly
reduced the network load.
Kevin Childers
It's like I've always said, "You can get
more with a kind word and a two by four,
than you can get with just a kind word."
----- Original Message -----
From: "Mark" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Cc: <[EMAIL PROTECTED]>
Sent: Wednesday, August 08, 2001 10:58 PM
Subject: RE: [IMail Forum] New CodeRed like virus
> I am also having code red iis shutdowns also 3 in two days. I applied
> the latest SRP patches and rebooted again and am waiting before calling
> MSFT as John Cesta did below...
>
> I am running NT4.0 Dual Pentium III IIS 4.0 fully patched with the same
> box running SQL 7.0
>
> John Cesta's Microsoft fix!
> For over two weeks, a couple of shared web servers have been going nuts.
> Dr Watson locks Inetinfo, W3SVC stops, cycling all services usually did
> the trick. This trend escalated over the weekend with all of the
> probing going round.
>
> I gave in last night and called MSFT for help. He looked at my Dr
> Watson and quickly knew the problem, HTTPRedirect s in IIS after
> applying the CodeRed patch. I used MDUTIL.exe to dump IIS to a text
> file and searched for HTTPRedirect. Found a total of three across the
> two of them. Opened IIS, reset IIS to point to a directory, put a
> Default.asp in that directory with a single line <% RESPONSE.REDIRECT
> "HTTP://[IP]"; %> . Cycled IIS and the problem was solved.
>
> MSFT did not charge as this is a bug in the IIS / CodeRed patch.
>
>
> -----Original Message-----
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED]] On Behalf Of John Cesta -
> Lists
> Sent: Wednesday, August 08, 2001 8:29 AM
> To: [EMAIL PROTECTED]
> Subject: RE: [IMail Forum] New CodeRed like virus
>
>
>
>
> > -----Original Message-----
> > From: [EMAIL PROTECTED]
> > [mailto:[EMAIL PROTECTED]]On Behalf Of Steve Polyak
> > Sent: Monday, August 06, 2001 6:38 PM
> > To: [EMAIL PROTECTED]
> > Subject: [IMail Forum] New CodeRed like virus
> >
> >
> > Has anyone been running into what seems to be a CodeRed Virus. I have
>
> > my IIS web services stopping anywhere from a minute to an hour after
> > reboot. FTP services seem to be unaffected. I have the patches
> > installed from Microsoft since the last attack and have installed it a
>
> > number of times since. I have tested the server using the CodeRed
> > test from Norton and it says everything is ok. I do see the new Code
> > Red getting logged into my log
>
> There is actually a bug in the code red patch from microsoft. Read this:
>
> It may be a solution for the inetinfo crashes:
>
>
> For over two weeks, a couple of shared web servers have been going nuts.
> Dr Watson locks Inetinfo, W3SVC stops, cycling all services usually did
> the trick. This trend escalated over the weekend with all of the
> probing going round.
>
> I gave in last night and called MSFT for help. He looked at my Dr
> Watson and quickly knew the problem, HTTPRedirect s in IIS after
> applying the CodeRed patch. I used MDUTIL.exe to dump IIS to a text
> file and searched for HTTPRedirect. Found a total of three across the
> two of them. Opened IIS, reset IIS to point to a directory, put a
> Default.asp in that directory with a single line <% RESPONSE.REDIRECT
> "HTTP://[IP]"; %> . Cycled IIS and the problem was solved.
>
> MSFT did not charge as this is a bug in the IIS / CodeRed patch.
>
>
> > files as GET /default.ida XXXXXXXX and so forth but the server does
> > not really seem to crash. But when I try to restart the computer or
> > restart web
> > services the Events log says Also I have noticed that sometimes
> when
> > Inetinfo.exe Dr. Watson's the computer with blue screen and reboot.
> > Also sometimes I will see my SQL 7 server which is on the same machine
>
> > become busy. I have the latest Norton installed and up to date and
> > also have now install IIS Secure and the problem still occurs. It
> > only started on Friday like this and I am running out of ideas.
> > Anyone else been having the same problem? I have had one server do it
>
> > a couple time in the last couple days
> > and it did run SQL 7 at one point. The other servers seem to be fine.
> >
> > Thanks
> >
> > Steve
> >
> >
> > Please visit http://www.ipswitch.com/support/mailing-lists.html
> > to be removed from this list.
> >
> > An Archive of this list is available at:
> > http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
> >
>
>
> Please visit http://www.ipswitch.com/support/mailing-lists.html
> to be removed from this list.
>
> An Archive of this list is available at:
> http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
>
>
> Please visit http://www.ipswitch.com/support/mailing-lists.html
> to be removed from this list.
>
> An Archive of this list is available at:
> http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
>
Please visit http://www.ipswitch.com/support/mailing-lists.html
to be removed from this list.
An Archive of this list is available at:
http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
