I agree the SRP download of a the security patches including the code
red patch from Microsoft seems to have fix our problems. Up for 3 days
no restarts.
-----Original Message-----
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of Brian Hruska
Sent: Friday, August 10, 2001 7:59 AM
To: [EMAIL PROTECTED]
Subject: Re: [IMail Forum] New CodeRed like virus
My Win2K server has been stable for a couple days now . Not sure what
combo of things I've tried has worked, but here's a short list of what I
did:
-disabled all un-needed file extentions in IIS... including the .ida for
all the thousands of dummy hits on default.ida I was getting. -blocked
the IP addresses of the servers who were hitting me with all those
default.ida files. -shut down the search and indexing services since I
wasn't using them anyhow. -went to update.microsoft.com to RE-DOWNLOAD
all patches for the server. I think re-download is a new option out
there cause I don't remember seeing it before.
Frankly, I think it was the last item that did it. That was suggested
by someone on this email list. Its possible Microsoft has re-tweaked
some of those patches, or tied the installs together better. Who knows,
but so far so good.
Brian
----- Original Message -----
From: "Mark" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Cc: <[EMAIL PROTECTED]>
Sent: Wednesday, August 08, 2001 9:58 PM
Subject: RE: [IMail Forum] New CodeRed like virus
> I am also having code red iis shutdowns also 3 in two days. I applied
> the latest SRP patches and rebooted again and am waiting before
> calling MSFT as John Cesta did below...
>
> I am running NT4.0 Dual Pentium III IIS 4.0 fully patched with the
> same box running SQL 7.0
>
> John Cesta's Microsoft fix!
> For over two weeks, a couple of shared web servers have been going
> nuts. Dr Watson locks Inetinfo, W3SVC stops, cycling all services
> usually did the trick. This trend escalated over the weekend with all
> of the probing going round.
>
> I gave in last night and called MSFT for help. He looked at my Dr
> Watson and quickly knew the problem, HTTPRedirect s in IIS after
> applying the CodeRed patch. I used MDUTIL.exe to dump IIS to a text
> file and searched for HTTPRedirect. Found a total of three across the
> two of them. Opened IIS, reset IIS to point to a directory, put a
> Default.asp in that directory with a single line <% RESPONSE.REDIRECT
> "HTTP://[IP]"; %> . Cycled IIS and the problem was solved.
>
> MSFT did not charge as this is a bug in the IIS / CodeRed patch.
>
>
> -----Original Message-----
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED]] On Behalf Of John Cesta -
> Lists
> Sent: Wednesday, August 08, 2001 8:29 AM
> To: [EMAIL PROTECTED]
> Subject: RE: [IMail Forum] New CodeRed like virus
>
>
>
>
> > -----Original Message-----
> > From: [EMAIL PROTECTED]
> > [mailto:[EMAIL PROTECTED]]On Behalf Of Steve
> > Polyak
> > Sent: Monday, August 06, 2001 6:38 PM
> > To: [EMAIL PROTECTED]
> > Subject: [IMail Forum] New CodeRed like virus
> >
> >
> > Has anyone been running into what seems to be a CodeRed Virus. I
> > have
>
> > my IIS web services stopping anywhere from a minute to an hour after
> > reboot. FTP services seem to be unaffected. I have the patches
> > installed from Microsoft since the last attack and have installed it
> > a
>
> > number of times since. I have tested the server using the CodeRed
> > test from Norton and it says everything is ok. I do see the new
> > Code Red getting logged into my log
>
> There is actually a bug in the code red patch from microsoft. Read
> this:
>
> It may be a solution for the inetinfo crashes:
>
>
> For over two weeks, a couple of shared web servers have been going
> nuts. Dr Watson locks Inetinfo, W3SVC stops, cycling all services
> usually did the trick. This trend escalated over the weekend with all
> of the probing going round.
>
> I gave in last night and called MSFT for help. He looked at my Dr
> Watson and quickly knew the problem, HTTPRedirect s in IIS after
> applying the CodeRed patch. I used MDUTIL.exe to dump IIS to a text
> file and searched for HTTPRedirect. Found a total of three across the
> two of them. Opened IIS, reset IIS to point to a directory, put a
> Default.asp in that directory with a single line <% RESPONSE.REDIRECT
> "HTTP://[IP]"; %> . Cycled IIS and the problem was solved.
>
> MSFT did not charge as this is a bug in the IIS / CodeRed patch.
>
>
> > files as GET /default.ida XXXXXXXX and so forth but the server does
> > not really seem to crash. But when I try to restart the computer or
> > restart web
> > services the Events log says Also I have noticed that sometimes
> when
> > Inetinfo.exe Dr. Watson's the computer with blue screen and reboot.
> > Also sometimes I will see my SQL 7 server which is on the same
> > machine
>
> > become busy. I have the latest Norton installed and up to date and
> > also have now install IIS Secure and the problem still occurs. It
> > only started on Friday like this and I am running out of ideas.
> > Anyone else been having the same problem? I have had one server do
> > it
>
> > a couple time in the last couple days
> > and it did run SQL 7 at one point. The other servers seem to be
> > fine.
> >
> > Thanks
> >
> > Steve
> >
> >
> > Please visit http://www.ipswitch.com/support/mailing-lists.html
> > to be removed from this list.
> >
> > An Archive of this list is available at:
> > http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
> >
>
>
> Please visit http://www.ipswitch.com/support/mailing-lists.html
> to be removed from this list.
>
> An Archive of this list is available at:
> http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
>
>
> Please visit http://www.ipswitch.com/support/mailing-lists.html
> to be removed from this list.
>
> An Archive of this list is available at:
> http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
>
Please visit http://www.ipswitch.com/support/mailing-lists.html
to be removed from this list.
An Archive of this list is available at:
http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
Please visit http://www.ipswitch.com/support/mailing-lists.html
to be removed from this list.
An Archive of this list is available at:
http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
