That malicious connection type line in my log files accounts for 35% of the log file! It's massive...
I reinstalled and upgraded Killer Web Mail, we'll see if that helps. How a bad HTML template would crash the web server I don't know, but that was IPSwitches suggestion. Scott At 04:21 PM 3/3/2002, you wrote: >I haven't had web messaging crash, but I have had unusually high virus >activity lately, including nimda/hybris/OL Vulenrability/Magistr. But no >Code Red. We have our IIS servers pretty well locked down. We have a >number of attempts on the web messaging with the "malicious connection type" >errors. > >Todd > >-----Original Message----- >From: [EMAIL PROTECTED] >[mailto:[EMAIL PROTECTED]]On Behalf Of Scott Baker >Sent: Sunday, March 03, 2002 6:13 PM >To: [EMAIL PROTECTED] >Subject: [IMail Forum] Web Messaging Crashing > > >Has anyone experienced any problems with Web Messaging crashing on them >lately. Mine has been crashing quite a bit since the upgrade to 7.05 and >7.06. I check the web logs and it looks like there is a LOT of code >red/nimda stuff in there. In fact most of the log file is related to those >two viruses. > >Lots of: > >20020302 213052 Socket Error - 12.224.40.84 Error while writing sockect due >to error 10054 or malicious connection type. >20020302 213052 Socket Error - 12.224.40.84 Error while writing sockect due >to error 10054 or malicious connection type. >20020302 213053 Socket Error - 12.224.40.84 Error while writing sockect due >to error 10054 or malicious connection type. > >Wondering if maybe there isn't an Imail exploit out there or something. > > >------------------------------- >ICQ: 46284013 - http://www.perturb.org/ > > >Please visit http://www.ipswitch.com/support/mailing-lists.html >to be removed from this list. > >An Archive of this list is available at: >http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ >--- >[This E-mail scanned for viruses by Declude Virus] > > >--- >[This E-mail scanned for viruses by Declude Virus] > > >Please visit http://www.ipswitch.com/support/mailing-lists.html >to be removed from this list. > >An Archive of this list is available at: >http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ ------------------------------- ICQ: 46284013 - http://www.perturb.org/ Please visit http://www.ipswitch.com/support/mailing-lists.html to be removed from this list. An Archive of this list is available at: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
