date:20010920

Cannot install WIN2k SP2 - No print spooler

2001-09-20 Thread Andrew Frost


COMPAQ DL580 WIN2K Adv Server SP1. 
 
Try to install SP2 and get a message cannot install as the print spooler is
not running. 
The spooler does not appear in the service list and net start spooler
returns service name is invalid. 
Tried to reinstall SP1 and get the same message. 

Any ideas appreciated. In fact I did not know you could have a install
without that service installed. TIA
 
Andrew Frost

http://www.sunbelt-software.com/ntsysadmin_list_charter.htm

Terminal Services/Citrix bug on a 933/1000Mhz multiproc system...?

2001-09-20 Thread Vance Krier


Hello all,

I ran across the following article that startled me somewhat. 

http://www.nwfusion.com/news/2001/0604infra.html

It talks about a bug that crashes MSTS and Citrix when run on a
multiprocessor 933 or 1000Mhz system.  I've searched, but I can't find any
other information on this.

Can anyone confirm/deny or point me in the direction of an article from MS
or Citrix or other?

Thanks!
Vance

http://www.sunbelt-software.com/ntsysadmin_list_charter.htm

RE: Cannot install win2k Sp2 No print spooler

2001-09-20 Thread Martin Henriksen




How 
about reinstalling file andprint sharing?

/MH

  -Original Message-From: Andrew Frost 
  [mailto:[EMAIL PROTECTED]]Sent: 20. september 2001 
  07:14To: NT System Admin IssuesSubject: Cannot install 
  win2k Sp2 No print spooler
  COMPAQDL580WIn2K Adv SP1. 
  
  
  Try to install SP2 
  and get a message cannot install SP2 as the print spooler is not running. The 
  spooler does not appear in the service list and net start spooler 
  returns service name is invalid. Tried to reinstall Sp1 and get the same 
  message. Any ideas as have not found any clues in TechNet. In fact I did not 
  know you could have a install without that service installed. 
  TIA
  
  Andrew 
  Frosthttp://www.sunbelt-software.com/ntsysadmin_list_charter.htm
http://www.sunbelt-software.com/ntsysadmin_list_charter.htm

Adding unlisted NIC driver to network install

2001-09-20 Thread Mark Pilbeam


Hi,

Is there any way in NT4.0 Server to add an unlisted NIC in the Network
Client Installation program?
Alternatively, is there any easy way to add an unlisted NIC to the created
boot disk?
Cheers
Mark


http://www.sunbelt-software.com/ntsysadmin_list_charter.htm

RE: HELP VIRUS ON NT MACHINE?

2001-09-20 Thread Eric Brouwer

I might be confused...  Why do you need to remove the hard drive?

-Original Message-
From: Matthew Western [mailto:[EMAIL PROTECTED]]
Sent: Wednesday, September 19, 2001 10:37 PM
To: NT System Admin Issues
Subject: RE: HELP VIRUS ON NT MACHINE?

hehehe  she knows how to fix it tho..  that's what we're doing sucessfully
here.  put it in another machine clean about 2000 files off the hard drive
and put it back in... working on workstations.

-Original Message-
From: Greg Page [mailto:[EMAIL PROTECTED]]
Sent: Thursday, 20 September 2001 10:22 AM
To: NT System Admin Issues
Subject: RE: HELP VIRUS ON NT MACHINE?

You're not in IT? Are you a lurker?

Greg

-Original Message-
From: PITNEY,LDENISE (A-Sonoma,ex1) [mailto:[EMAIL PROTECTED]]
Sent: Wednesday, September 19, 2001 6:44 PM
To: NT System Admin Issues
Subject: RE: HELP VIRUS ON NT MACHINE?

Our local IT department has actually had to remove the disk from it's
current machine and mount it in another machine as a secondary -- then clean
it and return it to it's original home.

Denise

-Original Message-
From: Tiffany Belcher [mailto:[EMAIL PROTECTED]]
Sent: Wednesday, September 19, 2001 2:35 PM
To: NT System Admin Issues
Subject: HELP VIRUS ON NT MACHINE?

This thing is on a machine at work and it writes .eml files all over the
place in the folders on the hard drive. Is there a way to get rid if this
virus? What is it? Uninstalling outlook express or email would that do it?
It ran very sluggish and now is frozen up. HELP

http://www.sunbelt-software.com/ntsysadmin_list_charter.htm

http://www.sunbelt-software.com/ntsysadmin_list_charter.htm

http://www.sunbelt-software.com/ntsysadmin_list_charter.htm

http://www.sunbelt-software.com/ntsysadmin_list_charter.htm

http://www.sunbelt-software.com/ntsysadmin_list_charter.htm

RE: How to remove Nimda from NT Server without a reload

2001-09-20 Thread Søren Albeck


I've had one server infected. Other than the description below, I used
NAI's removal-tool with no problems. It can be found at
http://vil.nai.com/vil/virusSummary.asp?virus_k=99209 (may be wrapped)
under the heading Stand-alone removal tool.
The server was booted in between each step, the whole operation took a
little over 1 hour and it is so far behaving nicely.

Søren A

 I'm in the middle of an all-nighter killing this thing, I'll tell you
 what is working for me (you need to be at the console):
 Delete Admin.dll and all TFTP* files from %driveletter%\Inetpub\scripts
 Stop and disable the server service
 Reboot
 Apply IIS cumulative patch
 Reboot
 Apply hotfixes for either IE 5.01 SP1 or IE5.5 SP1 (mime header vulns)
 Reboot
 I am running NetShield, so I apply DAT 4161 and then scan and clean.
 
 Kludgy, I know, we are working on scripting this.  That is what we have
 so far.  I'll update unless someone else does before then.  Back to
 work
 
 -Original Message-
 From: Matthew Western [mailto:[EMAIL PROTECTED]]
 Sent: Wednesday, September 19, 2001 8:59 PM
 To: NT System Admin Issues
 Subject: How to remove Nimda from NT Server without a reload
 
 
 Any links on how to remove Nimda from NT without a reload?  when i run
 the
 removal tool from this list it crashes...  any idea what services it
 overwrites and runs as?  i've heard cmd.exe and mmc.exe.  we've got
 mmc.exe
 running but when i try to kill it with task manager it says access
 denied...
 ideas?
 Matthew
 
 
 http://www.sunbelt-software.com/ntsysadmin_list_charter.htm

http://www.sunbelt-software.com/ntsysadmin_list_charter.htm

RE: Sevice pack Downloads

2001-09-20 Thread Hodson, Jason

See the IEAK 6.0 for full download and installation package build

Jason

-Original Message-
From: TDI Custom Computers [mailto:[EMAIL PROTECTED]]
Sent: Wednesday, September 19, 2001 8:59 PM
To: NT System Admin Issues
Subject: Re: Sevice pack Downloads

Discovered today, that with IE 6 you can't save to disk unless you go back
to the site after you did a download and install on the same machine and it
gives you an option for a different install and an Advanced button.
Mike

- Original Message -
From: Dennis Brunner [EMAIL PROTECTED]
To: NT System Admin Issues [EMAIL PROTECTED]
Sent: Wednesday, September 19, 2001 12:43 PM
Subject: Sevice pack Downloads

 When down loading from Microsoft's site is there a way to save to disk so
I
 can patch other computers without having to go back to the net and
 redownload them? They would be a great help. thanks

 Thank you
 Dennis Brunner
 616-677-3343
 mailto:[EMAIL PROTECTED] mailto:[EMAIL PROTECTED]

 http://www.sunbelt-software.com/ntsysadmin_list_charter.htm

http://www.sunbelt-software.com/ntsysadmin_list_charter.htm

http://www.sunbelt-software.com/ntsysadmin_list_charter.htm

RE: Repost: Spam to non-existent e-mail address-PLEASE HELP

2001-09-20 Thread Banyas, Pat F. Civ

Title: RE: Repost: Spam to non-existent e-mail address-PLEASE HELP





Steve


I use Mail Essentials on my Exchange server. It did real well with all the worms and with filtering. You can add the spammers and also filter out invalid return domains and prevent mail relaying. I got on the orbs list awhile ago and with Mail Essentials finally got it so their bogus mails didn't go anywhere.

Pat Banyas



-Original Message-
From: Steve Jacobson [mailto:[EMAIL PROTECTED]]
Sent: Wednesday, September 19, 2001 9:31 PM
To: NT System Admin Issues
Subject: Repost: Spam to non-existent e-mail address-PLEASE HELP



Please help!


I administer the e-mail server (Exchange 5.5) for my small consulting
company (DJI). I am getting lots of spam mail addressed to non-existent
e-mail addresses. These addresses have never been used. Some seem to be
valid
addresses ([EMAIL PROTECTED], or [EMAIL PROTECTED]), while others seem to be made up
from some random character generator ([EMAIL PROTECTED], [EMAIL PROTECTED]).


I get about 30-50 of these messages per day. Naturally, they are bounced by
the server, and I route them to the Administrator mailbox. Some of the
bounce messages back to the sender also get bounced (mainly due to invalid
addresses).


I am now getting e-mail from someone telling me (actually they are sending
it to one of the invalid e-mail addresses) not to spam them anymore. I have
spam relaying turned off in Exchange.


Do any of you folks have this problem, and if so, what do you do about it?
I am desperate, and am considering disabling the djicom MX record in the
dns (for a week) so that (hopefully) this spam will be stopped at the
source.


This is causing me quite a problem.


Steve Jacobson
[EMAIL PROTECTED]
[EMAIL PROTECTED] (for this list)





http://www.sunbelt-software.com/ntsysadmin_list_charter.htm



http://www.sunbelt-software.com/ntsysadmin_list_charter.htm



***The information contained in this e-mail is intended for the recipient or entity to whom it is addressed.  If you have received this e-mail in error, please notify the sender immediately and delete this email from your system. E-mail messages sent to this email address  must not contain any material that may reasonably be considered offensive, disruptive, defamatory, or disparaging towards any person.  Questions please contact K. Johnson, Information Security Officer, US Naval Hospital Guantanamo Bay, 011-5399-72440, [EMAIL PROTECTED]***
http://www.sunbelt-software.com/ntsysadmin_list_charter.htm

RE: Repost: Spam to non-existent e-mail address-PLEASE HELP

2001-09-20 Thread Banyas, Pat F. Civ

Title: RE: Repost: Spam to non-existent e-mail address-PLEASE HELP





Steve


I use Mail Essentials on my Exchange server. It did real well with all the worms and with filtering. You can add the spammers and also filter out invalid return domains and prevent mail relaying. I got on the orbs list awhile ago and with Mail Essentials finally got it so their bogus mails didn't go anywhere.

Pat Banyas



-Original Message-
From: Steve Jacobson [mailto:[EMAIL PROTECTED]]
Sent: Wednesday, September 19, 2001 9:31 PM
To: NT System Admin Issues
Subject: Repost: Spam to non-existent e-mail address-PLEASE HELP



Please help!


I administer the e-mail server (Exchange 5.5) for my small consulting
company (DJI). I am getting lots of spam mail addressed to non-existent
e-mail addresses. These addresses have never been used. Some seem to be
valid
addresses ([EMAIL PROTECTED], or [EMAIL PROTECTED]), while others seem to be made up
from some random character generator ([EMAIL PROTECTED], [EMAIL PROTECTED]).


I get about 30-50 of these messages per day. Naturally, they are bounced by
the server, and I route them to the Administrator mailbox. Some of the
bounce messages back to the sender also get bounced (mainly due to invalid
addresses).


I am now getting e-mail from someone telling me (actually they are sending
it to one of the invalid e-mail addresses) not to spam them anymore. I have
spam relaying turned off in Exchange.


Do any of you folks have this problem, and if so, what do you do about it?
I am desperate, and am considering disabling the djicom MX record in the
dns (for a week) so that (hopefully) this spam will be stopped at the
source.


This is causing me quite a problem.


Steve Jacobson
[EMAIL PROTECTED]
[EMAIL PROTECTED] (for this list)





http://www.sunbelt-software.com/ntsysadmin_list_charter.htm



http://www.sunbelt-software.com/ntsysadmin_list_charter.htm



***The information contained in this e-mail is intended for the recipient or entity to whom it is addressed.  If you have received this e-mail in error, please notify the sender immediately and delete this email from your system. E-mail messages sent to this email address  must not contain any material that may reasonably be considered offensive, disruptive, defamatory, or disparaging towards any person.  Questions please contact K. Johnson, Information Security Officer, US Naval Hospital Guantanamo Bay, 011-5399-72440, [EMAIL PROTECTED]***
http://www.sunbelt-software.com/ntsysadmin_list_charter.htm

Re: Well, this is reassuring...

2001-09-20 Thread Heidi Pilewski


FYI, SANS probably did not send that message at all, read the following
excerpt from Symantec's write up of the Nimda virus:

The worm begins the mass-mailing routine by first searching for email
addresses. The worm searches for email addresses in .htm and .html files
on the local system. The worm also uses MAPI to iterate through messages
in the Inbox of email clients. Any MAPI supporting email clients may be
affected including Microsoft Outlook and Outlook Express. The worm uses
these email address for the To: and the From: addresses. Thus, the From:
addresses will not be from the infected user. 

Heidi Pilewski
Windows Systems Administrator
Software Engineering Institute
[EMAIL PROTECTED]
 
Greg Page wrote:
 
 It's not a rumor, it's what happened. That this e-mail got to one of their
 people and propagated is disturbing. Antigen caught it at my GW and didn't
 send it anywhere. What's there excuse?
 
 Greg
 
 -Original Message-
 From: Dean Cunningham [mailto:[EMAIL PROTECTED]]
 Sent: Wednesday, September 19, 2001 9:19 PM
 To: NT System Admin Issues
 Subject: RE: Well, this is reassuring...
 
 Careful before spreading such a rumor, the detecters may well be
 oversensiitve at this point. McAffee did the same to me *because* a guy had
 posted to the mailing lust and email containing  a portion of the
 javascript. I would suggest considering the source of teh messaging being
 blocked, that it is like they the message was benign and they too had a
 portion of code in it that set the alarm bells off.
 
 regards
 Dean
 
 -Original Message-
 From: Greg Page [mailto:[EMAIL PROTECTED]]
 Sent: Thursday, 20 September 2001 12:49 p.m.
 To: NT System Admin Issues
 Subject: Well, this is reassuring...
 
 Antigen for Exchange found readme.exe infected with JScript/Nimda.A.Worm
 (CA(InoculateIT)) worm. The message is currently Purged.  The message, SANS
 NewsBites Vol. 3 Num. 38, was sent from The SANS Institute  and was
 discovered in IMC Queues\Inbound located at ORGANIZATION/SITE-1/ALEXAPP001.
 
 Greg
 
 http://www.sunbelt-software.com/ntsysadmin_list_charter.htm
 
 ***
 This e-mail is  not an  official  statement of  the
 Waikato  Regional  Council unless otherwise stated.
 Visit our website http://www.ew.govt.nz
 ***
 
 http://www.sunbelt-software.com/ntsysadmin_list_charter.htm
 
 http://www.sunbelt-software.com/ntsysadmin_list_charter.htm

http://www.sunbelt-software.com/ntsysadmin_list_charter.htm

win2000 dialup problem

2001-09-20 Thread Gareth Campling


Hi

Just recently keep getting this error on a dialup connection a ISP
(56K modem)


Goes thru handshaking , and verfying User details

then drops line with

  1. The specified port is not connected.

is this a ISP related problem which i think it is or a local problem ?


-- 
Best regards,
 Gareth, MCP mailto:[EMAIL PROTECTED]

[ Stay safe ppl, be kind to your neighbours. ]


http://www.sunbelt-software.com/ntsysadmin_list_charter.htm

RE: Discontinuation of BackOffice Server 2000

2001-09-20 Thread Robert Sanderson


Here's the link to what Microsoft has to say - I'm interpreting it as
BackOffice Server 2000 is going away completely and you just buy the
components separately.

http://www.microsoft.com/backofficeserver/howtobuy/pricing/changes.asp

Cheers

Robert


-Original Message-
From: Bruce Raymond [mailto:[EMAIL PROTECTED]]
Sent: Tuesday, September 18, 2001 8:14 AM
To: NT System Admin Issues
Subject: RE: Discontinuation of BackOffice Server 2000


Sorry, further reading shows that no trusts are supported, 50 clients max.
on the network and all SBS components installed on the same server.  Aaagh.

Thanks

-Original Message-
From: Bruce Raymond [mailto:[EMAIL PROTECTED]]
Sent: Tuesday, September 18, 2001 9:10 AM
To: NT System Admin Issues
Subject: RE: Discontinuation of BackOffice Server 2000


I thought SBS 4.5 did not support trusts and was limited to roughly 25
clients.  But it appears that SBS 2000 can support more clients than that
provided you purchase the CAL packs, etc.  But does it also support trusts?
Is the Exchange 2000 included with SBS 2000 a full version or does it have
some limitation?

Thanks,

Bruce

-Original Message-
From: Kent Neff [mailto:[EMAIL PROTECTED]]
Sent: Tuesday, September 18, 2001 8:47 AM
To: NT System Admin Issues
Subject: RE: Discontinuation of BackOffice Server 2000


Check out these MS links: www.microsoft.com/sbserver
  www.microsoft.com/backofficeserver/default.asp

The content has changed a bit since the last time I visited there.  I was
considering getting BO 2000 but when I saw that I went to SBS 2000.

HTH,

Kent


From: Jang Man [EMAIL PROTECTED]
Reply-To: NT System Admin Issues
[EMAIL PROTECTED]
To: NT System Admin Issues [EMAIL PROTECTED]
Subject: RE: Discontinuation of BackOffice Server 2000
Date: Tue, 18 Sep 2001 15:18:16 +0200

Is that true? I've got BackOffice 2000 on my system, upgraded from NT
few
moths ago. Does that mean we are not supported any more, despite BO is just

a bunch of standalone servers, BO snap in and with cheaper license.

Jang Man
Ixtlan Team

-Original Message-
From: Kent Neff [mailto:[EMAIL PROTECTED]]
Posted At: Tuesday, September 18, 2001 3:11 PM
Posted To: NTSysAdmin
Conversation: Discontinuation of BackOffice Server 2000
Subject: Re: Discontinuation of BackOffice Server 2000

Yes, this is correct.  It is being replaced by Small Business Server
2000 which contains: Exchange 2000, SQL 2000, ISA and Terminal
Services.  I recently purchased the Upgrade and am implementing it on
my network at work.

MS has already discontinued support for Backoffice 2000 so if you do
get it you are on your own.

HTH,

Kent Neff

MCP, MCSE, A+

 From: Chris Bodnar [EMAIL PROTECTED]
 Reply-To: NT System Admin Issues
[EMAIL PROTECTED]
 To: NT System Admin Issues [EMAIL PROTECTED]
 Subject: Discontinuation of BackOffice Server 2000
 Date: Tue, 18 Sep 2001 08:42:41 -0400
 
 I just received this from CDW, can anyone confirm that this is true:
 
 
 
 If you own:
 
BACKOFFICE SERVER 4.5
You must purchase BackOffice 2000 Server by 9/28/2001.
 
BACKOFFICE 2000 SERVER
Includes: Exchange 2000 Server, SQL Server 2000, Windows 2000
 Server, Host
Integration Server 2000, Internet Security and Acceleration Server
2000,
 and
Systems Management Server 2.0. AFTER 9/28/2001 these products may
 only be
purchased as standalone components due to the discontinuation of
 BackOffice
Server 2000.
 
 
 
 
 Chris Bodnar
 The Lehigh Group
 610-966-9702 X:134
 
 
 
 http://www.sunbelt-software.com/ntsysadmin_list_charter.htm
 


_
Get your FREE download of MSN Explorer at
http://explorer.msn.com/intl.asp


http://www.sunbelt-software.com/ntsysadmin_list_charter.htm

http://www.sunbelt-software.com/ntsysadmin_list_charter.htm



_
Get your FREE download of MSN Explorer at http://explorer.msn.com/intl.asp


http://www.sunbelt-software.com/ntsysadmin_list_charter.htm

http://www.sunbelt-software.com/ntsysadmin_list_charter.htm

http://www.sunbelt-software.com/ntsysadmin_list_charter.htm


http://www.sunbelt-software.com/ntsysadmin_list_charter.htm

RE: Cannot install win2k Sp2 No print spooler

2001-09-20 Thread Miller Bonnie L.




Stuff 
to try--
Use 
ntbackup to make an ERD first, then:

Start, 
run, cmd
chkdsk 
c: /f
exit
restart server

If 
still not working after chkdsk, try system file checker:

Start, 
Run, cmd
sfc 
/scannow

Have 
your Win2k adv sp1 server cd ready to replace any files found missing. 
Restart after it'sdone. You'll need to reapply hotfixes when 
done. If you don't have sp1 on the cd, you'll need to reapply that too, 
first (or you could just wing it and go right to sp2 :)

Good 
luck--please tell us if one of these fixes it for you. I don't think I've 
ever seen a win2k system with the spooler service completely 
missing.
-BM

  -Original Message-From: Andrew Frost 
  [mailto:[EMAIL PROTECTED]]Sent: Wednesday, September 19, 2001 
  10:14 PMTo: NT System Admin IssuesSubject: Cannot 
  install win2k Sp2 No print spooler
  COMPAQDL580WIn2K Adv SP1. 
  
  
  Try to install SP2 
  and get a message cannot install SP2 as the print spooler is not running. The 
  spooler does not appear in the service list and net start spooler 
  returns service name is invalid. Tried to reinstall Sp1 and get the same 
  message. Any ideas as have not found any clues in TechNet. In fact I did not 
  know you could have a install without that service installed. 
  TIA
  
  Andrew 
  Frosthttp://www.sunbelt-software.com/ntsysadmin_list_charter.htm
http://www.sunbelt-software.com/ntsysadmin_list_charter.htm

Crying Eagle is a source of Nimda?

2001-09-20 Thread Larry Nail


This is probably a hoax, but I heard on the radio this morning that the
Crying Eagle email  web pages were a source of our friend nimda and it
peaked my curiosity.  Anyone else see or hear anything about this?

I have that thing all over the place  they're as clean as a new whistle
according to NAV  Trend.  The e-mail I received it from is long gone so I
can't check that one out.

Cheers,
Larry


**
Lawrence D. Nail
Microsoft Certified Systems Engineer
NT Infrasture and Strategy
SC Design Systems
Texas Instruments Incorporated


http://www.sunbelt-software.com/ntsysadmin_list_charter.htm

RE: Win2KPro Security updates

2001-09-20 Thread Matt Wehnes


Goto http://corporate.windowsupdate.microsoft.com/en/default.asp

Download the appropriate hotfixes.
Use Qchain.exe from MS to chain the installs together. Add them to your
login script or have your users execute a batch file on the network.

Matt Wehnes 
System Administrator
Morton Machining  MFG


-Original Message-
From: Stefan Jafs [mailto:[EMAIL PROTECTED]]
Sent: Wednesday, September 19, 2001 3:06 PM
To: NT System Admin Issues
Subject: Win2KPro Security updates


I have 40 Win2kPro workstations. How do I update all my systems without
having to update single systems with windows update?

Stefan

http://www.sunbelt-software.com/ntsysadmin_list_charter.htm

http://www.sunbelt-software.com/ntsysadmin_list_charter.htm

RE: Security Bulletin Confusion Part 2

2001-09-20 Thread John Hornbuckle


The problem is that on one server (the most important server, no less)
it keeps telling me it can't find the XML file even though the XML file
is clearly present.



John Hornbuckle
Network Manager
Taylor County School District
318 North Clark Street
Perry, FL 32347 

-Original Message-
From: Greg Page [mailto:[EMAIL PROTECTED]] 
Sent: Wednesday, September 19, 2001 9:02 PM
To: NT System Admin Issues
Subject: RE: Security Bulletin Confusion Part 2


How about creating a dir names hotfix on your computer with all the
files associated with hfnetchk and running HFNETCHK on you workstation,
then copying all that to the server and running c:\dirname\hfnetchk -x
mssecure.xml

It's always works for me.

Greg


-Original Message-
From: John Hornbuckle [mailto:[EMAIL PROTECTED]] 
Sent: Wednesday, September 19, 2001 5:01 PM
To: NT System Admin Issues
Subject: RE: Security Bulletin Confusion Part 2


Yeah, but HFNETCHK doesn't work on my server. Never has, and I've tried
every suggestion everyone has made to make it work.



-Original Message-
From: Jim Busick [mailto:[EMAIL PROTECTED]] 
Sent: Wednesday, September 19, 2001 4:56 PM
To: NT System Admin Issues
Subject: RE: Security Bulletin Confusion Part 2


I still think that nothing beats HFNETCHK as it compares your registry
settings with the current MS hotfix database. Nothing like realtime.

http://support.microsoft.com/support/kb/articles/Q303/2/15.ASP

 -Original Message-
 From: John Hornbuckle [mailto:[EMAIL PROTECTED]]
 Sent: Wednesday, September 19, 2001 1:37 PM
 To: NT System Admin Issues
 Subject: Security Bulletin Confusion Part 2
 
 
 Grrr...
 
 Now I'm looking at MS01-041, which is title Malformed RPC Request Can

 Cause Service Failure and MS01-048, which is titled Malformed 
 Request to RPC Endpoint Mapper can Cause RPC Service to Fail.
 
 Are these two separate issues, or are they related?
 
 
 John Hornbuckle
 MIS Department
 Taylor County School District
 318 North Clark Street
 Perry, FL 32347
 
 
 http://www.sunbelt-software.com/ntsysadmin_list_charter.htm
 

http://www.sunbelt-software.com/ntsysadmin_list_charter.htm



http://www.sunbelt-software.com/ntsysadmin_list_charter.htm

http://www.sunbelt-software.com/ntsysadmin_list_charter.htm



http://www.sunbelt-software.com/ntsysadmin_list_charter.htm

RE: Terminal Services/Citrix bug on a 933/1000Mhz multiproc system...?

2001-09-20 Thread Benjamin Zachary


Well I have a couple of dual 1 gig compaq servers running TS App mode
and TS Admin mode and never seen/heard of this issue. Of course, I don't
use citrix, so maybe that's it :).

In reviewing the article its from 06/04/01 which is now 3 months old, Im
sure there would be more info/patches if there is a real issue. 

-Original Message-
From: Vance Krier [mailto:[EMAIL PROTECTED]] 
Sent: Thursday, September 20, 2001 5:10 AM
To: NT System Admin Issues
Subject: Terminal Services/Citrix bug on a 933/1000Mhz multiproc
system...?


Hello all,

I ran across the following article that startled me somewhat. 

http://www.nwfusion.com/news/2001/0604infra.html

It talks about a bug that crashes MSTS and Citrix when run on a
multiprocessor 933 or 1000Mhz system.  I've searched, but I can't find
any other information on this.

Can anyone confirm/deny or point me in the direction of an article from
MS or Citrix or other?

Thanks!
Vance

http://www.sunbelt-software.com/ntsysadmin_list_charter.htm




http://www.sunbelt-software.com/ntsysadmin_list_charter.htm

RE: Cannot install WIN2k SP2 - No print spooler

2001-09-20 Thread Benjamin Zachary

In win2k its called Print Spooler. Uhhh if you don't have that theres
other issues to be concerned about. On the other side, I have seen weird
occurences of this with the new nimda virus

-Original Message-
From: Andrew Frost [mailto:[EMAIL PROTECTED]] 
Sent: Thursday, September 20, 2001 4:52 AM
To: NT System Admin Issues
Subject: Cannot install WIN2k SP2 - No print spooler

COMPAQ DL580 WIN2K Adv Server SP1. 

Try to install SP2 and get a message cannot install as the print spooler
is not running. 
The spooler does not appear in the service list and net start spooler
returns service name is invalid. 
Tried to reinstall SP1 and get the same message. 

Any ideas appreciated. In fact I did not know you could have a install
without that service installed. TIA

Andrew Frost

http://www.sunbelt-software.com/ntsysadmin_list_charter.htm

http://www.sunbelt-software.com/ntsysadmin_list_charter.htm

RE: Crying Eagle is a source of Nimda?

2001-09-20 Thread Schreiber, Scott


That email was going around last week.  Nimda began Tuesday (some say very
late Monday).

I got the mail and viewed it and my machine was not infected by Nimda.

fwiw
Scott

-Original Message-
From: Larry Nail [mailto:[EMAIL PROTECTED]]
Sent: Thursday, September 20, 2001 9:19 AM
To: NT System Admin Issues
Subject: Crying Eagle is a source of Nimda?


This is probably a hoax, but I heard on the radio this morning that the
Crying Eagle email  web pages were a source of our friend 
nimda and it
peaked my curiosity.  Anyone else see or hear anything about this?

I have that thing all over the place  they're as clean as a 
new whistle
according to NAV  Trend.  The e-mail I received it from is 
long gone so I
can't check that one out.

Cheers,
Larry


**
Lawrence D. Nail
Microsoft Certified Systems Engineer
NT Infrasture and Strategy
SC Design Systems
Texas Instruments Incorporated


http://www.sunbelt-software.com/ntsysadmin_list_charter.htm


http://www.sunbelt-software.com/ntsysadmin_list_charter.htm

RE: IIS disabled but proxy enabled? how to...

2001-09-20 Thread Ade_Aiyenigba

Well; you can harden your servers based on the NSA standards. If they use it
and they are happyycheck out their site.www.nsa.org cannot
remember the exact URL when I do you will get it.

-Original Message-
From: Rocky Stefano [mailto:[EMAIL PROTECTED]]
Sent: 19 September 2001 07:34
To: NT System Admin Issues
Subject: RE: IIS disabled but proxy enabled? how to...

He has a point. Even a devout MS bigot has got to be pissed at the number of
patches they have had to install over the last year. Not to mention how many
applications don't work as advertised. If he can't do MS you're going to
send him to a linux package?

-Original Message-
From: Kelly Borndale [mailto:[EMAIL PROTECTED]]
Sent: September 19, 2001 1:20 AM
To: NT System Admin Issues
Subject: Re: IIS disabled but proxy enabled? how to...

You may want to watch your attitude first off -this is an NT sys admin list,
we all have jobs because we support MS products.

There are plenty of free proxy servers and web servers.  Check out
http://www.debian.org/ or any Linux site, as well.

-K
- Original Message -
From: Matthew Western [EMAIL PROTECTED]
To: NT System Admin Issues [EMAIL PROTECTED]
Sent: Wednesday, September 19, 2001 12:23 AM
Subject: IIS disabled but proxy enabled? how to...

 Hi People,
 We like the rest of the world are getting annoyed at microsnot.  How do i
 disable all web server IIS junk and keep the MX proxy enabled?  if i
disable
 the IIS in services it kills proxy too...  i've already broken one proxy
 trying to do this.
 regards
 Matthew

 http://www.sunbelt-software.com/ntsysadmin_list_charter.htm

http://www.sunbelt-software.com/ntsysadmin_list_charter.htm

http://www.sunbelt-software.com/ntsysadmin_list_charter.htm

http://www.sunbelt-software.com/ntsysadmin_list_charter.htm

RE: How to remove Nimda from NT Server without a reload

2001-09-20 Thread Miley, Dan

remember guest is admin on infected machines.  anyone can upload tools and
remote control apps to your machine, while guest is active.

Dan

-Original Message-
From: Sren Albeck [mailto:[EMAIL PROTECTED]]
Sent: Thursday, September 20, 2001 7:34 AM
To: NT System Admin Issues
Subject: RE: How to remove Nimda from NT Server without a reload

I've had one server infected. Other than the description below, I used
NAI's removal-tool with no problems. It can be found at
http://vil.nai.com/vil/virusSummary.asp?virus_k=99209 (may be wrapped)
under the heading Stand-alone removal tool.
The server was booted in between each step, the whole operation took a
little over 1 hour and it is so far behaving nicely.

Søren A

 I'm in the middle of an all-nighter killing this thing, I'll tell you
 what is working for me (you need to be at the console):
 Delete Admin.dll and all TFTP* files from %driveletter%\Inetpub\scripts
 Stop and disable the server service
 Reboot
 Apply IIS cumulative patch
 Reboot
 Apply hotfixes for either IE 5.01 SP1 or IE5.5 SP1 (mime header vulns)
 Reboot
 I am running NetShield, so I apply DAT 4161 and then scan and clean.

 Kludgy, I know, we are working on scripting this.  That is what we have
 so far.  I'll update unless someone else does before then.  Back to
 work

 -Original Message-
 From: Matthew Western [mailto:[EMAIL PROTECTED]]
 Sent: Wednesday, September 19, 2001 8:59 PM
 To: NT System Admin Issues
 Subject: How to remove Nimda from NT Server without a reload

 Any links on how to remove Nimda from NT without a reload?  when i run
 the
 removal tool from this list it crashes...  any idea what services it
 overwrites and runs as?  i've heard cmd.exe and mmc.exe.  we've got
 mmc.exe
 running but when i try to kill it with task manager it says access
 denied...
 ideas?
 Matthew

 http://www.sunbelt-software.com/ntsysadmin_list_charter.htm

http://www.sunbelt-software.com/ntsysadmin_list_charter.htm
This e-mail may be privileged and/or confidential, and the sender does not
waive any related rights and obligations. Any distribution, use or copying
of this e-mail or the information it contains by other than an intended
recipient is unauthorized. If you received this e-mail in error, please
advise me (by return e-mail or otherwise) immediately. 

http://www.sunbelt-software.com/ntsysadmin_list_charter.htm

RE: Security Bulletin Confusion Part 2

2001-09-20 Thread John Hornbuckle


Yepper. But it doesn't work.


John

-Original Message-
From: Greg Page [mailto:[EMAIL PROTECTED]] 
Sent: Thursday, September 20, 2001 9:58 AM
To: NT System Admin Issues
Subject: RE: Security Bulletin Confusion Part 2


Do you use the -x mssecure.xml switch?

Greg


-Original Message-
From: John Hornbuckle [mailto:[EMAIL PROTECTED]] 
Sent: Thursday, September 20, 2001 9:33 AM
To: NT System Admin Issues
Subject: RE: Security Bulletin Confusion Part 2


The problem is that on one server (the most important server, no less)
it keeps telling me it can't find the XML file even though the XML file
is clearly present.



John Hornbuckle
Network Manager
Taylor County School District
318 North Clark Street
Perry, FL 32347 

-Original Message-
From: Greg Page [mailto:[EMAIL PROTECTED]] 
Sent: Wednesday, September 19, 2001 9:02 PM
To: NT System Admin Issues
Subject: RE: Security Bulletin Confusion Part 2


How about creating a dir names hotfix on your computer with all the
files associated with hfnetchk and running HFNETCHK on you workstation,
then copying all that to the server and running c:\dirname\hfnetchk -x
mssecure.xml

It's always works for me.

Greg


-Original Message-
From: John Hornbuckle [mailto:[EMAIL PROTECTED]] 
Sent: Wednesday, September 19, 2001 5:01 PM
To: NT System Admin Issues
Subject: RE: Security Bulletin Confusion Part 2


Yeah, but HFNETCHK doesn't work on my server. Never has, and I've tried
every suggestion everyone has made to make it work.



-Original Message-
From: Jim Busick [mailto:[EMAIL PROTECTED]] 
Sent: Wednesday, September 19, 2001 4:56 PM
To: NT System Admin Issues
Subject: RE: Security Bulletin Confusion Part 2


I still think that nothing beats HFNETCHK as it compares your registry
settings with the current MS hotfix database. Nothing like realtime.

http://support.microsoft.com/support/kb/articles/Q303/2/15.ASP

 -Original Message-
 From: John Hornbuckle [mailto:[EMAIL PROTECTED]]
 Sent: Wednesday, September 19, 2001 1:37 PM
 To: NT System Admin Issues
 Subject: Security Bulletin Confusion Part 2
 
 
 Grrr...
 
 Now I'm looking at MS01-041, which is title Malformed RPC Request Can

 Cause Service Failure and MS01-048, which is titled Malformed 
 Request to RPC Endpoint Mapper can Cause RPC Service to Fail.
 
 Are these two separate issues, or are they related?
 
 
 John Hornbuckle
 MIS Department
 Taylor County School District
 318 North Clark Street
 Perry, FL 32347
 
 
 http://www.sunbelt-software.com/ntsysadmin_list_charter.htm
 

http://www.sunbelt-software.com/ntsysadmin_list_charter.htm



http://www.sunbelt-software.com/ntsysadmin_list_charter.htm

http://www.sunbelt-software.com/ntsysadmin_list_charter.htm



http://www.sunbelt-software.com/ntsysadmin_list_charter.htm

http://www.sunbelt-software.com/ntsysadmin_list_charter.htm



http://www.sunbelt-software.com/ntsysadmin_list_charter.htm

Nimda Scanner from eEye Digital Security (Beta)

2001-09-20 Thread webmaster


http://www.eeye.com/html/Research/Tools/nimda.html

http://www.sunbelt-software.com/ntsysadmin_list_charter.htm

RE: HELP VIRUS ON NT MACHINE?

2001-09-20 Thread Rocky Stefano



For those of you that were unfortunately hit with the latest worm. There is
usually no recourse but to wipe the machine clean and reload your software.
Trend Antivirus has released a cleaner for the virus. Here is the info.

Trend Micro has developed a cleaning tool that will allow you to clean
systems infected by PE_NIMDA.A. The cleaning tool and instructions, manual
cleaning instructions, and the latest pattern file can be found on our FTP
site at:

ftp://us-web\[EMAIL PROTECTED]

Password: tmcustomer

Directory: Premium Customer\tool

Files:

Cleaning tool: FIX_NIMDA.zip

Cleaning tool description and instructions: Readme_nimda.txt

Manual cleaning documentation: How to Clean.txt

Latest pattern file: ptn_942.zip



-Original Message-
From: Tiffany Belcher [mailto:[EMAIL PROTECTED]]
Sent: September 19, 2001 5:35 PM
To: NT System Admin Issues
Subject: HELP VIRUS ON NT MACHINE?



This thing is on a machine at work and it writes .eml files all over the
place in the folders on the hard drive. Is there a way to get rid if this
virus? What is it? Uninstalling outlook express or email would that do it?
It ran very sluggish and now is frozen up. HELP

http://www.sunbelt-software.com/ntsysadmin_list_charter.htm


http://www.sunbelt-software.com/ntsysadmin_list_charter.htm

RE: HELP VIRUS ON NT MACHINE?

2001-09-20 Thread Murray Freeman


HEY, not true, not true. We got hit on 3 servers and were able to cleanse
manually and never even turned off the servers, nor did it impact our
regular production.

Murray

-Original Message-
From: Rocky Stefano [mailto:[EMAIL PROTECTED]]
Sent: Thursday, September 20, 2001 9:21 AM
To: NT System Admin Issues
Subject: RE: HELP VIRUS ON NT MACHINE?



For those of you that were unfortunately hit with the latest worm. There is
usually no recourse but to wipe the machine clean and reload your software.
Trend Antivirus has released a cleaner for the virus. Here is the info.

Trend Micro has developed a cleaning tool that will allow you to clean
systems infected by PE_NIMDA.A. The cleaning tool and instructions, manual
cleaning instructions, and the latest pattern file can be found on our FTP
site at:

ftp://us-web\[EMAIL PROTECTED]

Password: tmcustomer

Directory: Premium Customer\tool

Files:

Cleaning tool: FIX_NIMDA.zip

Cleaning tool description and instructions: Readme_nimda.txt

Manual cleaning documentation: How to Clean.txt

Latest pattern file: ptn_942.zip



-Original Message-
From: Tiffany Belcher [mailto:[EMAIL PROTECTED]]
Sent: September 19, 2001 5:35 PM
To: NT System Admin Issues
Subject: HELP VIRUS ON NT MACHINE?



This thing is on a machine at work and it writes .eml files all over the
place in the folders on the hard drive. Is there a way to get rid if this
virus? What is it? Uninstalling outlook express or email would that do it?
It ran very sluggish and now is frozen up. HELP

http://www.sunbelt-software.com/ntsysadmin_list_charter.htm


http://www.sunbelt-software.com/ntsysadmin_list_charter.htm

http://www.sunbelt-software.com/ntsysadmin_list_charter.htm

RE: HELP VIRUS ON NT MACHINE?

2001-09-20 Thread Wendell Cotton

Hmmm.  We have not had to take such drastic action(s) here at all - 'course,
let's see what the new day brings.  :-)

Wendell

-Original Message-
From: Rocky Stefano [mailto:[EMAIL PROTECTED]]
Sent: Thursday, September 20, 2001 7:21 AM
To: NT System Admin Issues
Subject: RE: HELP VIRUS ON NT MACHINE?

For those of you that were unfortunately hit with the latest worm. There is
usually no recourse but to wipe the machine clean and reload your software.
Trend Antivirus has released a cleaner for the virus. Here is the info.

Trend Micro has developed a cleaning tool that will allow you to clean
systems infected by PE_NIMDA.A. The cleaning tool and instructions, manual
cleaning instructions, and the latest pattern file can be found on our FTP
site at:

ftp://us-web\[EMAIL PROTECTED]

Password: tmcustomer

Directory: Premium Customer\tool

Files:

Cleaning tool: FIX_NIMDA.zip

Cleaning tool description and instructions: Readme_nimda.txt

Manual cleaning documentation: How to Clean.txt

Latest pattern file: ptn_942.zip

-Original Message-
From: Tiffany Belcher [mailto:[EMAIL PROTECTED]]
Sent: September 19, 2001 5:35 PM
To: NT System Admin Issues
Subject: HELP VIRUS ON NT MACHINE?

This thing is on a machine at work and it writes .eml files all over the
place in the folders on the hard drive. Is there a way to get rid if this
virus? What is it? Uninstalling outlook express or email would that do it?
It ran very sluggish and now is frozen up. HELP

http://www.sunbelt-software.com/ntsysadmin_list_charter.htm

http://www.sunbelt-software.com/ntsysadmin_list_charter.htm

http://www.sunbelt-software.com/ntsysadmin_list_charter.htm

RE: File Creation Dates

2001-09-20 Thread Len Hammond


Just curious...  Is there a utility available to adjust the creation date of
a file.  One of our SPC applications looks for a file with a specific date
on it before it runs in the full mode instead of Evaluation mode.
However, the contents of the file needs to change but when I change it, it
runs the way I want it to but reverts back to an eval copy.  So...  I need
to edit the file and then change it's date back to the original date.

Len Hammond
Network Administrator
Pontiac Coil, Inc.
[EMAIL PROTECTED]


-Original Message-
From: Kenneth Taira [mailto:[EMAIL PROTECTED]]
Sent: Friday, September 14, 2001 5:55 PM
To: NT System Admin Issues
Subject: Re: File Creation Dates


Err...you can make monster zip files as they save the creation date...then 
unzip them
on the target.

At 04:03 PM 9/14/2001 -0500, you wrote:
Hello All,

I have the need to transfer a large amount of data from one server to 
another. The source
system is NT3.51 and the destination is Win2K.  I am attempting to 
transfer these files
across the network. My problem is that I need to maintain the file 
creation date on each
file. I might also add that these files where created over several years 
of usage.
Does anyone know of a utility or a switch that would allow for this?
http://www.sunbelt-software.com/ntsysadmin_list_charter.htm



http://www.sunbelt-software.com/ntsysadmin_list_charter.htm

http://www.sunbelt-software.com/ntsysadmin_list_charter.htm

IIS Slow Down Due to Nimda?

2001-09-20 Thread Jerry Gamblin

Title: IIS Slow Down Due to Nimda?





Any one seen there IIS Server slow down due to the bug?
Is there anyway to stop the request(cmd.exe) from even being made to you box?


Here's is what my logs look like. Sunday was a little slow but on an average day we get around ~700 unique visitors. 


Date Hits Successful Hits
09/16/2001 : 372 : 222 
09/17/2001 : 3,454 : 1,026 
09/18/2001 : 6,224 : 1,046 
09/19/2001 : 5,401 : 745 
09/20/2001 : 2,193 : 86 


Total Hits : 17644
Average Hits : 3528


That's around 14,000 hits alone from this virus.
I don't know what its doing to the server, but is there any way to make it stop?



Jerry Gamblin
Technology Specialist


Linn State Technical College
One Technology Drive
Linn, MO 65051
[EMAIL PROTECTED]
www.linnstate.edu
573-897-5240



-Original Message-
From: Murray Freeman [mailto:[EMAIL PROTECTED]]
Sent: Thursday, September 20, 2001 9:24 AM
To: NT System Admin Issues
Subject: RE: HELP VIRUS ON NT MACHINE?



HEY, not true, not true. We got hit on 3 servers and were able to cleanse
manually and never even turned off the servers, nor did it impact our
regular production.


Murray


-Original Message-
From: Rocky Stefano [mailto:[EMAIL PROTECTED]]
Sent: Thursday, September 20, 2001 9:21 AM
To: NT System Admin Issues
Subject: RE: HELP VIRUS ON NT MACHINE?




For those of you that were unfortunately hit with the latest worm. There is
usually no recourse but to wipe the machine clean and reload your software.
Trend Antivirus has released a cleaner for the virus. Here is the info.


Trend Micro has developed a cleaning tool that will allow you to clean
systems infected by PE_NIMDA.A. The cleaning tool and instructions, manual
cleaning instructions, and the latest pattern file can be found on our FTP
site at:


ftp://us-web\[EMAIL PROTECTED]


Password: tmcustomer


Directory: Premium Customer\tool


Files:


Cleaning tool: FIX_NIMDA.zip


Cleaning tool description and instructions: Readme_nimda.txt


Manual cleaning documentation: How to Clean.txt


Latest pattern file: ptn_942.zip




-Original Message-
From: Tiffany Belcher [mailto:[EMAIL PROTECTED]]
Sent: September 19, 2001 5:35 PM
To: NT System Admin Issues
Subject: HELP VIRUS ON NT MACHINE?




This thing is on a machine at work and it writes .eml files all over the
place in the folders on the hard drive. Is there a way to get rid if this
virus? What is it? Uninstalling outlook express or email would that do it?
It ran very sluggish and now is frozen up. HELP


http://www.sunbelt-software.com/ntsysadmin_list_charter.htm



http://www.sunbelt-software.com/ntsysadmin_list_charter.htm


http://www.sunbelt-software.com/ntsysadmin_list_charter.htm



http://www.sunbelt-software.com/ntsysadmin_list_charter.htm

RE: IIS Slow Down Due to Nimda?

2001-09-20 Thread Les Bessant

Title: IIS Slow Down Due to Nimda?

I'm
blocking at the firewall.[1] Still has an impact on our bandwidth, but at least
the server is free to get on with things...

[1]
Raptor[2]
[2]
aka Symantec Enterprise Firewall[3]
[3]
Boring name :(

Les Bessant mailto:[EMAIL PROTECTED]IT Manager,
Sanderson Townend GilbertActing in a personal capacityhttp://www.tiggercam.co.uk
- New, improved and with more bounce!

-Original Message-From: Jerry Gamblin
[mailto:[EMAIL PROTECTED]]Sent: Thursday, September 20,
2001 3:36 PMTo: NT System Admin IssuesSubject: IIS Slow
Down Due to Nimda?
Any one seen there IIS Server slow down due to the bug?
Is there anyway to stop the request(cmd.exe) from even being
made to you box?
Here's is what my logs look like. Sunday was a little slow but
on an average day we get around ~700 unique visitors.
Date
Hits Successful Hits 09/16/2001 :
372 : 222 09/17/2001 : 3,454 : 1,026
09/18/2001 : 6,224 : 1,046 09/19/2001 : 5,401 : 745 09/20/2001 : 2,193 :
86
Total Hits : 17644 Average Hits :
3528
That's around 14,000 hits alone from this virus.
I don't know what its doing to the server, but is there any
way to make it stop?
Jerry Gamblin Technology
Specialist
Linn State Technical College One
Technology Drive Linn, MO 65051 [EMAIL PROTECTED] www.linnstate.edu 573-897-5240
-Original Message- From:
Murray Freeman [mailto:[EMAIL PROTECTED]]
Sent: Thursday, September 20, 2001 9:24 AM To: NT System Admin Issues Subject: RE: HELP
VIRUS ON NT MACHINE?
HEY, not true, not true. We got hit on 3 servers and were able
to cleanse manually and never even turned off the
servers, nor did it impact our regular
production.
Murray
-Original Message- From: Rocky
Stefano [mailto:[EMAIL PROTECTED]]
Sent: Thursday, September 20, 2001 9:21 AM To: NT System Admin Issues Subject: RE: HELP
VIRUS ON NT MACHINE?
For those of you that were unfortunately hit with the latest
worm. There is usually no recourse but to wipe the
machine clean and reload your software. Trend
Antivirus has released a cleaner for the virus. Here is the info.
Trend Micro has developed a cleaning tool that will allow you
to clean systems infected by PE_NIMDA.A. The cleaning
tool and instructions, manual cleaning instructions,
and the latest pattern file can be found on our FTP site at:
ftp://us-web\[EMAIL PROTECTED]

Password: tmcustomer
Directory: Premium Customer\tool
Files:
Cleaning tool: FIX_NIMDA.zip
Cleaning tool description and instructions:
Readme_nimda.txt
Manual cleaning documentation: How to Clean.txt
Latest pattern file: ptn_942.zip
-Original Message- From:
Tiffany Belcher [mailto:[EMAIL PROTECTED]]
Sent: September 19, 2001 5:35 PM To:
NT System Admin Issues Subject: HELP VIRUS ON NT
MACHINE?
This thing is on a machine at work and it writes .eml files
all over the place in the folders on the hard drive.
Is there a way to get rid if this virus? What is it?
Uninstalling outlook express or email would that do it? It ran very sluggish and now is frozen up. HELP
http://www.sunbelt-software.com/ntsysadmin_list_charter.htm

http://www.sunbelt-software.com/ntsysadmin_list_charter.htm

http://www.sunbelt-software.com/ntsysadmin_list_charter.htm
http://www.sunbelt-software.com/ntsysadmin_list_charter.htm_This
message has been checked for all known viruses by Star Internetdelivered
through the MessageLabs Virus Scanning Service. For furtherinformation
visit http://www.star.net.uk/stats.asp or alternatively callStar Internet
for details on the Virus Scanning Service.
http://www.sunbelt-software.com/ntsysadmin_list_charter.htm

The information in this communication and any attachments is confidential and may be legally privileged. It is intended solely for the addressee. If you are not the intended recipient any use, review, dissemination, distribution or copying of this information is strictly prohibited. If you have received this communication in error please notify us immediately on 0191 261 2681 and delete the original message and any copies of it.

Any opinions, conclusions or other information in this message that do not relate to the official business of Sanderson Townend & Gilbert are neither given nor endorsed by the firm.

_
This message has been checked for all known viruses by Star Internet
delivered through the MessageLabs Virus Scanning Service. For further
information visit http://www.star.net.uk/stats.asp or alternatively call
Star Internet for details on the Virus Scanning Service.

http://www.sunbelt-software.com/ntsysadmin_list_charter.htm

RE: IIS Slow Down Due to Nimda?

2001-09-20 Thread John Cesta - Lists

Title: IIS Slow Down Due to Nimda?

Any one seen there IIS Server slow down due to the bug?
Is there anyway to stop the request(cmd.exe) from even being
made to you box?
Here's is what my logs look like. Sunday was a little slow but
on an average day we get around ~700 unique visitors.

Of
course IIS is going to slow down due to many requests. Not much of a way to make
it stop unless you know where the source is, call them and ask. Otherwise we are
all in the same boat.

John
Cesta

-Original Message-From: Jerry Gamblin
[mailto:[EMAIL PROTECTED]]Sent: Thursday, September 20,
2001 10:36 AMTo: NT System Admin IssuesSubject: IIS Slow
Down Due to Nimda?
Any one seen there IIS Server slow down due to the bug?
Is there anyway to stop the request(cmd.exe) from even being
made to you box?
Here's is what my logs look like. Sunday was a little slow but
on an average day we get around ~700 unique visitors.
Date
Hits Successful Hits 09/16/2001 :
372 : 222 09/17/2001 : 3,454 : 1,026
09/18/2001 : 6,224 : 1,046 09/19/2001 : 5,401 : 745 09/20/2001 : 2,193 :
86
Total Hits : 17644 Average Hits :
3528
That's around 14,000 hits alone from this virus.
I don't know what its doing to the server, but is there any
way to make it stop?
Jerry Gamblin Technology
Specialist
Linn State Technical College One
Technology Drive Linn, MO 65051 [EMAIL PROTECTED] www.linnstate.edu 573-897-5240
-Original Message- From:
Murray Freeman [mailto:[EMAIL PROTECTED]]
Sent: Thursday, September 20, 2001 9:24 AM To: NT System Admin Issues Subject: RE: HELP
VIRUS ON NT MACHINE?
HEY, not true, not true. We got hit on 3 servers and were able
to cleanse manually and never even turned off the
servers, nor did it impact our regular
production.
Murray
-Original Message- From: Rocky
Stefano [mailto:[EMAIL PROTECTED]]
Sent: Thursday, September 20, 2001 9:21 AM To: NT System Admin Issues Subject: RE: HELP
VIRUS ON NT MACHINE?
For those of you that were unfortunately hit with the latest
worm. There is usually no recourse but to wipe the
machine clean and reload your software. Trend
Antivirus has released a cleaner for the virus. Here is the info.
Trend Micro has developed a cleaning tool that will allow you
to clean systems infected by PE_NIMDA.A. The cleaning
tool and instructions, manual cleaning instructions,
and the latest pattern file can be found on our FTP site at:
ftp://us-web\[EMAIL PROTECTED]

http://www.sunbelt-software.com/ntsysadmin_list_charter.htm

http://www.sunbelt-software.com/ntsysadmin_list_charter.htm
http://www.sunbelt-software.com/ntsysadmin_list_charter.htm
http://www.sunbelt-software.com/ntsysadmin_list_charter.htm

RE: IIS Slow Down Due to Nimda?

2001-09-20 Thread Martin Blackstone

Title: Message

Slow
down? Not that we could tell.
But my
traffic doubled the first day it was out.

However it did tell that what I built can scale!

-Original Message-From: John Cesta -
Lists [mailto:[EMAIL PROTECTED]] Sent: Thursday, September 20, 2001
8:03 AMTo: NT System Admin IssuesSubject: RE: IIS Slow
Down Due to Nimda?

Of
course IIS is going to slow down due to many requests. Not much of a way to
make it stop unless you know where the source is, call them and ask. Otherwise
we are all in the same boat.

John
Cesta

-Original Message- From:
Murray Freeman [mailto:[EMAIL PROTECTED]]
Sent: Thursday, September 20, 2001 9:24 AM To: NT System Admin Issues Subject: RE: HELP
VIRUS ON NT MACHINE?
HEY, not true, not true. We got hit on 3 servers and were
able to cleanse manually and never even turned off
the servers, nor did it impact our regular
production.
Murray
-Original Message- From:
Rocky Stefano [mailto:[EMAIL PROTECTED]]
Sent: Thursday, September 20, 2001 9:21 AM To: NT System Admin Issues Subject: RE: HELP
VIRUS ON NT MACHINE?
For those of you that were unfortunately hit with the latest
worm. There is usually no recourse but to wipe the
machine clean and reload your software. Trend
Antivirus has released a cleaner for the virus. Here is the info.

Trend Micro has developed a cleaning tool that will allow
you to clean systems infected by PE_NIMDA.A. The
cleaning tool and instructions, manual cleaning
instructions, and the latest pattern file can be found on our FTP
site at:
ftp://us-web\[EMAIL PROTECTED]

Password: tmcustomer
Directory: Premium Customer\tool
Files:
Cleaning tool: FIX_NIMDA.zip
Cleaning tool description and instructions:
Readme_nimda.txt
Manual cleaning documentation: How to Clean.txt
Latest pattern file: ptn_942.zip
-Original Message- From:
Tiffany Belcher [mailto:[EMAIL PROTECTED]]
Sent: September 19, 2001 5:35 PM To: NT System Admin Issues Subject: HELP
VIRUS ON NT MACHINE?
This thing is on a machine at work and it writes .eml files
all over the place in the folders on the hard drive.
Is there a way to get rid if this virus? What is it?
Uninstalling outlook express or email would that do it? It ran very sluggish and now is frozen up. HELP
http://www.sunbelt-software.com/ntsysadmin_list_charter.htm

http://www.sunbelt-software.com/ntsysadmin_list_charter.htm

http://www.sunbelt-software.com/ntsysadmin_list_charter.htm
http://www.sunbelt-software.com/ntsysadmin_list_charter.htmhttp://www.sunbelt-software.com/ntsysadmin_list_charter.htm
http://www.sunbelt-software.com/ntsysadmin_list_charter.htm

RE: IIS Slow Down Due to Nimda?

2001-09-20 Thread John Hanks

Title: IIS Slow Down Due to Nimda?

On my
boxes where I have host headers configured and no website is "default", that is,
every website demands that a host header be in the request, none of these
requests are making it into the logs. I have no idea what that means wrt IIS,
maybe it is still processing them and not logging or maybe it just ignores them
once a matching host header isn't found.

jbh

-Original Message-From: John Cesta - Lists
[mailto:[EMAIL PROTECTED]]Sent: Thursday, September 20, 2001 9:03
AMTo: NT System Admin IssuesSubject: RE: IIS Slow Down
Due to Nimda?

Of
course IIS is going to slow down due to many requests. Not much of a way to
make it stop unless you know where the source is, call them and ask. Otherwise
we are all in the same boat.

John
Cesta

Password: tmcustomer
Directory: Premium Customer\tool
Files:
Cleaning tool: FIX_NIMDA.zip
Cleaning tool description and instructions:
Readme_nimda.txt
Manual cleaning documentation: How to Clean.txt
Latest pattern file: ptn_942.zip
-Original Message- From:
Tiffany Belcher [mailto:[EMAIL PROTECTED]]
Sent: September 19, 2001 5:35 PM To: NT System Admin Issues Subject: HELP
VIRUS ON NT MACHINE?
This thing is on a machine at work and it writes .eml files
all over the place in the folders on the hard drive.
Is there a way to get rid if this virus? What is it?
Uninstalling outlook express or email would that do it? It ran very sluggish and now is frozen up. HELP
http://www.sunbelt-software.com/ntsysadmin_list_charter.htm

http://www.sunbelt-software.com/ntsysadmin_list_charter.htm

Free Nimda scanner from eEye

2001-09-20 Thread Tom . Kustner


http://www.eeye.com/html/Research/Tools/nimda.html

Tom Kustner
PC/LAN Engineer
Wells Fargo Retirement Plan Services

Any opinions are strictly my own and not necessarily those of Wells Fargo. 

http://www.sunbelt-software.com/ntsysadmin_list_charter.htm

NIMDA FIX

2001-09-20 Thread David Coffey


Good morning,
Is anyone having good luck running the Fix_Nimda.A. Fix?  A little
skeptical about running it as of yet.
Thanks,
Dave

http://www.sunbelt-software.com/ntsysadmin_list_charter.htm

RE: win2000 dialup problem

2001-09-20 Thread Miley, Dan


I had a problem with a new compaq (cheapie) winmodem on my home machine.  I
also got the message remote computer not responding or something...

compaq swapped the modem 3 times, reloaded the new drivers 4 x, (and told me
how to turn the volume down 5 times!) before they sent me a line filter to
go in line with the phone line.  You might find one at rat shack.

fixed the prob.

I'd try another modem/pc combination on the same line/ISP to see if it's in
the workstation, or the connection.

Dan

-Original Message-
From: Gareth Campling [mailto:[EMAIL PROTECTED]]
Sent: Thursday, September 20, 2001 8:40 AM
To: NT System Admin Issues
Subject: win2000 dialup problem


Hi

Just recently keep getting this error on a dialup connection a ISP
(56K modem)


Goes thru handshaking , and verfying User details

then drops line with

  1. The specified port is not connected.

is this a ISP related problem which i think it is or a local problem ?


-- 
Best regards,
 Gareth, MCP mailto:[EMAIL PROTECTED]

[ Stay safe ppl, be kind to your neighbours. ]


http://www.sunbelt-software.com/ntsysadmin_list_charter.htm
This e-mail may be privileged and/or confidential, and the sender does not
waive any related rights and obligations. Any distribution, use or copying
of this e-mail or the information it contains by other than an intended
recipient is unauthorized. If you received this e-mail in error, please
advise me (by return e-mail or otherwise) immediately. 

http://www.sunbelt-software.com/ntsysadmin_list_charter.htm

RE: IIS Slow Down Due to Nimda?

2001-09-20 Thread John Cesta - Lists

Title: IIS Slow Down Due to Nimda?

On my boxes where I have host headers configured and no website is
"default", that is, every website demands that a host header be in the
request, none of these requests are making it into the logs. I have no idea
what that means wrt IIS, maybe it is still processing them and not logging or
maybe it just ignores them once a matching host header isn't found.

You can bet, it is still banging on you
though.

John
Cesta

jbh

-Original Message-From: John Cesta - Lists
[mailto:[EMAIL PROTECTED]]Sent: Thursday, September 20, 2001 9:03
AMTo: NT System Admin IssuesSubject: RE: IIS Slow Down
Due to Nimda?

Any one seen there IIS Server slow down due to the
bug? Is there anyway to stop the request(cmd.exe)
from even being made to you box?
Here's is what my logs look like. Sunday was a little slow
but on an average day we get around ~700 unique visitors.

Of
course IIS is going to slow down due to many requests. Not much of a way to
make it stop unless you know where the source is, call them and ask.
Otherwise we are all in the same boat.

John Cesta

-Original Message- From:
Murray Freeman [mailto:[EMAIL PROTECTED]]
Sent: Thursday, September 20, 2001 9:24 AM
To: NT System Admin Issues Subject: RE: HELP VIRUS ON NT MACHINE?
HEY, not true, not true. We got hit on 3 servers and were
able to cleanse manually and never even turned off
the servers, nor did it impact our regular
production.
Murray
-Original Message- From:
Rocky Stefano [mailto:[EMAIL PROTECTED]]
Sent: Thursday, September 20, 2001 9:21 AM
To: NT System Admin Issues Subject: RE: HELP VIRUS ON NT MACHINE?
For those of you that were unfortunately hit with the
latest worm. There is usually no recourse but to
wipe the machine clean and reload your software. Trend Antivirus has released a cleaner for the virus. Here is the
info.
Trend Micro has developed a cleaning tool that will allow
you to clean systems infected by PE_NIMDA.A. The
cleaning tool and instructions, manual cleaning
instructions, and the latest pattern file can be found on our FTP
site at:
ftp://us-web\[EMAIL PROTECTED]

Password: tmcustomer
Directory: Premium Customer\tool
Files:
Cleaning tool: FIX_NIMDA.zip
Cleaning tool description and instructions:
Readme_nimda.txt
Manual cleaning documentation: How to Clean.txt

Latest pattern file: ptn_942.zip
-Original Message- From:
Tiffany Belcher [mailto:[EMAIL PROTECTED]]
Sent: September 19, 2001 5:35 PM To: NT System Admin Issues Subject: HELP
VIRUS ON NT MACHINE?
This thing is on a machine at work and it writes .eml
files all over the place in the folders on the
hard drive. Is there a way to get rid if this virus? What is it? Uninstalling outlook express or email would that
do it? It ran very sluggish and now is frozen up.
HELP
http://www.sunbelt-software.com/ntsysadmin_list_charter.htm

http://www.sunbelt-software.com/ntsysadmin_list_charter.htm

http://www.sunbelt-software.com/ntsysadmin_list_charter.htm
http://www.sunbelt-software.com/ntsysadmin_list_charter.htmhttp://www.sunbelt-software.com/ntsysadmin_list_charter.htmhttp://www.sunbelt-software.com/ntsysadmin_list_charter.htm
http://www.sunbelt-software.com/ntsysadmin_list_charter.htm

RE: Problem Connecting to Terminal Server

2001-09-20 Thread Mal Sasalu




Could this be a license issue?. We had similar problems on our citrix.
 -Original Message-
From:   Bill Higgins [mailto:[EMAIL PROTECTED]] 
Sent:   Thursday, September 20, 2001 8:52 AM
To: NT System Admin Issues
Subject:Problem Connecting to Terminal Server

Server1: W2K Advanced Server, SP2, running Terminal Server in remote
administration mode
Server2: W2K Advanced Server, SP1, running Terminal Server in remote
administration mode

Client1: Win98
Client2: W2K Advanced Server, SP1
Client3: W2K Pro

Client2 and Client3 can connect to Server1 and Server2 with no problems.
Client1 can connect to Server2 with no problem
Client1 cannot connect to Server1, get the terminal server has ended the
connection dialog box before a login box.

I have checked Technet and it is not:
http://support.microsoft.com/support/kb/articles/Q237/7/92.ASP?LN=EN-USSD=g
nFR=0qry=%26quot%3Bthe%20terminal%20server%20has%20ended%20the%20connectio
n%26quot%3Brnk=11src=DHCS_MSPSS_gn_SRCHSPR=MSALL (running in admin mode,
not app mode)

Any suggestions?

Bill Higgins
Lead NT Systems Engineer
(415) 402-3444 office
(415) 720-7053 cell
[EMAIL PROTECTED]



http://www.sunbelt-software.com/ntsysadmin_list_charter.htm

http://www.sunbelt-software.com/ntsysadmin_list_charter.htm

RE: Problem Connecting to Terminal Server

2001-09-20 Thread Bill Higgins


shouldn't be a licenese issue... the Terminal Server is running in
Administrative Mode (no licensing required) not Application Sharing Mode...

If it was Licensing, I would expect that no clients could connect to
Server1:

-Original Message-
From: Mal Sasalu [mailto:[EMAIL PROTECTED]]
Sent: Thursday, September 20, 2001 08:26
To: NT System Admin Issues
Subject: RE: Problem Connecting to Terminal Server




Could this be a license issue?. We had similar problems on our citrix.
 -Original Message-
From:   Bill Higgins [mailto:[EMAIL PROTECTED]] 
Sent:   Thursday, September 20, 2001 8:52 AM
To: NT System Admin Issues
Subject:Problem Connecting to Terminal Server

Server1: W2K Advanced Server, SP2, running Terminal Server in remote
administration mode
Server2: W2K Advanced Server, SP1, running Terminal Server in remote
administration mode

Client1: Win98
Client2: W2K Advanced Server, SP1
Client3: W2K Pro

Client2 and Client3 can connect to Server1 and Server2 with no problems.
Client1 can connect to Server2 with no problem
Client1 cannot connect to Server1, get the terminal server has ended the
connection dialog box before a login box.

I have checked Technet and it is not:
http://support.microsoft.com/support/kb/articles/Q237/7/92.ASP?LN=EN-USSD=g
nFR=0qry=%26quot%3Bthe%20terminal%20server%20has%20ended%20the%20connectio
n%26quot%3Brnk=11src=DHCS_MSPSS_gn_SRCHSPR=MSALL (running in admin mode,
not app mode)

Any suggestions?

Bill Higgins
Lead NT Systems Engineer
(415) 402-3444 office
(415) 720-7053 cell
[EMAIL PROTECTED]



http://www.sunbelt-software.com/ntsysadmin_list_charter.htm

http://www.sunbelt-software.com/ntsysadmin_list_charter.htm

http://www.sunbelt-software.com/ntsysadmin_list_charter.htm

Microsoft Proxy Server Version 2 on NT 4.0 - SP 6a

2001-09-20 Thread Nelson Aguillon


Help, please

As a result of the latest virus, I downloaded and installed one of the
recommended patches for Internet Explorer.
Anyway, after the installation of that patch...

I can't open the following services within Microsoft Internet Service
Manager

Socks Proxy
Web Proxy
WWW

In the event viewer, I see an event ID 7023 with the error message COULD
NOT FIND SPECIFIED MODULE

I have looked in my TechNet CD and on the Internet, but I can't find
anything that addresses this issue.


Can anyone help me with this?

Thanks in advance,

Nelson Aguillón
626.937.6693


http://www.sunbelt-software.com/ntsysadmin_list_charter.htm

RE: NIMDA FIX

2001-09-20 Thread Don Collier (Intermap Denver)


I guess that it works fine.  I didn't think that I had any infected machines
but ran it anyway and came up with no infected computers.  No virus warning
yet.

 
_
Don Collier
Network Administrator
Intermap Technologies Inc.
Voice:  303-708-0955 x-207
Fax:303-708-0952
[EMAIL PROTECTED] 
www.intermaptechnologies.com

-Original Message-
From: David Coffey [mailto:[EMAIL PROTECTED]]
Sent: Thursday, September 20, 2001 9:22 AM
To: NT System Admin Issues
Subject: NIMDA FIX


Good morning,
Is anyone having good luck running the Fix_Nimda.A. Fix?  A little
skeptical about running it as of yet.
Thanks,
Dave

http://www.sunbelt-software.com/ntsysadmin_list_charter.htm

http://www.sunbelt-software.com/ntsysadmin_list_charter.htm

Microsoft Has Nimda

2001-09-20 Thread Phillips, Glen


If anyone is looking for more infected sites, here's some including Dell and
Microsoft...

http://www.theregister.co.uk/content/56/21772.html


*
If you receive this e-mail in error, please contact +44 20 7280 5500. 
The information contained in this e-mail and in the attachments if 
any, is confidential.  Unauthorised use, disclosure, printing, 
forwarding or copying is strictly prohibited. 
*


http://www.sunbelt-software.com/ntsysadmin_list_charter.htm

RE: Free Nimda scanner from eEye

2001-09-20 Thread Blackburn Barrett


Just a good note about this...

We scanned our network, and while we had all of our servers patched, it did
point out a few of our assembly line machines that had vulnerability that we
hadn't thought about.

Very excellent software. Kudos to all those at eEye who were involved.

Barrett Blackburn
___

The two most common things in the universe are hydrogen and stupidity.
___


-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]]
Sent: Thursday, September 20, 2001 10:05 AM
To: NT System Admin Issues
Subject: Free Nimda scanner from eEye


http://www.eeye.com/html/Research/Tools/nimda.html

Tom Kustner
PC/LAN Engineer
Wells Fargo Retirement Plan Services

Any opinions are strictly my own and not necessarily those of Wells Fargo. 

http://www.sunbelt-software.com/ntsysadmin_list_charter.htm

http://www.sunbelt-software.com/ntsysadmin_list_charter.htm

1 2 3 >

1 - 100 of 207 matches

Mail list logo