Windows Forum

Ask something
Discussion Locked

IIS 5.0 keeps shutting down

0 helpful
9 replies

by iphicles 1 view

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
I have a web server on a w2k machine sp2. I repartioned using pqmagic 5.0. Now, all of a sudden, my IIS admin service stops running after 20 minutes or so. then, as a result, all my other web services stop. the event ID is 7031. does anyone know why this is happening? i've reapplied sp2, and i still get the error. i've set it up so that the service restarts automatically, but this is only a temp solution. any help would be appreciated.

9 replies

by kurt g

Hey there,

Well, I'm guessing that what you're seeing isn't due to the repartition. Take a look at the other posts. Looks like we may be victims of a virus? I have several WinNT 4.0 server running IIS 4.0 and they are experiencing the SAME problems. I have restarted them manually like 4 times now and they keep shutting down. However, I'm not seeing ANYTHING out of the ordinary in the event log or the IIS log.

I hope someone figures this one out!!

by jsarinana

My IIS keeps shuting down also, it sharted yesterday. Every 20 min. or so. Could this be a virus ?

by ds9

Hi Guys,

I'm in the same situation, and have found the bad guy.!!!

I'm in the process of cleaning up (seven) 7 NT 4.0 Servers running IIS 4.0 and all web site shut down about every 5 to 10 Minutes, and must be re-started.

Yesterday we ran Norton's Virus check on all of them and the results were the same. A total of 12 infected files, most in InetPub directory. It is a virus called "Backdoor.Sadmind.dr" and appears to EAT all Default.xxx files, which of course are essential in IIS. Norton says it CAN NOT be repaired, and the only course is to remove (delete) infected files, remove IIS and reload and start all over again, which we have started to do today.

I know this is not what you wanted to hear, but if I were you, I would do an immediate virus scan and see what you get.!!

Lots of Luck...
George

by ds9

Also, even if you don't get a list of infected files, I would check the InetPub/wwwroot directory and see if all of the default.xxx files have disappeared. (as they did on one of our machines.

Cheers.

This discussion is closed to new replies.