Windows Forum

Ask something
Discussion Locked

IIS4 keeps shutting down.

0 helpful
6 replies

by mark 2 views

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
About a week ago, IIS4 seems to keep shutting itself down. Web Publishing Services, FTP Publishing Services, and iisadmin. Initially I thought a hacker, but it ocurrs randomly and consistantly for about a week now. I setup a monitor that checks it every 2 minutes, and if it goes down, it automatically issues a restart. This has dampened my problem, but it shouldn't stay like that. I can't seem to find anything on the Internet that explains it exactly. Some are similar, but I get no error messages, nothing in the event log. I only have 64MB RAM on a P120, but it has been running like this for several years. Anyone have any ideas? Know of any good free sniffers that can tell me what traffic is causing this problem?

6 replies

by pxttocyob

My guess is that someone is exploiting the vulnerabilities of the software by buffer overruns. This is a serious weakness after someone finds out about it, and it looks like someone has. If you only have web and ftp, I would look into a more secure server OS.

by mark

Does this mean someone keeps hitting my server over and over again? Wouldn't they get tired of doing this? Would a firewall stop it? Security patch or something? Why aren't my other servers experiencing the same thing?

by mackem

There is a good application called Lockdown 2000, which will stop most hackers from interfering with your system. It disconnects any unauthorised attacks. You should be able to find a download on cnet
Hope this helps

by mark

At this point I don't think it is a hacker, but I'm about ready to try anything. It started at about 10 times a day, but now it is about every 5 minutes. I'm still looking. Thanks for the input.

by mark

Never did figure out what was causing this, but I did get a solution by installing SecureIIS, a software package from eeyes that keeps hackers out of IIS.

This discussion is closed to new replies.