Was ist nur mit dem IIS 4. 0 los ?*verzweifel*

[Carmen]

Hallo Leute...

Ich verstehe den Webserver nicht mehr.
Seit wir neue Asp-Seiten zu unsere Standardwebseite zugefügt haben, funktioniert der Webserver zwar noch, beendet aber immer nach ein paar Stunden den Dienst.
In der Management Konsole steht dann hinter ´Standardwebsite 'beendet', man nuß danach die Standardwebseite markieren und wieder auf 'Starten' umstellen, so daß die Webseite wieder läuft.
Die ASP-Seiten laufen danach wieder einwandfrei.
Wieso beendet er mir andauernd den Dienst?
Kann keinen Fehler entdecken.

Danke für Eure Mühe im voraus

Carmen

[Christian]

Hallo Carmen,
ASP Seiten sind wahrscheinlich Zufall,Das sind eher die Hacker-Attacken der letzten Woche. Hier ein Beitrag aus einer engl. NG:

*** "CODE RED" ATTACK
This attack replaces the home page of all of your web sites with the
phrases..."You have been infected by www.worm.com, Hacked by Chinese". It
does not delete your web files, but installs a small script that does the
deed. At that point, this is resident on your server and must be removed.

Updated Fix:
Review the article at www.cert.org/incident_notes/IN-2001-08.html. This is a
complete discussion on how to eradicate the Code Red worm. You can also read
more about it at eEye Security. Their article can be retrieved at
www.eeye.com/html/Research/Advisories/AL20010717.html.

*** "IIS SHUT DOWN" ATTACK
This attack causes your web, ftp, W3SVC and other web-related services to
restart or just shut down entirely. There are many different symptoms
depending on which variety of the attack you received.

This is not a resident bug you need to find and delete or worry about in a
virus way. The fact that your services are doing this over and over is
apparently because you are receiving the attack over and over. Install the
patches as noted below, and your problem should disappear permanently.

Fix:
1. Install the latest SP for your OS (NT4 is SP6a, 2000 is SP2, see below).
2. Install security patch MS01-026 (see below)
3. Install security patch MS01-033 (see below)
4. Reboot the server.

There are some servers that have not been fixed after these steps were
taken. I would say the success rate has been 90% though, so give it a try.
If your server continues to shut down IIS after this, I would post your
situation to the newsgroup for help.

You can read more about this issue at eEye Security as well. Their article
can be retrieved at www.eeye.com/html/Research/Advisories/AD20010618.html.

*** DOWNLOADS

Note: When installing these, you must install the SP2 and then the security
patches IN ORDER. Otherwise, it will not work. My recommendation is that
instead of doing just what you NEED to do (below), you install the
appropriate SP below, and then review all security patches since then and
install all appropriate ones on your server.

I am not sure what SP6a covers for NT4, but I do know that SP2 for 2000
covers all security patches through MS01-023. Therefore, if you apply SP2
and all applicable patches numbered MS01-024 and greater, you are fully up
to date.

Windows NT4 SP6a:
www.microsoft.com/ntserver/nts/downloads/recommended/SP6/allSP6.asp

Windows 2000 SP2:
www.microsoft.com/windows2000/downloads/servicepacks/sp2/

Security Patch MS01-026 for IIS4:
www.microsoft.com/Downloads/Release.asp?ReleaseID=29787

Security Patch MS01-026 for IIS5:
www.microsoft.com/Downloads/Release.asp?ReleaseID=29764

Security Patch MS01-033 for NT4:
www.microsoft.com/Downloads/Release.asp?ReleaseID=30833

Security Patch MS01-033 for 2000:
www.microsoft.com/Downloads/Release.asp?ReleaseID=30800

Gruss
Christian

Hallo Leute...

Ich verstehe den Webserver nicht mehr.
Seit wir neue Asp-Seiten zu unsere Standardwebseite zugefügt haben, funktioniert der Webserver zwar noch, beendet aber immer nach ein paar Stunden den Dienst.
In der Management Konsole steht dann hinter ´Standardwebsite 'beendet', man nuß danach die Standardwebseite markieren und wieder auf 'Starten' umstellen, so daß die Webseite wieder läuft.
Die ASP-Seiten laufen danach wieder einwandfrei.
Wieso beendet er mir andauernd den Dienst?
Kann keinen Fehler entdecken.

Danke für Eure Mühe im voraus

Carmen