Prev: IIS 7 Event id's 5172 and 2297 - IIS website goes down
Next: Webhits and UNC Paths
From: Macchianera on 22 Mar 2010 14:19
Hi at all, I'm new of this NG :-)
I have a problem wich i can't find solution today: i have a windows xp pro
based pc with IIS 5. On this pc there is an archive software that has a web
interface for query and other functions. Last week it's got some problem due
to a virus, but after an update and a full scan i have cleaned the system.
Now there is a strange problem: after log into windows, the IIS 5 stops
after about 2 minutes, and into eventvwr i got the information message: "The
World Wide Web Publishing service was successfully sent a stop control". I
don't know why, because:
- The "temp" is empty
- I have reinstalled SP3
- The antivirus (Kars****) is ok and updated, and didn't found any virus
- I haven't any suspicious process (i use "process explorer" for this)
- The system seems to be cleaned and in the event viewer i haven't any
error/warnings.
- I have tryed to restart it from IIS console but after 50 seconds it's
going in "stop" status again
- I have tried to set "restart the service" option of WWW but with no
success, and the same with IISadmin service (in the 3rd case it runs
iisreset)


At the end, i don't know _who_ is sending the stop command to IIS...

any ideas?
Many thanks!!!
bye



From: Andrew Morton on 23 Mar 2010 04:54
Macchianera wrote:
> Hi at all, I'm new of this NG :-)
> I have a problem wich i can't find solution today: i have a windows
> xp pro based pc with IIS 5. On this pc there is an archive software
> that has a web interface for query and other functions. Last week
> it's got some problem due to a virus, but after an update and a full
> scan i have cleaned the system.

Ideally, you should format the disk and reinstall everything from your
backup before the virus infection.

If that isn't possible, you will have to do a much more thorough job of
checking it. I suggest using all of

Disconnect the computer from the Internet
Trojan Remover
Malwarebytes Anti-Malware
Hijack This!
Rootkit Revealer
Running your anti-virus program in safe mode
Using a different anti-virus program temporarily

--
Andrew


 | 
Pages: 1
Prev: IIS 7 Event id's 5172 and 2297 - IIS website goes down
Next: Webhits and UNC Paths