help strange goings on

[kiwix]

Hi i am a new bie here and don't know if this is right forum but here goes.

I have a strange security issue. I run xp pro(all latest patches) Norton Internet security, NAV

I am connected permanently to the net via adsl connection and sometimes when i check my task manager situation i see dllhost.exe being run by something called IWAM_R user.

subsequent searches on google reveal nothing for this. Has anyone come across this before, what does it mean and what if anything do i do about it.

Also i recently had an attack details below
: Attempted Intrusion "URL_Directory_Traversal" from your machine against

http://www.starletsdatabase.com(64.226.86.183)

was detected and blocked
Intruder: localhost(2484)
Risk Level: High
Protocol: TCP
Attacked IP:

http://www.starletsdatabase.com(64.226.86.183)

Attacked Port: http(80)

now i have never been near this starletsdatabase.com let alone havea clue what URL_Directory_traversla is, can anyone help.

 

[sleipnir214]

Are you running IIS on the machine? Users named IWAM_* and IUSR_* are usually associated with at web server.

Want the best answers? Ask the best questions:

http://www.catb.org/~esr/faqs/smart-questions.html

TANSTAAFL!!

 

[kiwix]

yes i am running iis, but again another strange one there. although iis is running and my web site is able to be accessed via the web, i no longer have any localhost. whenever i try to view a local web site on my machine i get no website configured at this address. Which is not the case as they all used to work like a charm.

 

[sleipnir214]

On what addresses is your web server configured to serve sites? Is 127.0.0.1 one of them?

Want the best answers? Ask the best questions:

http://www.catb.org/~esr/faqs/smart-questions.html

TANSTAAFL!!

 

[kiwix]

yes i think so, i am not sure really after i had connected to the web the site that was set as default on my iis started dispaying when i typed in my static ip

but that number does ring a bell and i have seen it

sorry dont really understand all this stuff

 

[sleipnir214]

"localhost" always refers to the machine you are on ("local host". Get it?). By definition under TCP/IP, "localhost" has an address of 127.0.0.1.

This is on all machines. If your web server has a web site set up on localhost and you point a browser to

http://localhost

from a workstation, you aren't pointing to the web server -- you are pointing to your local machine.

So the next question is: Are you acutally working on the web server machine when you point a browser to

http://localhost?

Want the best answers? Ask the best questions:

http://www.catb.org/~esr/faqs/smart-questions.html

TANSTAAFL!!

 

[kiwix]

yeh of course. before all this stuff started hapopening i have been working for months using iis as my localhost to test web sites on my machine before they go live on another server.

i understand the localhost part. But now i cannot access any web sites on local host at all. if i put in

http://localhost/blah

all i get is 'no web site configured at this address' when i know there is .

to do with the security report and URL_direction thingy from above the web site that was associated with the Security message is not mine, not on my machine, i have never even visited it.

as for the IWAM_R user & dllhost.exe i have no idea. I thought perhaps it was the blaster virus or a worm. but every virus scan i run using latest definaitions comes up negative. I have even run the win xp patch again and the specific fix blast tool from symantec.

 

[sleipnir214]

On the dllhost.exe problem. Have you heard of the Welchia worm?

http://vil.nai.com/vil/content/v_100559.htm

On the websites problem. You're running IE and IIE on the same machine, and you can't use

http://localhost...

to get to the website. Right?


Want the best answers? Ask the best questions:

http://www.catb.org/~esr/faqs/smart-questions.html

TANSTAAFL!!

 

[kiwix]

IE i assume is Internet explorer
IIE i assume you meant iis and answer to that is yes

 

[oharab]

For the dllhost thing: Get ad-aware from lavasoftusa.com it will find and remove it for you (and probably a load of other stuff too)

hth

Ben

----------------------------------------------
Ben O'Hara

http://www.RobotParade.co.uk

"Where are all the stupid people from...
...And how'd they get so dumb?"
NoFX-The Decline
----------------------------------------------