How do I identify app causing error? 1

[camp62]

I am currently experiencing a sporatic shutdown of our web services in IIS and in the event log I get the following message.

Transaction Server Error
Category: Context Wrapper
Description: An object call caused an exception.
(IID: {51372AEF-CAE7-11CF-BE81-00AA00A2FA25}) (Method: 3) (Microsoft Transaction Server Internals Information: File: i:\viper\src\runtime\mtxex\activity.cpp, Line: 889) (Exception: C00000FD) (Address: 0x680e2da7)
asp + 0x32DA7
asp + 0x231E1
asp!TerminateExtension + 0x7B06
asp + 0x325C6
mtxex!MTSCreateActivity + 0x1F3C
mtxex!MTSCreateActivity + 0xF3E

Unfortunetly, I am not very familiar with NT or the IIS services. Just enough to be dangerous. At the moment the only option is to manually restart the services that have shut down. Any help would be greatly appreciated. (-:

 

[MrShagadelic]

Sounds like you are infected with the Code Red Worm. One of the symptoms is the IIS service stops on it's own. Check your IIS logs and if you have anything that looks like this then you are definitely infected:

172.27.228.113, -, 7/19/01, 14:51:42, W3SVC1, JJJNT, 157.57.53.227, 150, 470, 766, 401, 5, GET, /default.ida, NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u9090%u8190%u00c3%u0003%u8b00%u531b%u53ff%u0078%u0000%u00=a,

What you need to do is:
1. Upgrade to Service Pack 6a
2. Install this patch

http://www.microsoft.com/technet/security/bulletin/MS01-039.asp

3. Reboot

However Microsoft is recommending a total rebuild of the server.

Hope this helps.

MrShagadelic

 

[camp62]

MrShagadelic,

We've been having this problem off and on for about 5 months. So I don't believe it is related to the Red Code Virus. I did however check the IIS logs as you suggested and did not see the message you indicated. The items in the logs looked as expected. We have installed the patch.

thanks for the help though.
camp62