inetinfo.exe running like mad ----- :(

[muosman]

I have a small biz server 2000 and all's been working fine until a few days ago when I noticed the harddrive work running like mad and the network was slow. When I go to task manager inetinfo.exe just keeps going up and up, stores.exe is the same and the harddrive is going mad. The system is running like a shit. I put the server into safe mode and all is well so I guess it's not the harddrive. The server haS only mcfee TVD and that's it. Can anyone help ?



\\muos o(-_-)o

 

[Shift838]

have you tried taking the site you are running in IIS and run it in its own memory address space to isolate the process?

 

[muosman]

can you tell me how?

\\muos o(-_-)o

 

[karmic]

Sounds like you are running exchange on your server... if inetinfo and stores.exe are running high cpu rates, you may want to check to see if exchange relay is turned off... someone may be relaying alot of mail thru your server...

here is a good writeup on relaying...

http://www.petri.co.il/preventing_exchange_from_relaying.htm

~ K.I.S.S - Don't make it any more complex than it has to be ~

 

[muosman]

it's running like this offline? but it was online, should I still look into open relaying, thanks for the help



\\muos o(-_-)o

 

[karmic]

if you're worried about a virus, a good place to start is with mcafee stinger, it's a great little tool designed to seek and destroy certain virii. Its here:

http://vil.nai.com/vil/stinger/

Stores.exe is part of exchange, inetinfo.exe is part of IIS, the two have to work hand in hand on a mail server.

If your server has been flooded, you will definitely see these results.

I've never used the tvd version of mcaffee but it's just as good as anything else (until you try to change servers that is...) If you're worried about a virus, check your event viewer for processes that are running and do a google search for the filenames you do not recognize.

Good luck



~ K.I.S.S - Don't make it any more complex than it has to be ~

 

[muosman]

karmic dude thanks for all the help, so sould I got for the open relay close down? I'm away to run the string

Thanks again

\\muos o(-_-)o