services not starting -- Firedaemon found

[sm43]

Hi,
Does anyone know about this Firedaemon program? Since yesterday, our system's

http://WWW Publishing,

FTP Publishing & a few other services have been down And We are unable to start them from either the Services Control Panel or Internet Services Manager (From IIS Manager-we get the error "service did not respond to the start control in a timely fashion" , from Services Control Panel we get the message "Could not start xxx service on Local Computer. Error 14: Not enough storage space is available to complete this operation.&quot. The errors do not help, there is over 4 Gig of space on both computers and 512 Mb RAM. We found 2 FireDaemon Services in the Services Control Panel - TCP and TNT , and upon probing the system, found the FireDaemon.exe application in our C:\WINNT\System32 folder. We have Windows 2000 Server, but the same problem is showing on my laptop workstation, which is running windows 2000 Prof. We had just installed the new Service Pack 3 for SQL Server 2000 on both the server and my laptop (before we were running SP2 w/ all the Security Updates) and that's when the problem appeared to have emerged. So, we went ahead and uninstalled SQL Server from the machines, and now we've Disabled the FireDaemon Services, removed the FireDaemon program, removed & reinstalled Internet Information Services from the Windows 2000 CD but the Services don't seem to work. We've even gone ahead and Repaired the Installation of Windows, but it seems to have made no difference. The Norton AntiVirus Scan w/ 12/12/02 definitions hasn't detected anything. Has anyone else gotten this problem. What do the 2 messages from IIS Services (from Services Control Panel & Internet Services Manager) mean?

Any help will be appreciated.

Saad

 

[chiph]

The services control manager gives starting services 60 seconds or so to become active. If they don't respond in that time period you get the error message you're seeing.

Something to check is the dependencies for these services. Something like the

http://WWW service

will obviously depend on TCP/IP being started first. You might want to see if there are any "unusual" dependencies listed.

Chip H.

 

[sm43]

I was going through the dependencies of all the services installed. I didn't find any suspicious dependencies. In fact, I didn't even find any suspicious services installed other than those FireDaemon services (and they weren't dependent on any of the services, nor any services were dependent on them. I DID learn about which services are dependent on which services and i just thought of something. I noticed that the

http://WWW Publishing

service depends on iis admin service which is dependent on Protected Storage Service, which is, in-turn, depedendent upon rpc (remote-procedure call) service.

Right now, all of these services are running except the

http://www publishing

service.

Since the error says "not enough storage space...", I sort of thought that it might be possibly linked to Protected "Storage" and that the vagueness of the message text might be because it's ageneric error message that the Protected Storage service generates.

The Protected Storage Service does the following. It is the text straight from the default description of the service in the Service Control Manager.


"Provides protected storage for sensitive data, such as private keys, to prevent access by unauthorized services, processes, or users."


Right now, All Services log-on with the LocalSystem account.
I'm just wondering, is there a change that is made to the LocalSystem account by the SQL Server Service Pack 3 or something...some change that's causing the

http://www publishing

service logon to fail.



Saad

 

[sm43]

my verdict is that either some hacker program, or a spy-ware, or virus or something has messed up something on my computer.. that is preventing the services that iis depends on from starting. i've run ad-aware and spybot and found a whole bunch of files classified as spyware - hacks etc and have removed all those files. That hasn't seemed to make a difference to the iis problem, even after i've uninstalled-installed iis.

Having no choice, I've had to rebuilt our server and installed everything from scratch.

My laptop, which is also suffering from the same dilemma, i haven't rebuilt yet. There's a LOT of stuff that I'll have to install & put back, and it's just a pain. i formatted & built it not so long before this problem occured, so it would be frustrating to do it again so soon. Instead, what I've done, is installed Apache web server for Windows (1.3.7) and am currently running a trial version of Instant ASP 2.1 by Stryon. It is a middleware, much like Chilisoft, for making ASP portable for other webservers, platforms.. I know it is not the ideal environment for ASP, and i would certainly like to be able to go back to ASP, if i could.. but re-installing the Operating System is not something that I wanna do.. anyway, thought I'd keep you updated.


Saad

 

[SgtB]

Please tell me the webserver was properly patched and sitting behind a firewall!
If it wasn't you'll need to do that. It will minimize the threat of future problems.

Oh here's a link on the firedaemon stuff:

http://www.firedaemon.com/

Good luck! Let us know if there's anything we can help you with. ________________________________________
Check out

http://www.security-forums.com