www service is terminating w/out apparent reason or explanation

[callshakeel]

My web and ftp services are terminating w/out apparent reason or explanation. I need help troubleshooting it. No clue where to start.

If I "start" the service from the IIS console, it just stops again after a few seconds.
I re-starts the IIS service completely (from the IIS console) and I thought that had solved the problem, but the services terminated again after about 5-10 minutes).

The event log shows errors (below)

1)The IIS Admin Service service terminated unexpectedly. It has done this 61 time(s). The following corrective action will be taken in 1 milliseconds: Run the configured
recovery program.

2)The World Wide Web Publishing Service service terminated unexpectedly. It has done this 61 time(s). The following corrective action will be taken in 0 milliseconds: No action.

3)The FTP Publishing Service service terminated unexpectedly. It has done this 53 time(s). The following corrective action will be taken in 0 milliseconds: No action.

 

[koquito]

DId you try applying the latest patches for IIS and your server?

A+, MCP, CCNA
marbinpr@hotmail.com

"I just know that I know nothing"
Socrates (469-399 B.C.E.)

 

[GiaBetiu]

As you see (we already have big problems with ths issue, so I damn studied it) Microsoft answer is: RedWorm.
What is doing redworm? Is overwriting an "unchecked" buffer, sending some requests to an ISAPI filter or extension. RedWorm is atacking Query service and Index service (.idq .ida file requests).
Be sure that you don't have any such worm or virus (Apply latest SPs, and hotfixes).
If after updating with al security patches you still have the problem, then:
- IIS can be shutted down unex. when an applictaion is blocking some resources (eg: SNMP, antivirus, backup)
- think about a "friendly fire". possible some packets in your network to attack in the same manner like redworm is doing
- are you having your own ISAPIs? Check them! If Microsoft had that uncheck buffer in their code,.. possible that another programmer to make same mistake.

Gia Betiu
giabetiu@chello.nl
Computer Eng. CNE 4, CNE 5, MCSE Win2K

 

[sveiki]

Hi,

We have "IIS Admin terminated.." every night now.
AntiVirus company TrendMicro.com
suggested to upgrade to ServerProtect 5.56
which we did but it did not help.

What else can be done?
Anybody?