Solved

inetinfo.exe Windows 2000 Small business Server

Posted on 2003-11-17
10
394 Views
Last Modified: 2010-04-14
Hello,

I am having a problem that started a few days ago, my servers inetinfo.exe file is bogging down my server, it is contstanly accessing the hard drive (I/O read and writes) and filling my memory resources reaching at times 300MB in memory. When I shut down IIS the file disappears and my servers works fine again, except i dont have access to my exchange server or IIS no more.

I only have 3 users on this server and its is connected to the inernet thourgh one NIC and connected to my local LAN with another NIC. (So there are 2 NICS on the server).

Please give me a solution to this.

THanks
Freddy
0
Comment
Question by:micropan
  • 5
  • 3
10 Comments
 
LVL 9

Expert Comment

by:MSGeek
Comment Utility
If it is connected directly to the internet and you do not have a software and hardware firewall in place, it is very likely your web server has been hijacked.  What do you have for firewall protection?  Hardware and software?  Do you have any strange directories under Inetpub/wwwroot?  If you have been connected directly to the internet back up you data, rebuild your server, install hardware and sofwatre firewalls and then reconnect to the internet.  Good luck, MSGeek
0
 

Author Comment

by:micropan
Comment Utility
I have done reseach on this site , and have come to the conclusion that I am a victim of spammers,,,the have apparnelty used my exchange server to send over 20,000 emails over a period of 3 days (wow!!).

Anyways i have disabled relaying in the SMTP (virtual server) and enabled a authentecation for smtp,,, and for some unknow reason the spammers are still able to use my exchange to relay mail,, the only way I am able to stop them is by completely disabling my SMTP (Virtual server)

I need this to stop this, because I am already being blacklisted from other domains and its is eating up our bandwidth.

MY question now is how do I stop these spammers from relaying from my server, and still allow ,my legitment users use server to send emails?

0
 
LVL 1

Expert Comment

by:jonbar610
Comment Utility
After you made the changes to the SMTP process to disallow relay, did you stop and restart the SMTP services on the server?  When you disabled the SMTP relay, did you allow any addresses in the list of allowed computers, or did you only force authentication?

Jon
0
 
LVL 9

Expert Comment

by:MSGeek
Comment Utility
jon.. that is a valid commebt, but if he is seriously compromised and not just relaying there is no telling what kinds of back doors have been put in place.
0
Do You Know the 4 Main Threat Actor Types?

Do you know the main threat actor types? Most attackers fall into one of four categories, each with their own favored tactics, techniques, and procedures.

 
LVL 9

Expert Comment

by:MSGeek
Comment Utility
jon.. that is a valid commebt, but if he is seriously compromised and not just relaying there is no telling what kinds of back doors have been put in place.
0
 
LVL 1

Expert Comment

by:jonbar610
Comment Utility
I agree, MSGeek.  I was giving the benefit of the doubt to Freddy that he was using some level of filtering on the server.  I made this assumption solely on the basis that he did some research and recognized that SMTP was being heavily utilized for relay.  If this is the case, then he needs to configure SMTP correctly in order to stop the relaying.  However, I fully agree that if there is the possibility of compromise (besides relay), he should absolutely rebuild the server and implement a firewall.  

I would recommend running some sort of spy detection software such as Pest Patrol.  If no strange services or directories are realized and filtering is being used, then Freddy should configure SMTP correctly (stop relay), and I would still go with your suggestion about the firewall at that point (rebuild may not be necessary if the server is hardened).

That being said, Freddy, is the server hardened or are any filtering features being used?
0
 
LVL 9

Accepted Solution

by:
MSGeek earned 250 total points
Comment Utility
micropan.. did you ever get this resolved??  MSGeek.
0
 
LVL 9

Expert Comment

by:MSGeek
Comment Utility
micropan... Thx, but I believe it would only be fair to give jonbar610 credit at least for an assist, his answer was accurate.  MSGeek.
0
 
LVL 1

Expert Comment

by:jonbar610
Comment Utility
Thank you, MSGeek.  I appreciate the recognition.

Jon
0

Featured Post

IT, Stop Being Called Into Every Meeting

Highfive is so simple that setting up every meeting room takes just minutes and every employee will be able to start or join a call from any room with ease. Never be called into a meeting just to get it started again. This is how video conferencing should work!

Join & Write a Comment

NTFS file system has been developed by Microsoft that is widely used by Windows NT operating system and its advanced versions. It is the mostly used over FAT file system as it provides superior features like reliability, security, storage, efficienc…
Never store passwords in plain text or just their hash: it seems a no-brainier, but there are still plenty of people doing that. I present the why and how on this subject, offering my own real life solution that you can implement right away, bringin…
It is a freely distributed piece of software for such tasks as photo retouching, image composition and image authoring. It works on many operating systems, in many languages.
Sending a Secure fax is easy with eFax Corporate (http://www.enterprise.efax.com). First, Just open a new email message.  In the To field, type your recipient's fax number @efaxsend.com. You can even send a secure international fax — just include t…

763 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

6 Experts available now in Live!

Get 1:1 Help Now