Solved

URGENT:  PLEASE HELP WITH VIRUS

Posted on 2004-04-14
4
194 Views
Last Modified: 2010-04-19
I am pretty sure I have a virus on one of my 2003 boxes

I am getting this message when I try to access any web pages:

:irc.f**.off.kthx.biz 451 GET :You have not registered
:irc.f**.off.kthx.biz 451 Accept: :You have not registered
:irc.f**.off.kthx.biz 451 Accept-Language: :You have not registered
:irc.f**.off.kthx.biz 451 Accept-Encoding: :You have not registered
:irc.f**.off.kthx.biz 451 User-Agent: :You have not registered
:irc.f**.off.kthx.biz 451 Host: :You have not registered
:irc.f**.off.kthx.biz 451 Connection: :You have not registered
:irc.f**.off.kthx.biz 451 Cache-Control: :You have not registered
ERROR :Closing Link: [68.163.138.77] (Ping timeout)

where f** is an f-bomb.  Does anyone know what the hell is going on here?  When I try to edit any of my IIS web app settings, its says error, the file is in use.

0
Comment
Question by:jjacksn
  • 2
  • 2
4 Comments
 
LVL 7

Accepted Solution

by:
IceRaven earned 500 total points
ID: 10830501
Suggestions...

1. Unplug server from the Network.
2. Stop the IIS Services so you can acesss the settings if nessicary
3. Get some anti-virus protection on there if you can. (Make sure it is 2003 Server Compatible)

The web pages you are trying to access, are they local, are they just html or asp or something else?

It looks like something is trying to connect to an irc channel.
Give me some more details and I can give you some more help.

IceRaven
0
 
LVL 5

Author Comment

by:jjacksn
ID: 10830597
IceRaven,

unfourtunately, I can only access the machine remotely right now, so it must stay connected.

the pages are all in the same directory (c:\web) with 5 different web apps  They root app (Register) is stoped, and when I try to start it, it says "the process cannot access the file because it is being used by another process".

My downloads are extremely slow on the machine, as well.  I am in the middle of downloading the virus protection software.  

This result can be seen when I connect to the ip address of that server.  (normally, it would give me the IIS under construction page since there is no default index.html).  
0
 
LVL 7

Expert Comment

by:IceRaven
ID: 10830742
from the command line of the server...

net stop w3svc

This will stop the IIS Web Service.  I am thinking prehaps something is hijacking the IIS or port 80.
Once the service is stopped.  See if you can still connect to port 80.

from the command line of your machine...
telnet yourservername 80

Is the port open?

IceRaven
0
 
LVL 5

Author Comment

by:jjacksn
ID: 10969363
It was a virus.  had to reinstall everything.  Anyway, problem fixed now.  Got to love Microsoft vunerabilities.  
0

Featured Post

Ransomware-A Revenue Bonanza for Service Providers

Ransomware – malware that gets on your customers’ computers, encrypts their data, and extorts a hefty ransom for the decryption keys – is a surging new threat.  The purpose of this eBook is to educate the reader about ransomware attacks.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This may not be a text book method to resolve VSS backup issues but it seemed to have worked on few of the Windows 2003 servers we had issues while performing a Volume Shadow Copy backup. If you have issues while performing a shadow copy backup usin…
Recently, I had the need to build a standalone system to run a point-of-sale system. I’m running this on a low-voltage Atom processor, so I wanted a light-weight operating system, but still needed Windows. I chose to use Microsoft Windows Server 200…
This video shows how to remove a single email address from the Outlook 2010 Auto Suggestion memory. NOTE: For Outlook 2016 and 2013 perform the exact same steps. Open a new email: Click the New email button in Outlook. Start typing the address: …
I designed this idea while studying technology in the classroom.  This is a semester long project.  Students are asked to take photographs on a specific topic which they find meaningful, it can be a place or situation such as travel or homelessness.…

919 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

17 Experts available now in Live!

Get 1:1 Help Now