Solved

URGENT:  PLEASE HELP WITH VIRUS

Posted on 2004-04-14
4
197 Views
Last Modified: 2010-04-19
I am pretty sure I have a virus on one of my 2003 boxes

I am getting this message when I try to access any web pages:

:irc.f**.off.kthx.biz 451 GET :You have not registered
:irc.f**.off.kthx.biz 451 Accept: :You have not registered
:irc.f**.off.kthx.biz 451 Accept-Language: :You have not registered
:irc.f**.off.kthx.biz 451 Accept-Encoding: :You have not registered
:irc.f**.off.kthx.biz 451 User-Agent: :You have not registered
:irc.f**.off.kthx.biz 451 Host: :You have not registered
:irc.f**.off.kthx.biz 451 Connection: :You have not registered
:irc.f**.off.kthx.biz 451 Cache-Control: :You have not registered
ERROR :Closing Link: [68.163.138.77] (Ping timeout)

where f** is an f-bomb.  Does anyone know what the hell is going on here?  When I try to edit any of my IIS web app settings, its says error, the file is in use.

0
Comment
Question by:jjacksn
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
  • 2
4 Comments
 
LVL 7

Accepted Solution

by:
IceRaven earned 500 total points
ID: 10830501
Suggestions...

1. Unplug server from the Network.
2. Stop the IIS Services so you can acesss the settings if nessicary
3. Get some anti-virus protection on there if you can. (Make sure it is 2003 Server Compatible)

The web pages you are trying to access, are they local, are they just html or asp or something else?

It looks like something is trying to connect to an irc channel.
Give me some more details and I can give you some more help.

IceRaven
0
 
LVL 5

Author Comment

by:jjacksn
ID: 10830597
IceRaven,

unfourtunately, I can only access the machine remotely right now, so it must stay connected.

the pages are all in the same directory (c:\web) with 5 different web apps  They root app (Register) is stoped, and when I try to start it, it says "the process cannot access the file because it is being used by another process".

My downloads are extremely slow on the machine, as well.  I am in the middle of downloading the virus protection software.  

This result can be seen when I connect to the ip address of that server.  (normally, it would give me the IIS under construction page since there is no default index.html).  
0
 
LVL 7

Expert Comment

by:IceRaven
ID: 10830742
from the command line of the server...

net stop w3svc

This will stop the IIS Web Service.  I am thinking prehaps something is hijacking the IIS or port 80.
Once the service is stopped.  See if you can still connect to port 80.

from the command line of your machine...
telnet yourservername 80

Is the port open?

IceRaven
0
 
LVL 5

Author Comment

by:jjacksn
ID: 10969363
It was a virus.  had to reinstall everything.  Anyway, problem fixed now.  Got to love Microsoft vunerabilities.  
0

Featured Post

Free Tool: Path Explorer

An intuitive utility to help find the CSS path to UI elements on a webpage. These paths are used frequently in a variety of front-end development and QA automation tasks.

One of a set of tools we're offering as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

by Batuhan Cetin In this article I will be guiding through the process of removing a failed DC metadata from Active Directory (hereafter, AD) using the ntdsutil tool in a Windows Server 2003 environment. These steps are not necessary in a Win…
This may not be a text book method to resolve VSS backup issues but it seemed to have worked on few of the Windows 2003 servers we had issues while performing a Volume Shadow Copy backup. If you have issues while performing a shadow copy backup usin…
Exchange organizations may use the Journaling Agent of the Transport Service to archive messages going through Exchange. However, if the Transport Service is integrated with some email content management application (such as an antispam), the admini…

749 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question