Solved

Server Error in '/' application.... No connection could be made because the target machine actively refused it xxx.xxx.xxx.xxx:80

Posted on 2010-11-21
25
909 Views
Last Modified: 2012-05-10
All of a sudden, users cannot access Internal web site. The error that is coming up seems to direct to an IP address somewhere in England.
Malwarebytes, Avira ServerAV, GMER all run on Box, No results. Restored Previous version of Web Site, reinstalled .Net2.0. Still no-go.
I uninstalled AV, thinking that was blocking it somehow. Didnt solve the problem.
I am at my wits end. Should I just uininstall IIS? will I have to reinstall .net and related?

Thanks in advance for any assistance.
0
Comment
Question by:chrismaksimik
  • 13
  • 11
25 Comments
 
LVL 17

Expert Comment

by:sweetfa2
Comment Utility
Your users cannot access internal web site.  Are your users internal too?

If your users are internal, what DNS server are they using ("ipconfig /all" will tell you on windows in a cmd prompt).

It probably means that the DNS is giving the wrong address for the server you are trying to hit.

Other possibilities are that a proxy server is not being bypassed when it should be, or that the DNS that a proxy server is using is giving the wrong address.
0
 
LVL 15

Expert Comment

by:pcsmitpra
Comment Utility
Hello
Are you able to browse website from server itself?
Are you able to browse pages or best to view images like .Jpeg from IIS itself?
Do you have any other software installed on same server which can eat the port :80 like jboss tomcat apache etc.
Is IIS services are running in services.msc?

Waiting for your reply.
Thank you
0
 

Author Comment

by:chrismaksimik
Comment Utility
DNS isnt the issue, even using the ip address gives the same issue.
I have the same error even browsing from IIS itself.
Users get the logon when they access the site, after authenticating, the error comes up.
I uninstalled Antivirus, thinking that was the issue, it wasnt.
Im here in person im going to run GMER again from the console and see what I find.
Funny how it is redirecting to an offsite web page, which is then denying the request.
0
 
LVL 17

Expert Comment

by:sweetfa2
Comment Utility
Users get the logon - after authentication the error comes up.

How do you know the dns is not at fault.   How does the initial page after authentication get determined.  Does it have a redirect.

Has your site been hacked?

What is causing the page flow to attempt to go outside.  What is the content of hte page it should be displaying.  How does it determine what that page is.
0
 

Author Comment

by:chrismaksimik
Comment Utility
I dont know if the site has been Hacked. I dont know what is causing the redirection. The web server is on an IBM box running S2003 standard. A rootkit was found earlier today by running GMER. Even after restart Site does not work. Site contains Documents and Graphics that the Internal users use for daily business. No outside use of this server. It is used for printing and file sharing also. The site is contained in a local folder on the hard drive. it gets backed up every week (Overwritten, I'm afraid) So if the site is damaged, so is Saturday's backup. S**t.

I dont know anything about web development Im afraid. I know IIS opens a default page called Default.aspx. Dont know anything about it after that.
0
 

Author Comment

by:chrismaksimik
Comment Utility
]Server Error in '/' Application
No connection could be made because the target machine actively refused it 80.68.92.29:80
Description: An unhandled exception occurred during the execution of the current web request. Please review the stack trace for more information about the error and where it originated in the code.

Exception Details: System.Net.Sockets.SocketException: No connection could be made because the target machine actively refused it 80.68.92.29:80

Source Error:

An unhandled exception was generated during the execution of the current web request. Information regarding the origin and location of the exception can be identified using the exception stack trace below.  

Stack Trace:


[SocketException (0x274d): No connection could be made because the target machine actively refused it 80.68.92.29:80]
   System.Net.Sockets.Socket.DoConnect(EndPoint endPointSnapshot, SocketAddress socketAddress) +239
   System.Net.Sockets.Socket.InternalConnect(EndPoint remoteEP) +35
   System.Net.ServicePoint.ConnectSocketInternal(Boolean connectFailure, Socket s4, Socket s6, Socket& socket, IPAddress& address, ConnectSocketState state, IAsyncResult asyncResult, Int32 timeout, Exception& exception) +224

[WebException: Unable to connect to the remote server]
   System.Net.WebClient.DownloadDataInternal(Uri address, WebRequest& request) +287
   System.Net.WebClient.DownloadData(Uri address) +106
   System.Net.WebClient.DownloadData(String address) +29
   RssToolkit.RssDownloadManager.DownloadChannelDom(String url) in c:\webnet\misc\dmitryr\rsstoolkit\sources\toolkit\RssDownloadManager.cs:49
   RssToolkit.RssDownloadManager.GetChannelDom(String url) in c:\webnet\misc\dmitryr\rsstoolkit\sources\toolkit\RssDownloadManager.cs:171
   RssToolkit.RssDownloadManager.GetChannel(String url) in c:\webnet\misc\dmitryr\rsstoolkit\sources\toolkit\RssDownloadManager.cs:182
   RssToolkit.RssChannelBase`2.LoadFromUrl(String url) in c:\webnet\misc\dmitryr\rsstoolkit\sources\toolkit\RssChannelBase.cs:30
   RssToolkit.GenericRssChannel.LoadChannel(String url) in c:\webnet\misc\dmitryr\rsstoolkit\sources\toolkit\GenericRssChannel.cs:38
   RssToolkit.RssDataSource.get_Channel() in c:\webnet\misc\dmitryr\rsstoolkit\sources\toolkit\RssDataSource.cs:51
   RssToolkit.RssDataSourceView.ExecuteSelect(DataSourceSelectArguments arguments) in c:\webnet\misc\dmitryr\rsstoolkit\sources\toolkit\RssDataSource.cs:86
   System.Web.UI.WebControls.BaseDataList.GetData() +38
   System.Web.UI.WebControls.DataList.CreateControlHierarchy(Boolean useDataSource) +153
   System.Web.UI.WebControls.BaseDataList.OnDataBinding(EventArgs e) +54
   System.Web.UI.WebControls.BaseDataList.DataBind() +55
   System.Web.UI.WebControls.BaseDataList.EnsureDataBound() +60
   System.Web.UI.WebControls.BaseDataList.CreateChildControls() +69
   System.Web.UI.Control.EnsureChildControls() +87
   System.Web.UI.Control.PreRenderRecursiveInternal() +44
   System.Web.UI.Control.PreRenderRecursiveInternal() +171
   System.Web.UI.Control.PreRenderRecursiveInternal() +171
   System.Web.UI.Control.PreRenderRecursiveInternal() +171
   System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint) +842

 


--------------------------------------------------------------------------------
Version Information: Microsoft .NET Framework Version:2.0.50727.3615; ASP.NET Version:2.0.50727.3618
0
 
LVL 17

Expert Comment

by:sweetfa2
Comment Utility
what are the contents of your Default.aspx?
0
 

Author Comment

by:chrismaksimik
Comment Utility
<%@ Page Language="C#" MasterPageFile="~/site.master" AutoEventWireup="true" CodeFile="Default.aspx.cs" Inherits="_Default" Title="Untitled Page" %>

<%@ Register Assembly="RssToolkit" Namespace="RssToolkit" TagPrefix="cc1" %>
<asp:Content ID="Content2" runat="server" ContentPlaceHolderID="InfoBox">
     <asp:DataList ID="DataList1" runat="server" DataSourceID="RssDataSource1">
         <ItemTemplate>
            <div class="smallheader" style="text-align:center;">Weather Report</div><br />
            <div style="text-align: center;">
             <%# Eval("description") %>
             </div>
         </ItemTemplate>
    </asp:DataList>
    <hr />
    <div class="smallheader" style="text-align:center;">Did you know...?</div>
    <br />
    <div style="text-align:center;"><asp:Label ID="funQuote" runat="server"></asp:Label></div>
    <cc1:RssDataSource ID="RssDataSource1" runat="server" MaxItems="0" Url="http://weather.yahooapis.com/forecastrss?p=60477">
    </cc1:RssDataSource>
    </asp:Content>
<asp:Content ID="Content3" runat="server" ContentPlaceHolderID="Content">
    <div class="header">
        <!--<table style="border-style:double; border-color:Navy; padding: 2px; font-size:12px;"><tr><td style="text-align:center;">
            <asp:Image ID="Image1" runat="server" ImageUrl="images/25years.jpg" BorderWidth="0px"/></td></tr>
            <tr>
                <td style="text-align: center">
                    <p>Congratulations on 25 plus years of dedication and service! </p>
                    <p> Thank you one and all!</p></td>
            </tr>
        </table>-->
        <br />
        <br />
        August 3, 2010</div><br />
    <br />
      <span style="font-size: 12pt">
      <p>To all Team Members:

<p>What a difference a year makes,
<p>Economically speaking, things have improved, but slower than all of us I'm sure anticipated.  
<br><br><br>
<p>Best Regards,<br><br>
<p>owner.<br>
President
<p>&nbsp;
<p>&nbsp;
</span>
</asp:Content>
0
 
LVL 17

Expert Comment

by:sweetfa2
Comment Utility
http://weather.yahooapis.com/forecastrss?p=60477

From your server, and from a workstation that is attempting to perform the login can you try the link above and let me know the results
0
 

Author Comment

by:chrismaksimik
Comment Utility
The link works, it updates a little weather app on the home page.
0
 
LVL 17

Expert Comment

by:sweetfa2
Comment Utility
  RssToolkit.RssDownloadManager.DownloadChannelDom(String url) in c:\webnet\misc\dmitryr\rsstoolkit\sources\toolkit\RssDownloadManager.cs:49
   RssToolkit.RssDownloadManager.GetChannelDom(String url) in c:\webnet\misc\dmitryr\rsstoolkit\sources\toolkit\RssDownloadManager.cs:171
   RssToolkit.RssDownloadManager.GetChannel(String url) in c:\webnet\misc\dmitryr\rsstoolkit\sources\toolkit\RssDownloadManager.cs:182
   RssToolkit.RssChannelBase`2.LoadFromUrl(String url) in c:\webnet\misc\dmitryr\rsstoolkit\sources\toolkit\RssChannelBase.cs:30
   RssToolkit.GenericRssChannel.LoadChannel(String url) in c:\webnet\misc\dmitryr\rsstoolkit\sources\toolkit\GenericRssChannel.cs:38
   RssToolkit.RssDataSource.get_Channel() in c:\webnet\misc\dmitryr\rsstoolkit\sources\toolkit\RssDataSource.cs:51
   RssToolkit.RssDataSourceView.ExecuteSelect(DataSourceSelectArguments arguments) in c:\webnet\misc\dmitryr\rsstoolkit\sources\toolkit\RssDataSource.cs:86

Open in new window


The above stack trace indicates it is attempting to load an RSS stream.  The only stream in your Default.aspx is the link I got you to test.  As the link works on both machines, that cannot be what it is trying to access.

Therefore,  you need to work out what page is trying to be loaded.  You will need to refer to your server access logs to see what page is actually attempting to be loaded and then check that for any RSS links.

Somewhere in the setup it is attempting to access an RSS site at the address that is refusing connections.

Is it possible that the remote RSS server is actually just down?
0
 
LVL 17

Expert Comment

by:sweetfa2
Comment Utility
The problem is not related to your server, and repeated reinstallation attempts aren't going to change it.

The problem is to identify what is causing the attempted external connection.  Your website itself is still functioning, it is just that your page design does not deal with errors on it's rss feed and as such stops your site from functioning for the users.  Send your site back to the developers to fix, and in the meantime attempt to isolate what is triggering the outcall.
0
Free Trending Threat Insights Every Day

Enhance your security with threat intelligence from the web. Get trending threat insights on hackers, exploits, and suspicious IP addresses delivered to your inbox with our free Cyber Daily.

 

Author Comment

by:chrismaksimik
Comment Utility
I will send the site to the developer, although he was the one who informed me of the problem. I did a search through the registry for the External IP address, it came up twice, in a Browser Redirect object. I changed the IP address to the Web server's address for S**Ts and Giggles, but the External address still came up.
None of this affects the servers Browsing capability or other functionality, though...
0
 
LVL 17

Expert Comment

by:sweetfa2
Comment Utility
The developer needs to wrap error handling around the RSS feed.  

There is still something in your site that is causing the RSS feed to attempt to go to the error address that you need to find.

What is the URL for the page that gets the error?
0
 

Author Comment

by:chrismaksimik
Comment Utility
I think the servers are infected with Virux. I found 7.tmp in the MBR, Hod on, Im going to see what I can do to remove this thing..
0
 
LVL 17

Expert Comment

by:sweetfa2
Comment Utility
That would certainly explain it.  It was a thought I was having earlier on as a possible cause.

Good luck
0
 

Author Comment

by:chrismaksimik
Comment Utility
Think mbrfix may take care of it. this is bad.....
0
 
LVL 17

Expert Comment

by:sweetfa2
Comment Utility
Think you will find there is more than that.  Can you boot of a usb or cd and run a virus scan on it?
0
 

Author Comment

by:chrismaksimik
Comment Utility
Im going to try to get out there tomorrow, Do you think more than Fixmbr will work?
0
 
LVL 17

Expert Comment

by:sweetfa2
Comment Utility
The particular virus you mention does a lot more than just toy with the MBR record.  You will need a full virus scan with removal capability for VIRUX.
0
 

Author Comment

by:chrismaksimik
Comment Utility
I had Symantec corporate, when the problem arose. I installed Avira, It found a lot of Bugs that SYM never caught. ALSO,,, out of all the programs I have tried, RootRepeal is the ONLY one that showed the 7.tmp file in the boot record.

Malwarebytes, trendMicro, Eset, rootkit reveal, microsoft Malicious Software removal tool, GMER, all have been tried.

Now the matter will be to Fixmbr and HOPE that Avira will catch anything malicious (That Symantec Let through.)
0
 
LVL 17

Expert Comment

by:sweetfa2
Comment Utility
just make sure you are booting from a different drive (cd,usb) when you run your scan.  If you use one of the existing drives on the system you could be compromising your scan)
0
 

Author Comment

by:chrismaksimik
Comment Utility
First I want to Thank you for your help all this time.

Today I booted to the SBS2003 disk, ran fixmbr, OKd the warnings, and restarted. On restart, I ran RootRepeal and the MBR Bug is still there.
I am going to boot to a Linux disk, download Eset or something and run that and see what I find. Else I will have to scrap the server as a last resort.  
0
 

Accepted Solution

by:
chrismaksimik earned 0 total points
Comment Utility
Nothing worked. I am going to rebuild the Array, Virtualize the Server, and reinstall the OS.
0
 

Author Closing Comment

by:chrismaksimik
Comment Utility
nothing worked. reinstalled server
0

Featured Post

Threat Intelligence Starter Resources

Integrating threat intelligence can be challenging, and not all companies are ready. These resources can help you build awareness and prepare for defense.

Join & Write a Comment

I've always wanted to allow a user to have a printer no matter where they login. The steps below will show you how to achieve just that. In this Article I'll show how to deploy printers automatically with group policy and then using security fil…
If you don't have the right permissions set for your WordPress location in IIS, you won't be able to perform automatic updates. Here's how to fix the problem.
It is a freely distributed piece of software for such tasks as photo retouching, image composition and image authoring. It works on many operating systems, in many languages.
This video shows how to remove a single email address from the Outlook 2010 Auto Suggestion memory. NOTE: For Outlook 2016 and 2013 perform the exact same steps. Open a new email: Click the New email button in Outlook. Start typing the address: …

743 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

15 Experts available now in Live!

Get 1:1 Help Now