Help - Do I Need To Re-Load

Appologies for posting this problem a second time, but
I'm on the verge of doing a complete re-load of the
Server, I would appreciate any comments as to whether I'm
doing the right thing.

The Problem - yesterday for no apparant reason the server
started to crawl whenever a connection to the internet
was made (56k dialup)

CPU usage was running at 100%, keyboard inputs to the
server took several mins to respond on screen. As soon as
web connection dropped, CPU usage returned to normal.

In the Apps log I have multiple entries showing Event ID
14079 associated with ISA with the following description

Description: Due to an unexpected error, the service
w3schdwn stopped responding to all requests. This
occurred 8 time(s) in the past 3:25 hours. Try to stop
the service or kill the corresponding process if it does
not respond, and start it again. Check the Event Viewer
for related error messages.

I have uninstalled and reinstalled ISA, but still have
the same problem.

I disabled exchange to make sure this wasn't affecting
things.

I've searched google, others have reported the same
problem, no one seems to have an answer.

I'm almost resigned to the fact that I'm going to have to
do a complete reload, (restoring exchange scares me a bit)

Am I doing the right thing, does anyone have any other
ideas, I really would appreciate any input.

Thanks ......... Andy

jimbehning
Thu Aug 21 06:42:31 CDT 2003

What antivirus are you running on your server? Are you totally up to
date on patches? I doubt that you need to do a reload. If you live in
the USA and you bought a retail copy of SBS you have two free calls
to Microsoft tech support. Even if you do not have free calls I
believe a call to them is $245 and well worth it if you do not find
the answer on the newsgroup.

"Andy L" <andy@nospam.com> wrote:

>Appologies for posting this problem a second time, but
>I'm on the verge of doing a complete re-load of the
>Server, I would appreciate any comments as to whether I'm
>doing the right thing.
>
>The Problem - yesterday for no apparant reason the server
>started to crawl whenever a connection to the internet
>was made (56k dialup)
>
>CPU usage was running at 100%, keyboard inputs to the
>server took several mins to respond on screen. As soon as
>web connection dropped, CPU usage returned to normal.
>
>In the Apps log I have multiple entries showing Event ID
>14079 associated with ISA with the following description
>
>Description: Due to an unexpected error, the service
>w3schdwn stopped responding to all requests. This
>occurred 8 time(s) in the past 3:25 hours. Try to stop
>the service or kill the corresponding process if it does
>not respond, and start it again. Check the Event Viewer
>for related error messages.
>
>I have uninstalled and reinstalled ISA, but still have
>the same problem.
>
>I disabled exchange to make sure this wasn't affecting
>things.
>
>I've searched google, others have reported the same
>problem, no one seems to have an answer.
>
>I'm almost resigned to the fact that I'm going to have to
>do a complete reload, (restoring exchange scares me a bit)
>
>Am I doing the right thing, does anyone have any other
>ideas, I really would appreciate any input.
>
>Thanks ......... Andy

Jim B. SBS MVP

Mark
Thu Aug 21 06:42:15 CDT 2003

Sounds like you might have the Blaster or other worm.

Download the "Stinger" removal tool from www.nai.com and=20
pop it on a blank CD. If you cannot get access to your=20
internet cos it kills your server go use someone elses PC,=20
say at an internet cafe to get the download. Also download=20
the blaster patch from here=20

http://www.microsoft.com/security/incident/blast.asp

and stick that on the CD too.

Now boot your server up in safe mode and log in as=20
administrator, copy the tool and patch from the CD to the=20
server. Run the Stinger first, let it clear any infections=20
then run the blaster patch.

Some sites list an alternative removal method, but I've=20
found the safe mode - administrator to be 100% effective=20
during the couple of hundred of cleanups I've done this=20
week, other methods can take a few tries depending on the=20
setup. (No I didn't get it, I just ran a "24 hour PC fix"=20
ad in the local paper that cost me =A3140 when I realised=20
what was going to happen last Friday. It made me over =A32K)


>-----Original Message-----
>Appologies for posting this problem a second time, but=20
>I'm on the verge of doing a complete re-load of the=20
>Server, I would appreciate any comments as to whether I'm=20
>doing the right thing.
>
>The Problem - yesterday for no apparant reason the server=20
>started to crawl whenever a connection to the internet=20
>was made (56k dialup)
>
>CPU usage was running at 100%, keyboard inputs to the=20
>server took several mins to respond on screen. As soon as=20
>web connection dropped, CPU usage returned to normal.
>
>In the Apps log I have multiple entries showing Event ID=20
>14079 associated with ISA with the following description
>
>Description: Due to an unexpected error, the service=20
>w3schdwn stopped responding to all requests. This=20
>occurred 8 time(s) in the past 3:25 hours. Try to stop=20
>the service or kill the corresponding process if it does=20
>not respond, and start it again. Check the Event Viewer=20
>for related error messages.
>
>I have uninstalled and reinstalled ISA, but still have=20
>the same problem.
>
>I disabled exchange to make sure this wasn't affecting=20
>things.
>
>I've searched google, others have reported the same=20
>problem, no one seems to have an answer.
>
>I'm almost resigned to the fact that I'm going to have to=20
>do a complete reload, (restoring exchange scares me a bit)
>
>Am I doing the right thing, does anyone have any other=20
>ideas, I really would appreciate any input.
>
>Thanks ......... Andy
>.
>

Andy
Thu Aug 21 07:18:19 CDT 2003

Hi Jim, thanks for your response. We run Sophos
antivitus, this together with Security patches are
religiously updated.

I will call to Microsoft, I really don't want to re-load
if it can be avoided.

Thanks ..... Andy



>-----Original Message-----
>What antivirus are you running on your server? Are you
totally up to
>date on patches? I doubt that you need to do a reload. If
you live in
>the USA and you bought a retail copy of SBS you have two
free calls
>to Microsoft tech support. Even if you do not have free
calls I
>believe a call to them is $245 and well worth it if you
do not find
>the answer on the newsgroup.
>
>"Andy L" <andy@nospam.com> wrote:
>
>>Appologies for posting this problem a second time, but
>>I'm on the verge of doing a complete re-load of the
>>Server, I would appreciate any comments as to whether
I'm
>>doing the right thing.
>>
>>The Problem - yesterday for no apparant reason the
server
>>started to crawl whenever a connection to the internet
>>was made (56k dialup)
>>
>>CPU usage was running at 100%, keyboard inputs to the
>>server took several mins to respond on screen. As soon
as
>>web connection dropped, CPU usage returned to normal.
>>
>>In the Apps log I have multiple entries showing Event ID
>>14079 associated with ISA with the following description
>>
>>Description: Due to an unexpected error, the service
>>w3schdwn stopped responding to all requests. This
>>occurred 8 time(s) in the past 3:25 hours. Try to stop
>>the service or kill the corresponding process if it does
>>not respond, and start it again. Check the Event Viewer
>>for related error messages.
>>
>>I have uninstalled and reinstalled ISA, but still have
>>the same problem.
>>
>>I disabled exchange to make sure this wasn't affecting
>>things.
>>
>>I've searched google, others have reported the same
>>problem, no one seems to have an answer.
>>
>>I'm almost resigned to the fact that I'm going to have
to
>>do a complete reload, (restoring exchange scares me a
bit)
>>
>>Am I doing the right thing, does anyone have any other
>>ideas, I really would appreciate any input.
>>
>>Thanks ......... Andy
>
>Jim B. SBS MVP
>.
>

Merv
Thu Aug 21 09:32:31 CDT 2003

Is this any help?

Multiple Overdue Tasks Are Run and Alerts Are Issued for a Short Period
http://support.microsoft.com/?kbid=293863

--
Merv Porter [SBS MVP]
===================================

"Andy L" <Andy@nospam.com> wrote in message
news:0bb901c367de$4ed57b00$a401280a@phx.gbl...
> Hi Jim, thanks for your response. We run Sophos
> antivitus, this together with Security patches are
> religiously updated.
>
> I will call to Microsoft, I really don't want to re-load
> if it can be avoided.
>
> Thanks ..... Andy
>
>
>
> >-----Original Message-----
> >What antivirus are you running on your server? Are you
> totally up to
> >date on patches? I doubt that you need to do a reload. If
> you live in
> >the USA and you bought a retail copy of SBS you have two
> free calls
> >to Microsoft tech support. Even if you do not have free
> calls I
> >believe a call to them is $245 and well worth it if you
> do not find
> >the answer on the newsgroup.
> >
> >"Andy L" <andy@nospam.com> wrote:
> >
> >>Appologies for posting this problem a second time, but
> >>I'm on the verge of doing a complete re-load of the
> >>Server, I would appreciate any comments as to whether
> I'm
> >>doing the right thing.
> >>
> >>The Problem - yesterday for no apparant reason the
> server
> >>started to crawl whenever a connection to the internet
> >>was made (56k dialup)
> >>
> >>CPU usage was running at 100%, keyboard inputs to the
> >>server took several mins to respond on screen. As soon
> as
> >>web connection dropped, CPU usage returned to normal.
> >>
> >>In the Apps log I have multiple entries showing Event ID
> >>14079 associated with ISA with the following description
> >>
> >>Description: Due to an unexpected error, the service
> >>w3schdwn stopped responding to all requests. This
> >>occurred 8 time(s) in the past 3:25 hours. Try to stop
> >>the service or kill the corresponding process if it does
> >>not respond, and start it again. Check the Event Viewer
> >>for related error messages.
> >>
> >>I have uninstalled and reinstalled ISA, but still have
> >>the same problem.
> >>
> >>I disabled exchange to make sure this wasn't affecting
> >>things.
> >>
> >>I've searched google, others have reported the same
> >>problem, no one seems to have an answer.
> >>
> >>I'm almost resigned to the fact that I'm going to have
> to
> >>do a complete reload, (restoring exchange scares me a
> bit)
> >>
> >>Am I doing the right thing, does anyone have any other
> >>ideas, I really would appreciate any input.
> >>
> >>Thanks ......... Andy
> >
> >Jim B. SBS MVP
> >.
> >