WebApp Sec mailing list archives

Re: asp application problem.


From: vbedus () bitchangers com
Date: Fri, 7 Mar 2003 10:52:07 -0800 (PST)

Gill,
The slammer virus actually replaces your services.exe with an infected on in
system32/drivers.

The problem that you are listing below sounds like a classic ASP type of
problem.  When you kill off the dllhost.exe you are actually killing off the
thread created by the asp page.
It sounds like you have an appartment threaded component, that is either doing a
transaction, or is waiting on a lock.

I would take a look at your source to see what is going on.

Let me know if you need further help.

Vinny Bedus
Bit Changers
http://www.BitChangers.com/
Quoting Sarbjit Singh Gill <ssgill () gilltechnologies com>:

Greetings folks,

I have a problem with a ASP classic application on W2k.

After a day, the application gets hang. On the task manager, we could see
three dllhost.exe. The third one is the problem. One dllhost.exe will be
running under System. The second will be IWAM_<computername> and the third
will also be IWAM_<computername>.

 ON doing "end process" on the IWAM_<computername> dllhost.exe process, the
application starts working fine. This happens
 once in a day. One a heavy load day, it happens a couple of times. Every
time after removing the IWAM_ related dllhost.exe and application starts
working fine.

There is  a SQL server(on the same box as IIS) in this application(IIS5,
SQL2000, asp classic). Could this be a virus. I have been told that the
Slammer affects the win32.dll(my guess) and/or dllhost.exe. When ever i am
removing(killing process from Task Manager) the third hostdll and our
application works fine.

I am more confused and i do not where to start to trouble shoot.

Could it be my IIS config? or Active X dll managment in my application. I
have checked the dll. They are ok coding wise.

Cheers
Gill





Current thread: