Hi, I have a problem that keeps occuring on my Win 2000 server but the logs don't tell me the full info. What is evident though is a particular exploit is occuring which crashes IIS which though it restarts, often restarts with an error in ASP or other ISAPI applications.
What I can discover is the following connection has been blocked by Zone Alarm (an early version)...
FWIN,2006/03/19,11:10:45 +0:00 GMT,220.127.116.11:14955,18.104.22.168:80,TCP (flags:S)
where my server is the something like the 217 number.
Every time IIS has a problem, a number of this type of connection are made and IIS restarts.
Anybody have any ideas?
Oh yes. The connection only appears in the ZA log and nowhere else that I can find.
Operating System:Windows 2000 Server/Adv Server
Product Name:ZoneAlarm Pro