My IIS server is not working correctly anymore

[Kenny]

My IIS server is not working correctly anymore. I cannot open my root site
(on my computer) I get the following message:

the server unexpectedly closed the connection.

When I look into the EVENT VIEWER I have the following
1) INFORMATION:

Event Type: Information
Event Source: COM+
Event Category: (117)
Event ID: 778
Date: 7/5/2004
Time: 7:03:05 ìì
User: N/A
Computer: KENNY-XP
Description:
Application image dump failed.
Server Application ID: {3D14228C-FBE1-11D0-995D-00C04FD919C1}
Server Application Instance ID:
{E4FE98E6-AD4F-415E-A764-C1914DB092BF}
Server Application Name: IIS In-Process Applications
Error Code = 0x80004005 : Unspecified error
COM+ Services Internals Information:
File: d:\nt_qxp\com\com1x\src\shared\util\svcerr.cpp, Line: 1259
Comsvcs.dll file version: ENU 2001.12.4414.53 shp

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

____________________________________
2) ERROR:


The run-time environment has detected an inconsistency in its internal
state. This indicates a potential instability in the process that could be
caused by the custom components running in the COM+ application, the
components they make use of, or other factors. Error in
d:\nt_qxp\com\com1x\src\comsvcs\package\cpackage.cpp(1184), hr = 80080005:
InitEventCollector failed

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

Heelllppppp!!!

 

[Bojidar Alexandrov]

Without more information I can suggest you only - remove and install again
IIS...

 

[Kenny]

Problem solved! I used SYSTEM RESTORE and went 2 days back and IIS is
working again!

 

[Bojidar Alexandrov]

Problem solved! I used SYSTEM RESTORE and went 2 days back and IIS is

"Nice" feature that I never use...

 

[Cari \(MS-MVP\)]

Now, can you remember doing anything to the PC in the 2 days between when it
was working and when it wasn't!

Thereby lies the way to find out what happened!

 

[David]

"Nice" feature that I never use...

I'm glad it worked for you but my own experiences have been very much
hit and miss, sometimes it works but on most occassions it has
completely failed. I think there is better software that is more
reliable at system restore. Can anyone recommend what to buy?

TIA

David

 

[Bojidar Alexandrov]

It is called with one general name - backup software....

 

[Painless]

I have been experiencing lots of weird behavior in the past 3 days with my
IIS servers. (I have 4). Windows Integrated Authentication is failing on
2, while another has totally lost the accepted IP addresses that the SMTP
server is allowed to relay mail from.

All were working before, and I have changed NOTHING in the past 9 months.
The problems were ALL caused by settings being changed from the working
defaults. The only server that has not given me problems this week is the
server which I had automatic updates turned off. (Me wonders if the recent
Sasser attacks have caused uncle Bill to release a buggy patch?)

 

[John Alderson]

Patches don't mysteriously change website configurations or file system
permissions. Either someone in your office is experimenting or you have
been compromised. Patches are often blamed for bad behavior like this
because often changes like the ones you describe don't manifest themselves
until the process (or system in case of a reboot) is restarted. It is
rather rare for a patch to cause widespread problems. They may cause issues
in not often used configurations and even that is rare. 011 has caused
issues with IPSec enabled systems driving the CPU to 100% utilization.
Otherwise, the patch is stable on a wide variety of systems (Domain
Controllers, Exchange, SQL Server, IIS, etc).

Have you applied patches in the past 9 months where nothing has changed?
Are you using URLScan and the IIS Lockdown tool or similar configurations?
Do you have auditing enabled? On the file system as well? Have you
examined the logs? Unless you can reasonably prove to yourself that the
machine has not been compromised or that (more likely) someone else in your
office has not made any changes, even inadvertently, to affect the status of
these websites, then you should continue to investigate these more likely
causes.

John Alderson