xmlrpc.php causing system hang?

[mlordi]

Hello everyone! first time posting here. I have a windows 2000 server
running iis 5. I am having this weird problem of late (started around
11/7/2005). I noticed in my event viewer under system that I have been
getting these timeout messages from a file called xmlrpc.php. Now the
weird thing is that this message is happening about every fifteen
minutes. The exact error message is:


The script started from the URL '/blog/xmlsrv/xmlrpc.php' with
parameters '' has not responded within the configured timeout period.
The HTTP server is terminating the script.
For additional information specific to this message please visit the
Microsoft Online Support site located at:
http://www.microsoft.com/contentredirect.asp.


The URL changes though to a few different locations.
Here are some:
blog/xmlrpc.php
blogs/xmlrpc.php
wordpress/xmlrpc.php
blog/xmlsrv/xmlrpc.php
blog/xmlsrv/xmlrpc.php


Now eventually my webserver seems to not be able to handle the timeout
sessions and then sometime overnight will eventually stop servering web

requests. It seems as though everything is running normally (services
and everything look fine.) But when you bring up the URL it comes up
with a DNS error. Now if I go and stop and restart the WWW publishing
service everything starts running fine again.


I have found some information about a virus called lupii or lupper.
This virus is targeted at Linux machines though.


So does anyone know of other things I can check to make sure I am
protected, or how to filter out these requests? I really need help
since this is just getting so bothersome now. Any help or ideas are
appreciated. Thank you very much for your time.


Mark

 

[Guest]

we're seeing the same behavior on our server.

a couple of months ago, I was seeing something that I think is related. it
had to do with the number of bytez being posted to the php page, but only
through IE. if the bytes posted to a php page served through IIS exceeded a
certain amount, the page was never executed, and I saw a cgi timeout.

http://news.php.net/php.windows/26418

in this particular case, I set up IIS to use the isapi module instead of the
cgi executable, and it runs fine now.

seeing the logs, the size of the post is quite large, and I wonder if the
issue is related. some sort of bug in the interaction between PHP and IIS
related to the post size in IE.