IIS Log exactly 65.536 bytes ???

From: Dominick Baier (groups@die-lounge.com)
Date: 11/26/02

  • Next message: Rob Wilcox: "RE: Exchange in the DMZ" 
    From: "Dominick Baier" <groups@die-lounge.com>
To: <focus-ms@securityfocus.com>
Date: Tue, 26 Nov 2002 19:51:21 +0100

    Hi,

    i have a strange behaviour on my IIS 5 box.

    I administer my Web Server via Terminal Services and i check the IIS
    Logfiles on a daily basis.

    From time to time i encounter a LogFiles which, when opened in Notepad,
    freezes the whole system. No Terminal Service reconnect - nothing. I
    have to reboot the machine.

    I then copied this suspicious Logfile to another machine and open it via
    Notepad - only empty lines. Opened it in a Hex Editor. Only 00 (ASCII
    00).

    Each Logfiles showing this behaviour has a size of exactly 65.536 Bytes.

    Another thing that makes me wonder is, that normally every logfile gets
    created by IIS at exactly 01.00. Only these suspicious Logfiles were
    created at a different time.

    The setup is IIS5 (fully patched) and URLScan 2.1

    Has anybody encoutered such a behaviour - speculations also welcome.

    greetings
    dominick

    • Quantcast