NT 4.0 server DNS.exe

Thread view:

Enable EMail Alerts

Start New Thread

Thread rating:

Frank - 26 Mar 2004 01:06 GMT

I have a client that whe she arrives in the morning the
following error message appears: An application error has
occured. DNS.exe Exception: access violation.
The server has sp6 installed.
This just started to occur about two weeks ago. Once the
server is rebooted the error goes away for the remainder
of the day until the next morning when it reappears. Any
suggestions on a fix for this?

Reply to this Message

anonymous@discussions.microsoft.com - 11 May 2004 16:57 GMT

I am having the same problem with one of my servers...

any solutions?

>-----Original Message-----
>I have a client that whe she arrives in the morning the
[quoted text clipped - 6 lines]
>suggestions on a fix for this?
>.

Reply to this Message

Jeff Cochran - 11 May 2004 21:51 GMT

>I am having the same problem with one of my servers...
>
>any solutions?

Event log errors, including ID's and source?

Jeff

>>-----Original Message-----
>>I have a client that whe she arrives in the morning the
[quoted text clipped - 7 lines]
>>suggestions on a fix for this?
>>.

Reply to this Message

Juergen Helbing - 01 Jun 2004 14:06 GMT

>I have a client that whe she arrives in the morning the
>following error message appears: An application error has
>occured. DNS.exe Exception: access violation.
>The server has sp6 installed.

Same situation here.
I'm wondering that this is not discussed anywhere else.

>This just started to occur about two weeks ago. Once the
>server is rebooted the error goes away for the remainder
>of the day until the next morning when it reappears. Any
>suggestions on a fix for this?

I'm having no idea how to fix this.

But I'm having an idea where it comes from:
A 'spam' program seems to contact all kind of demons
on all kind of ports and is sending a "POST" http command
which includes also a spam eMail message.
This is a very long 'command' (>1000 bytes) and I've
seen this 'command' in the error-logs of my web/mail/news-server.
This started the same time when my DNS server began to
encounter periodically shutdowns as you've described (access violation)
some weeks ago.

This could be a buffer overflow problem of the Microsoft DNS server.
And because just a few hobby admins - as myself - who did never
update their Win/NT-servers since '95 are having this problem
(because everybody did switch to W2K or W2K3 - or uses WinBind :-)
it might not be seriously traced or notified.

If anybody has info whether DNS.EXE has got a fix since SP6
(which is also installed together with the Blaster Fix on my server)
then I'd be happy to learn about it.
However it seems time to shutdown that old dog and replace it by
a new LINUX+BIND+APACHE. A DNS server which does not
operate properly and is no longer supported nor can be fixed
has no right to exist and longer. And purchasing a W2K or W2K3
server to fix the problem is not appropriate (for myself).

So long

Signature

Juergen Helbing, [The Archiver]
----------------------------------------------------
www.yenc.org
www.winews.net

Reply to this Message

Juergen Helbing - 04 Jun 2004 20:45 GMT

>>I have a client that whe she arrives in the morning the
>>following error message appears: An application error has
[quoted text clipped - 3 lines]
>Same situation here.
>I'm wondering that this is not discussed anywhere else.

Update:

It is not very polite to answer to myself - but there is new
info which might help other admins or those who are seeking
by Google:

It seems that ServicePack-6 is not a cumulative service pack
for an NT-Server. So if someone installs a fresh NT4.0 server
and applies _only_ SP6 then the DNS.EXE seems to be still
the 'old' one.
My 'original' version of DNS.EXE was dated 09.Aug.96
The version on another of my NT servers is: 19.Nov.99

For me the hot-fix was pretty simple: I've copied the newer
DNS.EXE to my new NT-server installation.
Since then no more GPF happened for some days now.
(And those wierd port-attacks are still there).

Perhaps it could be recommended to apply first SP4 (which is
a fully cumulative path) , then SP6, then the Blaster Immunity
and the Sasser Immunity patches.
Then an NT4 server could live some more weeks :-))

If I'm wrong then correction are welcome.
Else: Good luck with our NT4 servers.

So long

Signature

Juergen Helbing

Reply to this Message