W3SVC Warning question

TechJosh

unread,

Apr 6, 2004, 9:12:39 AM4/6/04

to

I receive the following Warning in my System Log several times a day:

Event ID: 30
Source: W3SVC
Type: Warning
Category: None
Description: The server was unable to read the file
C:\WINNT\help\common\404b.htm. The file does not exist.

I checked that path, and I do not have any .HTM files in the specified
path. I know a 404b is when a requested URL is not found, but I've
run a link-checker on my website to ensure that all links work. The
suspicious thing is, I receive this error on several servers, all
running IIS or WWW services, but some not actually serving up webpages
to people. It appears someone is trying to exploit an NT
vulnerability or gain access to my server. Any suggestions?

Carroll P. MacDonald

unread,

Apr 6, 2004, 11:38:46 PM4/6/04

to

Create the file 404b.html and put it where it is causing the error to
occur... simple as that. Be creative and say something about the URL that
was not found. This file is used for all "Links" not found, such as a user
types in a page that he/she believes should be in a folder (such as:
picture_2.html or any other file) on the server and come to find out there
is no such file the server will quickly look for the 404b file, but when
it's not found an error is then posted in your log file when it is not
found.

--

Regards,

Carroll P. MacDonald

TechJosh

unread,

Apr 7, 2004, 8:51:51 AM4/7/04

to

That solves the error message, but is only a workaround to the real
problem. I want to know how I can find out who's accessing these
servers looking for .HTML files. As I said, I have servers running
WWW services that aren't actually serving up websites, and I want to
know why I'm getting this message on those servers.

Deeps

unread,

Apr 8, 2004, 8:26:39 AM4/8/04

to

Look in the IIS logs.. there will be IP addresses and what they tried to
access.
You can also lock down any websites (like the default) to deny all IP
Addresses.

"TechJosh" <jo...@abswebb.net> wrote in message
news:ca9247b9.04040...@posting.google.com...

TechJosh

unread,

Apr 9, 2004, 11:43:38 AM4/9/04

to

Being that I'm a newbie at IIS, could you point me in the right direction?

"Deeps" <som...@microsoft.com> wrote in message news:<3ybdc.796$l75...@newsread2.news.atl.earthlink.net>...

Deeps

unread,

Apr 9, 2004, 12:51:29 PM4/9/04

to

If you have not done any custom configuration.. then they should be in:
C:\WINNT\system32\LogFiles\W3SVC1

That is for the default web.. any other websites will be in W3SVCx where x
is the instance number.

"TechJosh" <jo...@abswebb.net> wrote in message
news:ca9247b9.04040...@posting.google.com...

jmarquiz

unread,

Apr 26, 2004, 8:13:29 PM4/26/04

to

TechJosh wrote:
> *Being that I'm a newbie at IIS, could you point me in the right

> > Addresses. *

>c$\WINNT\system32\LogFiles heres the location and make sure >your
loging all you pages you might need to load microsofts
>"lockdown tool for iis" this will help
the log will look like this ex040426.log
> Addresses. [/B]

--
jmarquiz
------------------------------------------------------------------------
Posted via http://www.webservertalk.com
------------------------------------------------------------------------
View this thread: http://www.webservertalk.com/message173654.html