Something"s fishy going on: dead server & no log messages

I have an interesting problem. First, my Cygwin binary distribution of
Apache 1.3.22, ater 5 years has STOPPED RESPONDING. No errors to log
and No Web Service.

This all started by my computer get infecting by 2 Trojan Horses
viruses. The OS disk partition was copied and a virus scanner was
executed on the copy to clean it out. A decision was made to avoid a
lot of wait time by letting my son download from MS a copy of Windows XP
Pro,that included all changes up to SP3. Using this MS download CD,
most everything was restored to service with the exception of Apache.
It acts like it has not ever been started except for the normal
error_log messages present with start/stop.

QUESTION:
I know this is going to be a strange request: Has anyone had a
experience with the OS download possibly blocking port 80. The OS
download was a special subscription service from MS. Since I have my
own hardware firewall, the Windows Firewall is turned off as well as
ICS. My son, the MS experience, is quite suspicious of Apache and/or
Cygwin but is offering little help at this time. In fact he wanted me
to briefly upgrade to MS IIS!!! (no way)
I'm running on Cygwin 1.7 and Apache has worked flawlessly for about 5
years as well as Apache 1.3 22. I firmly believe: If it's working,
don't touch it.
Well I touched it. I upgraded to Apache 1.3.41 binary distribution.
The results EXACTLY the same: dead to.

------------------------------------------------------------ ---------
The official User-To-User support forum of the Apache HTTP Server Project.
See for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org

Re: Something"s fishy going on: dead server & no log

On Sat, Jan 30, 2010 at 3:41 PM, Paul McFerrin
wrote:
> I have an interesting problem. =A0First, my Cygwin binary distribution of
> Apache 1.3.22, ater 5 years has STOPPED RESPONDING. =A0No errors to log a=
nd No
> Web Service.
>

Event viewer? Does it work if you remove third-party modules like PHP?

Any extra feedback when you start it in the foreground and not as a service

--=20
Eric Covener
covener@gmail.com

------------------------------------------------------------ ---------
The official User-To-User support forum of the Apache HTTP Server Project.
See for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org

Re: Something"s fishy going on: dead server & no log messages

--------------------------------------------------
From: "Paul McFerrin"
Sent: 30 January, 2010 20:41
To:
Subject: [users@httpd] Something's fishy going on: dead server & no log messages

> I have an interesting problem. First, my Cygwin binary distribution of Apache
> 1.3.22, ater 5 years has STOPPED RESPONDING. No errors to log and No Web
> Service.
>
> This all started by my computer get infecting by 2 Trojan Horses viruses. The
> OS disk partition was copied and a virus scanner was executed on the copy to
> clean it out. A decision was made to avoid a lot of wait time by letting my
> son download from MS a copy of Windows XP Pro,that included all changes up to
> SP3. Using this MS download CD, most everything was restored to service with
> the exception of Apache. It acts like it has not ever been started except for
> the normal error_log messages present with start/stop.
>
> QUESTION:
> I know this is going to be a strange request: Has anyone had a experience
> with the OS download possibly blocking port 80. The OS download was a special
> subscription service from MS. Since I have my own hardware firewall, the
> Windows Firewall is turned off as well as ICS. My son, the MS experience, is
> quite suspicious of Apache and/or Cygwin but is offering little help at this
> time. In fact he wanted me to briefly upgrade to MS IIS!!! (no way)
> I'm running on Cygwin 1.7 and Apache has worked flawlessly for about 5 years
> as well as Apache 1.3 22. I firmly believe: If it's working, don't touch it.
> Well I touched it. I upgraded to Apache 1.3.41 binary distribution. The
> results EXACTLY the same: dead to.
>
> ------------------------------------------------------------ ---------
> The official User-To-User support forum of the Apache HTTP Server Project.
> See for more info.
> To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
> " from the digest: users-digest-unsubscribe@httpd.apache.org
> For additional commands, e-mail: users-help@httpd.apache.org
>

Paul,

First of all I would check to see if you can bring up your site by typing in
http://localhost or http://internalprivatelanip your external IP address is
forwarded to the correct internal private lan IP address like so:

External IP:80 > Firewall > Internal IP:80

Second thing I would try is to verify that the windows firewall is in fact
disabled, and all security applications are disabled.

Third, how did you get infected if you have a good hardware firewall
configured? Obviously you would have all all outbound allowed, and only select
services like http allowed in. This would prevent malicious people from
connecting to your machine. And call backs from being allowed.

Finally, how did you install Windows XP Pro, did you reformat the drive and
start anew then applied all updates, and installed all your applications? If
you just installed over your copy of XP, then you may have gotten infected
again. I would try scanning with http://www.malwarebytes.org/mbam.php.

I notice you use Road Runner as your ISP, are you a business subscriber or a
residential one? If the latter, then road runner may have blocked port 80 for
you since residential account subscribers are not allowed to run servers.

Thanks,
Daniel


------------------------------------------------------------ ---------
The official User-To-User support forum of the Apache HTTP Server Project.
See for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org

Re: Something"s fishy going on: dead server & no log messages

Good points. Why did I not think of this. First, I have always started
it in the foreground and never as a real service.
As for event viewer most are errors that I have caused with MSI. Here
is one error for HTTP:
HTTP namespace reservations are not installed.

No help is available and I certainly don't know what that means....
More messages:
HttpHandlers node *.svc does not exist in System.Web section group.
HttpModules node ServiceModel does not exist in System.Web section group.

All of the above messages are WARNINGS. Do any have any effects on me.




Other messages:
All compilation assembly nodes do not exist in System.Web section group.


Eric Covener wrote:
> On Sat, Jan 30, 2010 at 3:41 PM, Paul McFerrin
> wrote:
>
>> I have an interesting problem. First, my Cygwin binary distribution of
>> Apache 1.3.22, ater 5 years has STOPPED RESPONDING. No errors to log and No
>> Web Service.
>>
>>
>
> Event viewer? Does it work if you remove third-party modules like PHP?
>
> Any extra feedback when you start it in the foreground and not as a service
>
>
> ------------------------------------------------------------ ------------
>
>
> No virus found in this incoming message.
> Checked by AVG - www.avg.com
> Version: 8.5.432 / Virus Database: 271.1.1/2657 - Release Date: 01/30/10 07:35:00
>
>


------------------------------------------------------------ ---------
The official User-To-User support forum of the Apache HTTP Server Project.
See for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org

Re: Something"s fishy going on: dead server & no logmessages

Wow, my base site at http://localhost works !!!
Second: windows firewall is in fact disabled.
Third: infection due to unsafe surfing which is history now.
Fourth: To reload. Complete Installation including FORMAT from a XP Pro
CD that included all of the updates thru SP3 on one CD. Everything else
reinstalled from disk copies I've kept over the years. No further updates.

Service: Residential. This is very low traffic. My email and download
traffic is considerable more. TIMING COINCIDENCE??? Maybe. I hate to
contact them and raise their level of suspicion.

Daniel Reinhardt wrote:
>
> --------------------------------------------------
>
> Paul,
>
> First of all I would check to see if you can bring up your site by
> typing in http://localhost or http://internalprivatelanip your
> external IP address is forwarded to the correct internal private lan
> IP address like so:
>
> External IP:80 > Firewall > Internal IP:80
>
> Second thing I would try is to verify that the windows firewall is in
> fact disabled, and all security applications are disabled.
>
> Third, how did you get infected if you have a good hardware firewall
> configured? Obviously you would have all all outbound allowed, and
> only select services like http allowed in. This would prevent
> malicious people from connecting to your machine. And call backs from
> being allowed.
>
> Finally, how did you install Windows XP Pro, did you reformat the
> drive and start anew then applied all updates, and installed all your
> applications? If you just installed over your copy of XP, then you
> may have gotten infected again. I would try scanning with
> http://www.malwarebytes.org/mbam.php.
>
> I notice you use Road Runner as your ISP, are you a business
> subscriber or a residential one? If the latter, then road runner may
> have blocked port 80 for you since residential account subscribers are
> not allowed to run servers.
>
> Thanks,
> Daniel
>
> ------------------------------------------------------------ ---------
> The official User-To-User support forum of the Apache HTTP Server
> Project.
> See for more info.
> To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
> " from the digest: users-digest-unsubscribe@httpd.apache.org
> For additional commands, e-mail: users-help@httpd.apache.org
> ------------------------------------------------------------ ------------
>
>
> No virus found in this incoming message.
> Checked by AVG - www.avg.com
> Version: 8.5.432 / Virus Database: 271.1.1/2657 - Release Date: 01/30/10 07:35:00
>
>

------------------------------------------------------------ ---------
The official User-To-User support forum of the Apache HTTP Server Project.
See for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org

Re: Something"s fishy going on: dead server & no logmessages

Well I think I need to contact RoadRunner. It looks like they are
blocking port 80. From another PC connected to the same router, I can
access my webpage usinging my locally assigned IP address in a browser
window. Does it sound like this assumption is correct?

My web site is for my family genealogy information. Why should I pay
more money when I'm truly not a business customer?

Paul McFerrin wrote:
> Wow, my base site at http://localhost works !!!
> Second: windows firewall is in fact disabled.
> Third: infection due to unsafe surfing which is history now.
> Fourth: To reload. Complete Installation including FORMAT from a XP
> Pro CD that included all of the updates thru SP3 on one CD.
> Everything else reinstalled from disk copies I've kept over the
> years. No further updates.
>
> Service: Residential. This is very low traffic. My email and
> download traffic is considerable more. TIMING COINCIDENCE??? Maybe.
> I hate to contact them and raise their level of suspicion.
>
> Daniel Reinhardt wrote:
>>
>> --------------------------------------------------
>>
>> Paul,
>>
>> First of all I would check to see if you can bring up your site by
>> typing in http://localhost or http://internalprivatelanip your
>> external IP address is forwarded to the correct internal private lan
>> IP address like so:
>>
>> External IP:80 > Firewall > Internal IP:80
>>
>> Second thing I would try is to verify that the windows firewall is in
>> fact disabled, and all security applications are disabled.
>>
>> Third, how did you get infected if you have a good hardware firewall
>> configured? Obviously you would have all all outbound allowed, and
>> only select services like http allowed in. This would prevent
>> malicious people from connecting to your machine. And call backs
>> from being allowed.
>>
>> Finally, how did you install Windows XP Pro, did you reformat the
>> drive and start anew then applied all updates, and installed all your
>> applications? If you just installed over your copy of XP, then you
>> may have gotten infected again. I would try scanning with
>> http://www.malwarebytes.org/mbam.php.
>>
>> I notice you use Road Runner as your ISP, are you a business
>> subscriber or a residential one? If the latter, then road runner may
>> have blocked port 80 for you since residential account subscribers
>> are not allowed to run servers.
>>
>> Thanks,
>> Daniel
>>
>> ------------------------------------------------------------ ---------
>> The official User-To-User support forum of the Apache HTTP Server
>> Project.
>> See for more info.
>> To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
>> " from the digest: users-digest-unsubscribe@httpd.apache.org
>> For additional commands, e-mail: users-help@httpd.apache.org
>> ------------------------------------------------------------ ------------
>>
>>
>> No virus found in this incoming message.
>> Checked by AVG - www.avg.com Version: 8.5.432 / Virus Database:
>> 271.1.1/2657 - Release Date: 01/30/10 07:35:00
>>
>>
>
> ------------------------------------------------------------ ---------
> The official User-To-User support forum of the Apache HTTP Server
> Project.
> See for more info.
> To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
> " from the digest: users-digest-unsubscribe@httpd.apache.org
> For additional commands, e-mail: users-help@httpd.apache.org
> ------------------------------------------------------------ ------------
>
>
> No virus found in this incoming message.
> Checked by AVG - www.avg.com
> Version: 8.5.432 / Virus Database: 271.1.1/2657 - Release Date: 01/30/10 07:35:00
>
>


------------------------------------------------------------ ---------
The official User-To-User support forum of the Apache HTTP Server Project.
See for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org

Re: Something"s fishy going on: dead server & no logmessages

Paul McFerrin wrote:
> Wow, my base site at http://localhost works !!!
> Second: windows firewall is in fact disabled.
> Third: infection due to unsafe surfing which is history now.
> Fourth: To reload. Complete Installation including FORMAT from a XP Pro
> CD that included all of the updates thru SP3 on one CD. Everything else
> reinstalled from disk copies I've kept over the years. No further updates.
>
> Service: Residential. This is very low traffic. My email and download
> traffic is considerable more. TIMING COINCIDENCE??? Maybe. I hate to
> contact them and raise their level of suspicion.

i doubt time warner is blocking anything but mail transfer ports. ive
been running 3 sites from a residential account for over 5 years with no
problems. (im definately not using windows though, bsd and linux) you
have your router and port forwarding 80 to the internal ip of your
apache install working properly?

steve


------------------------------------------------------------ ---------
The official User-To-User support forum of the Apache HTTP Server Project.
See for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org

Re: Something"s fishy going on: dead server & no log

--0016e6d783fc9adc60047e6b03a6
Content-Type: text/plain; charset=ISO-8859-1

Some things that come to mind:
1. Is your router properly configured for port forwarding?
2. is the service you are using to do host redirection properly configured?
3. is the machine name & domain name you chose for your 'new' installation
the same name as you specified on your hosting service?
4. Are you doing virtual hosting? are the names set up correctly and in the
right order?
5. Having not set apache up on the windoz machine, any chance you had to
modify the hosts or lmhosts file, and need to do that to the new copy of xp?

Hmmm...all out of ideas...
Good luck
John


On Sat, Jan 30, 2010 at 5:46 PM, steve reilly wrote:

> Paul McFerrin wrote:
>
>> Wow, my base site at http://localhost works !!!
>> Second: windows firewall is in fact disabled.
>> Third: infection due to unsafe surfing which is history now.
>> Fourth: To reload. Complete Installation including FORMAT from a XP Pro
>> CD that included all of the updates thru SP3 on one CD. Everything else
>> reinstalled from disk copies I've kept over the years. No further updates.
>>
>> Service: Residential. This is very low traffic. My email and download
>> traffic is considerable more. TIMING COINCIDENCE??? Maybe. I hate to
>> contact them and raise their level of suspicion.
>>
>
> i doubt time warner is blocking anything but mail transfer ports. ive been
> running 3 sites from a residential account for over 5 years with no
> problems. (im definately not using windows though, bsd and linux) you have
> your router and port forwarding 80 to the internal ip of your apache install
> working properly?
>
> steve
>
>
>
> ------------------------------------------------------------ ---------
> The official User-To-User support forum of the Apache HTTP Server Project.
> See for more info.
> To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
> " from the digest: users-digest-unsubscribe@httpd.apache.org
> For additional commands, e-mail: users-help@httpd.apache.org
>
>

--0016e6d783fc9adc60047e6b03a6
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

Some things that come to mind:
1. Is your router properly configured for=
port forwarding?
2. is the service you are using to do host redirection=
properly configured?
3. is the machine name & domain name you chos=
e for your 'new' installation the same name as you specified on you=
r hosting service?

4. Are you doing virtual hosting?=A0 are the names set up correctly and in =
the right order?
5. Having not set apache up on the windoz machine, any =
chance you had to modify the hosts or lmhosts file, and need to do that to =
the new copy of xp?


Hmmm...all out of ideas...
Good luck
John

Re: Something"s fishy going on: dead server & no log messages

John Hudak wrote:
> Some things that come to mind:
> 1. Is your router properly configured for port forwarding?
> 2. is the service you are using to do host redirection properly
> configured?

I already found the problem. I used my son to do the initial load of
the OS and knew nothing of how the router was setup. Port forwarding
only works correctly on static IP addressing. He had chosen DHCP, not
fully understanding the needs. Just a communications error.
> 3. is the machine name & domain name you chose for your 'new'
> installation the same name as you specified on your hosting service?
> 4. Are you doing virtual hosting? are the names set up correctly and
> in the right order?
> 5. Having not set apache up on the windoz machine, any chance you had
> to modify the hosts or lmhosts file, and need to do that to the new
> copy of xp?
>
> Hmmm...all out of ideas...
> Good luck
> John
>
>
> On Sat, Jan 30, 2010 at 5:46 PM, steve reilly > > wrote:
>
> Paul McFerrin wrote:
>
> Wow, my base site at http://localhost works !!!
> Second: windows firewall is in fact disabled.
> Third: infection due to unsafe surfing which is history now.
> Fourth: To reload. Complete Installation including FORMAT
> from a XP Pro CD that included all of the updates thru SP3 on
> one CD. Everything else reinstalled from disk copies I've
> kept over the years. No further updates.
>
> Service: Residential. This is very low traffic. My email and
> download traffic is considerable more. TIMING COINCIDENCE???
> Maybe. I hate to contact them and raise their level of suspicion.
>
>
> i doubt time warner is blocking anything but mail transfer ports.
> ive been running 3 sites from a residential account for over 5
> years with no problems. (im definately not using windows though,
> bsd and linux) you have your router and port forwarding 80 to the
> internal ip of your apache install working properly?
>
> steve
>
>
>
> ------------------------------------------------------------ ---------
> The official User-To-User support forum of the Apache HTTP Server
> Project.
> See for more info.
> To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
>
> " from the digest: users-digest-unsubscribe@httpd.apache.org
>
> For additional commands, e-mail: users-help@httpd.apache.org
>
>
>
> ------------------------------------------------------------ ------------
>
>
> No virus found in this incoming message.
> Checked by AVG - www.avg.com
> Version: 8.5.432 / Virus Database: 271.1.1/2657 - Release Date: 01/30/10 07:35:00
>
>


------------------------------------------------------------ ---------
The official User-To-User support forum of the Apache HTTP Server Project.
See for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org

Re: Something"s fishy going on: dead server & no log messages

Paul McFerrin wrote:
> John Hudak wrote:
>> Some things that come to mind:
>> 1. Is your router properly configured for port forwarding?
>> 2. is the service you are using to do host redirection properly
>> configured?
>
> I already found the problem. I used my son to do the initial load of
> the OS and knew nothing of how the router was setup. Port forwarding
> only works correctly on static IP addressing. He had chosen DHCP, not
> fully understanding the needs. Just a communications error.


Yep, that would do it! Glad you found it pretty quickly...

--
73
-------------------------------------
Jim Walls - K6CCC
jim@k6ccc.org
Ofc: 818-548-4804
http://home.earthlink.net/~k6ccc
AMSAT Member 32537 - WSWSS Member 395


------------------------------------------------------------ ---------
The official User-To-User support forum of the Apache HTTP Server Project.
See for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org