Re: error 12560 causing webservices slowdown

From: Roy M <RXMiller_at_gmail.com>
Date: 9 Mar 2006 12:23:59 -0800
Message-ID: <1141935839.582786.88330@z34g2000cwc.googlegroups.com>

Thank you Frank, that's very useful

> NOTE: in all logs we just replaced real host names with XXXX
this is just paranoid me. I hope it doesn't offend you!

I am not getting it only from my ColdFusion environment, As you can see below I am also getting the error from inetinfo.exe

---

Fatal NI connect error 12560, connecting to:

(DESCRIPTION=(ADDRESS=(PROTOCOL=BEQ)(PROGRAM=oracle)(ARGV0=oracleORCL)(ARGS='(DESCRIPTION=(LOCAL=YES)(ADDRESS=(PROTOCOL=beq)))'))(CONNECT_DATA=(SID=ORCL)(CID=(PROGRAM=C:\WINNT\System32\inetsrv\inetinfo.exe)(HOST=XXXXXX)(USER=SYSTEM))))

  VERSION INFORMATION:

	TNS for 32-bit Windows: Version 8.1.7.0.0 - Production
	Oracle Bequeath NT Protocol Adapter for 32-bit Windows: Version
8.1.7.0.0 - Production
	Windows NT TCP/IP NT Protocol Adapter for 32-bit Windows: Version

8.1.7.0.0 - Production
  Time: 08-MAR-2006 13:34:09
....
....

---

if I understand correctly BEQ is meant to use locally, so any calls to BEQ cannot be originated from our programs. there is no DB installed at our web servers! so does it mean its a hack, spyware, etc. trying to access the DB using def values? would that explain why the web server "chokes" when it happens? also, why does it happen to most web servers simultaneously?

do you have any knowledge on specific malware that works like that?

our IIS seettings declare the user to run our pages, so the SYSTEM does not seem to be from our application either

is there any other direction we should be looking at?

thanks again,

Roy Received on Thu Mar 09 2006 - 14:23:59 CST