FIX: The Inetinfo.exe process stops responding when you configure Web sites to use host headers in IIS 5 (899472)

SYMPTOMS

When you configure multiple Web sites that are hosted on Microsoft Internet Information Services (IIS) 5 to use host headers, the Inetinfo.exe process may return an access violation. This behavior occurs when the following conditions are true:

Global ISAPI filters are loaded at the server level.
At least one Web site level ISAPI filter is loaded for a Web site.

When this behavior occurs, you may experience different symptoms and error messages depending on the request conditions and the ISAPI filter that is loaded. For example, you may receive an error message in the System log that is similar to one of the following error messages:

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7031
Date: 7/18/2005
Time: 7:37:43 PM
User: N/A
Computer: EWEB20
Description: The IIS Admin Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 1 milliseconds: Run the configured recovery program.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7031
Date: 7/18/2005
Time: 7:37:43 PM
User: N/A
Computer: EWEB20
Description: The FTP Publishing Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 0 milliseconds: No action.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7031
Date: 7/18/2005
Time: 7:37:43 PM
User: N/A
Computer: EWEB20
Description: The World Wide Web Publishing Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.

Event Type: Information
Event Source: IISCTLS
Event Category: None
Event ID: 2
Date: 7/18/2005
Time: 7:37:44 PM
User: N/A
Computer: EWEB20
Description: IIS stop command received from user NT AUTHORITY\SYSTEM. The logged data is the status code.

Event Type: Information
Event Source: IISCTLS
Event Category: None
Event ID: 1
Date: 7/18/2005
Time: 7:37:59 PM
User: N/A
Computer: EWEB20
Description: IIS start command received from user NT AUTHORITY\SYSTEM. The logged data is the status code.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7032
Date: 7/18/2005
Time: 7:38:43 PM
User: N/A
Computer: EWEB20
Description: The Service Control Manager tried to take a corrective action (Restart the service) after the unexpected termination of the World Wide Web Publishing Service service, but this action failed with the following error: An instance of the service is already running.

CAUSE

This problem occurs when the wrong context pointer is passed to an ISAPI filter. ISAPI filters provide a context to IIS. IIS uses this context for subsequent notifications over the same connection. The ISAPI filter then saves a pointer to the context. The mechanism that IIS uses to store the context pointers assumes that the list of installed ISAPI filters is the same for all requests over a connection.

When the Web server is configured to use HTTP Keep-Alives and host headers, the Web server may receive multiple requests for different sites over the same connection. When this behavior occurs, the wrong context pointer may be passed to the ISAPI filter when both global and Web site level ISAPI filters are installed.

RESOLUTION

Hotfix information

A supported hotfix is now available from Microsoft, but it is only intended to correct the problem that this article describes. Apply it only to systems that are experiencing this specific problem.

To resolve this problem, contact Microsoft Product Support Services to obtain the hotfix. For a complete list of Microsoft Product Support Services telephone numbers and information about support costs, visit the following Microsoft Web site:

http://support.microsoft.com/contactus/?ws=support

Note In special cases, charges that are ordinarily incurred for support calls may be canceled if a Microsoft Support Professional determines that a specific update will resolve your problem. The usual support costs will apply to additional support questions and issues that do not qualify for the specific update in question.

Prerequisites

No prerequisites are required.

Restart requirement

You must restart the computer after you apply this hotfix. If you do not want to restart the computer, use the iisreset /stop command to stop all IIS services before you apply this hotfix.

Hotfix replacement information

This hotfix does not replace any other hotfixes.

File information

The English version of this hotfix has the file attributes (or later file attributes) that are listed in the following table. The dates and times for these files are listed in Coordinated Universal Time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time tool in Control Panel.

  Date         Time   Version	     Size     File name
  -----------------------------------------------------   
  25-Jul-2005  05:28  5.0.2195.7061  350,480  W3svc.dll

MORE INFORMATION

This problem may also occur when multiple ISAPI filters that have different priorities are loaded at the Web site level. For example, the Md5filt.dll file is the Digest Authentication filter in IIS. By default, the Md5filt.dll file is installed and is loaded at a low priority. If another ISAPI filter such as Macromedia JRun is installed and loads at a higher priority than the Md5filt.dll file, you may experience this problem.

When you troubleshoot this example scenario, the Md5filt.dll file or the Jrun.dll file may incorrectly appear to cause the problem.