IISadmin service unable to start after a crypto attack on 2008R2/Exchange 2010 server RRS feed

  • Question

  • User-301619146 posted


    We are facing a problem. A crypto locked several folders on a WS 2008R2 with Exchange 2010 server. It has encrypted the inetpub folder. And some folders within "program" and "program files" including the Exchange MDBs ! It has left c:\Windows intact and untouched. We have restored the Exchange MDBs and repaired them because left in "Dirty shutdown" after the restoration. We restored the "c:\Inetpub" folder. The Exchange MDB are mounted and work fine. But the IISadmin service is not able to start : ID7023 in log event : The IIS Admin Service service stopped with the error: An internal error occurred (1359) ???

    Any idea ?

    Thanx for your help.

    Wednesday, March 7, 2018 8:28 PM

All replies

  • User-460007017 posted

    Hi suppportexec,

    IIS Admin service is mainly used for administrator to read metabase for SMTP and FTP. So I think maybe the data recovery didn't recover the whole IIS metabase.  So Please try to reinstall the IIS FTP and SMTP/IIS6 compatitive related feature. Or you could try to backup the application and reinstall the whole IIS and windows process activation service.

    Best Regards,

    Yuk Ding

    Thursday, March 8, 2018 8:24 AM
  • User-301619146 posted

    Many thanks for your reply !

    But I am sceptical as the c:\windows and therefore the "inetsrv" folder (IIS metabase repository) has not been restored because not encrypted. 

    Reinstalling IIS 7 is an option but it will break Exchange Server and maybe bring more problems than solutions, I'm afraid !

    Thanx anyway ;-)

    Thursday, March 8, 2018 9:00 AM