Problem :
Module IsapiModule
Notification ExecuteRequestHandler
Handler ASPClassic
Error Code 0x800700aa
Requested URL http://localhost/New_Site/Default.asp
Physical Path C:\inetpub\wwwroot\New_Site\Default.asp
Logon Method Anonymous
Logon User Anonymous
After you successfully remove VSE, the system reports the following error:
Procmon shows that when a VBScript is executed on this server, instead of calling the VBScript Driver vbscript.dll, it continues to call the McAfee driver from:
c:\Program Files\Common Files\McAfee\SystemCore\ScriptSn.20110315093749.dll
Applet logs record the following errors related to VBScript after you use MFERemoval100.exe to remove VSE:
Some times you try to browse a simple ASP page (Legacy ASP) hosted on IIS 7.5 or IIS 8.5 and you run in to following Error :
Detailed Error InformationModule IsapiModule
Notification ExecuteRequestHandler
Handler ASPClassic
Error Code 0x800700aa
Requested URL http://localhost/New_Site/Default.asp
Physical Path C:\inetpub\wwwroot\New_Site\Default.asp
Logon Method Anonymous
Logon User Anonymous
You
try all the other options like Enabling 32 Bit, Changing AppPool
Pipeline mode to Classic, installing .net framework 1.1 or 2.0 but it
doesn't help.
Diagnose the Problem :
To
find the main reason of this problem you will need to run Process
Monitor and filter the logs to see only ProcMon Logs related to
w3Wp.exe.
While digging the logs, you may find some logs similar to following :
12:31:49.0797868 PM w3wp.exe 8264 CreateFile C:\Program Files\McAfee\VirusScan\scriptsn.dll PATH NOT FOUND
OR
12:31:49.0797868 PM w3wp.exe 8264 CreateFile C:\Program Files\McAfee\VirusScan\scriptsn.dll PATH NOT FOUND
Now the question is, why an asp file request is calling a .dll file which is related to to AntiVirus program.
Some times , when AntiVirus program is installed on your server or Updated , it add this DLL as part of there ScriptScan feature to intercept the script calls before they are executed on following Regresty Key :
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B54F3741-5B07-11cf-A4B0-00AA004A55E8}\InprocServer32
(Default) REG_SZ C:\Program Files\McAfee\VirusScan\scriptsn.dll
(Default) REG_SZ C:\Program Files\McAfee\VirusScan\scriptsn.dll
In normal Conditions, this Registry Key (CLSID - HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B54F3741-5B07-11cf-A4B0-00AA004A55E8}\InprocServer32 ) points to VBScript.dll but here it is pointing to C:\Program Files\McAfee\VirusScan\scriptsn.dll. And this is the reason, ASP files are not being
processed when requested.
After you successfully remove VSE, the system reports the following error:
The VBscript engine does not run any scripts on this machine
Some applications that utilize java script may not run properly
Some applications that utilize java script may not run properly
Procmon shows that when a VBScript is executed on this server, instead of calling the VBScript Driver vbscript.dll, it continues to call the McAfee driver from:
c:\Program Files\Common Files\McAfee\SystemCore\ScriptSn.20110315093749.dll
Applet logs record the following errors related to VBScript after you use MFERemoval100.exe to remove VSE:
<Part of Applet--2016.12.21--09.58.01--[MFERemoval100.exe].txt>
E Failed to set HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B54F3741-5B07-11cf-A4B0-00AA004A55E8}\InprocServer32 to C: \windows\SysWOW64\vbscript.dll
S C:\windows\SysWOW64\vbscript.dll was register.
E Failed to set HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B54F3741-5B07-11cf-A4B0-00AA004A55E8}\InprocServer32 to C:\windows\system32\vbscript.dll
S C:\windows\system32\vbscript.dll was register.
S HKEY_LOCAL_MACHINE\Wow6432Node\SOFTWARE\Classes\VBScript deleted.
E Failed to set HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B54F3741-5B07-11cf-A4B0-00AA004A55E8}\InprocServer32 to C: \windows\SysWOW64\vbscript.dll
S C:\windows\SysWOW64\vbscript.dll was register.
E Failed to set HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B54F3741-5B07-11cf-A4B0-00AA004A55E8}\InprocServer32 to C:\windows\system32\vbscript.dll
S C:\windows\system32\vbscript.dll was register.
S HKEY_LOCAL_MACHINE\Wow6432Node\SOFTWARE\Classes\VBScript deleted.
No comments:
Post a Comment