IIS的W3SVC服务由于性能记数器错而当机的解决办法

刚刚正在群里聊得起劲呢，朋友Q我说，近几天他有一台web服务器访问不是很快，而且一天当机一次，服务器系统资源占用消耗也并不是很大。当机时出现页面几乎打不开的情况。根据pathping 和tracert统计值每一个hop都不大，不存在time out的情况。重起IIS后，速度恢复，但过半天又当了。

因为这台服务器安全一直是我在负责，呵呵，应该不大可能出现被入侵的情况。于是上服务器：
查应用程序日志发现有警告信息如下：
事件类型: 警告
事件来源: Perflib
事件种类: 无
事件 ID: 2003
日期:  2005-11-18
事件:  20:49:08
用户:  N/A
计算机: SERVER00
描述:
"W3SVC" 服务的性能库 "C:WINDOWSsystem32inetsrvw3ctrs.dll" 的配置信息  同在注册表中保存的受信任性能库信息不匹 配。此库中的函数不会作为受信任函数处理。有关更多信息，请参阅在 http://go.microsoft.com/fwlink/events.asp 的帮助和支持中心。

呵呵，找到答案了，是性能记数据器在作怪，呵呵。再Search一下发现：

SYMPTOMSAfter you install Windows 2000 on a drive that uses the FAT or FAT32 file system (that was formatted during the installation process) and install Internet Information Services (IIS) in the same Setup process, event ID 2003 warning messages may appear in the Application event log when you start System Monitor and add counters. This issue does not occur with NTFS drives that do not have a service pack, if the FAT or FAT32 drive is formatted before you run Windows 2000 Setup, or if you add IIS later. The event ID 2003 warning message has the following text:
The configuration information of the performance library "C:/WINNT/system32/w3ctrs.dll" for the "W3SVC" service does not match the trusted performance library information stored in the registry. The functions in this library will not be treated as trusted.

The configuration information of the performance library "C:/WINNT/system32/infoctrs.dll" for the "InetInfo" service does not match the trusted performance library information stored in the registry. The functions in this library will not be treated as trusted.

The configuration information of the performance library "C:/WINNT/system32/aspperf.dll" for the "ASP" service does not match the trusted performance library information stored in the registry. The functions in this library will not be treated as trusted. RESOLUTIONTo resolve this problem, run the following commands at a command prompt in the %SystemRoot%/System32 folder to unload and reload the IIS performance dynamic-link libraries (DLLs). After you run these commands, the warning messages are not logged:

unlodctr w3svc
unlodctr msftpsvc
unlodctr asp
unlodctr inetinfo
lodctr w3ctrs.ini
lodctr ftpctrs.ini
lodctr axperf.ini
lodctr infoctrs.ini

将后面(红色部份)几条命令编辑成bat或者vbs批处理文件执行一次，网站访问速度迅速恢复。
后来要观察一天后，确定访问页面难以打开就是因为此问题所致；经过以后几天观察，服务器运行稳定。

本文作者:李泊林/Leebolin  Email:Leebolin#ServerSTeam.Org
来源:　服务器安全资源网　服务器安全讨论区
原始地址：http://www.31896.net/html/2005-11-28/2156224083.shtml
http://www.fineacer.org/SHtml/Article/4382.shtml