RE: Critical Problem - Connection down - Please advice
- From: "Thomas W Shinder" <tshinder@xxxxxxxxxxxxxxxxxx>
- To: "[ISAserver.org Discussion List]" <isalist@xxxxxxxxxxxxx>
- Date: Tue, 26 Aug 2003 19:51:04 -0500
Hi Ahmed,
Sounds like the Welchia worm to me.
HTH,
Tom
Thomas W Shinder
www.isaserver.org/shinder
ISA Server and Beyond: http://tinyurl.com/1jq1
Configuring ISA Server: http://tinyurl.com/1llp
-----Original Message-----
From: Nabil, Ahmed [mailto:anmahmou@xxxxxxxxxx]
Sent: Monday, August 25, 2003 5:36 AM
To: [ISAserver.org Discussion List]
Subject: [isalist] RE: Critical Problem - Connection down - Please
advice
http://www.ISAserver.org
I disconnected the local NIC (Internal) cable from the ISA server and
everything went fine. The task manager performance dropped to 2% and the
Internet is connected !!!!!!!!!!!!!
Is that a kind of virus on the Internal LAN ??
Please advice,
Ahmed
-----Original Message-----
From: Nabil, Ahmed
Sent: Monday, August 25, 2003 9:16 AM
To: [ISAserver.org Discussion List]
Subject: [isalist] Critical Problem - Connection down - Please advice
Importance: High
http://www.ISAserver.org
Hello Everyone,
Just to give you an overview of my ISA architecture. The ISA External
Interface NIC is connected to the Firewall which in turn is connected to
our ISP.
The Problem is that we are not able to connect to the Internet, The
problem is for sure with the ISA, I inserted a Laptop between the ISA
and the Firewall (Bypassing the ISA) and I connected fine to the
Internet.
Actually the connection isn't totally down, When I start to ping the ISA
external Interface from my client machine or to ping for example
www.yahoo.com I get a reply for my ping and then the Time (TTL) starts
to increase till it reach 1000ms then REQUEST TIME OUT message appear.
This happens for another 5-10 minutes then a reply once again come back
for another 2-5 minutes then TTL increase again and the same loop goes
on.
When I check the ISA server Task manager, thats the strange part, the
Performance is 100% CPU Usage and when I check the Process, I find few
process (CSRSS, Winlogon, rdpclip, shstat, wzqkpick, hkcmd,
controldGUI.......etc) and each of them is showing 0% CPU
!!!!!!!!!!!!!!!!!!
I tried to clear the cache several times and I restarted the computer
many times and when its up, it works fine for few minutes then the loop
starts.
Now the CPU Usage is 100% and I don't have another choice but to restart
the ISA.
Please advice,
Thanks in advance for your help,
Ahmed
------------------------------------------------------
List Archives: http://www.webelists.com/cgi/lyris.pl?enter=isalist
ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp
ISA Server FAQ: http://www.isaserver.org/pages/larticle.asp?type=FAQ
------------------------------------------------------
Other Internet Software Marketing Sites:
Leading Network Software Directory: http://www.serverfiles.com
No.1 Exchange Server Resource Site: http://www.msexchange.org
Windows Security Resource Site: http://www.windowsecurity.com/
Network Security Library: http://www.secinf.net/
Windows 2000/NT Fax Solutions: http://www.ntfaxfaq.com
------------------------------------------------------
You are currently subscribed to this ISAserver.org Discussion List as:
anmahmou@xxxxxxxxxx
To unsubscribe send a blank email to $subst('Email.Unsub')
------------------------------------------------------
List Archives: http://www.webelists.com/cgi/lyris.pl?enter=isalist
ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp
ISA Server FAQ: http://www.isaserver.org/pages/larticle.asp?type=FAQ
------------------------------------------------------
Other Internet Software Marketing Sites:
Leading Network Software Directory: http://www.serverfiles.com
No.1 Exchange Server Resource Site: http://www.msexchange.org
Windows Security Resource Site: http://www.windowsecurity.com/
Network Security Library: http://www.secinf.net/
Windows 2000/NT Fax Solutions: http://www.ntfaxfaq.com
------------------------------------------------------
You are currently subscribed to this ISAserver.org Discussion List as:
tshinder@xxxxxxxxxxxxxxxxxx
To unsubscribe send a blank email to $subst('Email.Unsub')
Other related posts:
