RE: Critical Problem - Connection down - Please advice

We use "Symantec Antivirus Filtering for Exchange 3.0", has been running good 
so far if setup correctly to stop sobig.f along with Symantec 8.1 Corp Edition.

Koie Smith
Nex-Tek, Inc.
Technical Support Team 

-----Original Message-----
From: John Tolmachoff (Lists) [mailto:johnlist@xxxxxxxxxxxxxxxxxxx]
Sent: Wednesday, August 27, 2003 11:27 AM
To: [ISAserver.org Discussion List]
Subject: [isalist] RE: Critical Problem - Connection down - Please
advice


http://www.ISAserver.org


No, normal AV software DOES NOT CHECK incoming and outgoing message through
Exchange. You need specific software for that.

John Tolmachoff MCSE CSSA
Engineer/Consultant
eServices For You
www.eservicesforyou.com


> -----Original Message-----
> From: Nabil, Ahmed [mailto:anmahmou@xxxxxxxxxx]
> Sent: Tuesday, August 26, 2003 11:44 PM
> To: [ISAserver.org Discussion List]
> Subject: [isalist] RE: Critical Problem - Connection down - Please advice
> 
> http://www.ISAserver.org
> 
> 
> Hi Tom,
> 
> I downloaded the Welchia fix from the Symantec Site and I am trying to
apply it in
> the logon script for all users. Yesterday I found some Sobig also in the
Exchange
> EDB which wasn't detected by normal antivirus !!!!!
> 
> What do you think ??
> 
> I am getting an error in the application log of the ISA server (userenv -
Windows
> can't determine the user or computer name)
> 
> Please advice,
> 
> Thanks alot for all of you for your help and support.
> 
> Ahmed
> 
> -----Original Message-----
> From: Thomas W Shinder [mailto:tshinder@xxxxxxxxxxxxxxxxxx]
> Sent: Wednesday, August 27, 2003 3:51 AM
> To: [ISAserver.org Discussion List]
> Subject: [isalist] RE: Critical Problem - Connection down - Please
> advice
> 
> 
> http://www.ISAserver.org
> 
> 
> Hi Ahmed,
> 
> Sounds like the Welchia worm to me.
> 
> HTH,
> Tom
> 
> Thomas W Shinder
> www.isaserver.org/shinder
> ISA Server and Beyond: http://tinyurl.com/1jq1
> Configuring ISA Server: http://tinyurl.com/1llp
> 
> 
> 
> -----Original Message-----
> From: Nabil, Ahmed [mailto:anmahmou@xxxxxxxxxx]
> Sent: Monday, August 25, 2003 5:36 AM
> To: [ISAserver.org Discussion List]
> Subject: [isalist] RE: Critical Problem - Connection down - Please
> advice
> 
> 
> http://www.ISAserver.org
> 
> 
> I disconnected the local NIC (Internal) cable from the ISA server and
> everything went fine. The task manager performance dropped to 2% and the
> Internet is connected !!!!!!!!!!!!!
> 
> Is that a kind of virus on the Internal LAN ??
> 
> Please advice,
> 
> Ahmed
> 
> -----Original Message-----
> From: Nabil, Ahmed
> Sent: Monday, August 25, 2003 9:16 AM
> To: [ISAserver.org Discussion List]
> Subject: [isalist] Critical Problem - Connection down - Please advice
> Importance: High
> 
> 
> http://www.ISAserver.org
> 
> 
> Hello Everyone,
> 
> Just to give you an overview of my ISA architecture. The ISA External
> Interface NIC is connected to the Firewall which in turn is connected to
> our ISP.
> 
> The Problem is that we are not able to connect to the Internet, The
> problem is for sure with the ISA, I inserted a Laptop between the ISA
> and the Firewall (Bypassing the ISA) and I connected fine to the
> Internet.
> 
> Actually the connection isn't totally down, When I start to ping the ISA
> external Interface from my client machine or to ping for example
> www.yahoo.com I get a reply for my ping and then the Time (TTL) starts
> to increase till it reach 1000ms then REQUEST TIME OUT message appear.
> This happens for another 5-10 minutes then a reply once again come back
> for another 2-5 minutes then TTL increase again and the same loop goes
> on.
> 
> When I check the ISA server Task manager, thats the strange part, the
> Performance is 100% CPU Usage and when I check the Process, I find few
> process (CSRSS, Winlogon, rdpclip, shstat, wzqkpick, hkcmd,
> controldGUI.......etc) and each of them is showing 0% CPU
> !!!!!!!!!!!!!!!!!!
> 
> I tried to clear the cache several times and I restarted the computer
> many times and when its up, it works fine for few minutes then the loop
> starts.
> 
> Now the CPU Usage is 100% and I don't have another choice but to restart
> the ISA.
> 
> Please advice,
> 
> Thanks in advance for your help,
> 
> Ahmed
> 
> ------------------------------------------------------
> List Archives: http://www.webelists.com/cgi/lyris.pl?enter=isalist
> ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp
> ISA Server FAQ: http://www.isaserver.org/pages/larticle.asp?type=FAQ
> ------------------------------------------------------
> Other Internet Software Marketing Sites:
> Leading Network Software Directory: http://www.serverfiles.com
> No.1 Exchange Server Resource Site: http://www.msexchange.org
> Windows Security Resource Site: http://www.windowsecurity.com/
> Network Security Library: http://www.secinf.net/
> Windows 2000/NT Fax Solutions: http://www.ntfaxfaq.com
> ------------------------------------------------------
> You are currently subscribed to this ISAserver.org Discussion List as:
> anmahmou@xxxxxxxxxx
> To unsubscribe send a blank email to $subst('Email.Unsub')
> 
> ------------------------------------------------------
> List Archives: http://www.webelists.com/cgi/lyris.pl?enter=isalist
> ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp
> ISA Server FAQ: http://www.isaserver.org/pages/larticle.asp?type=FAQ
> ------------------------------------------------------
> Other Internet Software Marketing Sites:
> Leading Network Software Directory: http://www.serverfiles.com
> No.1 Exchange Server Resource Site: http://www.msexchange.org
> Windows Security Resource Site: http://www.windowsecurity.com/
> Network Security Library: http://www.secinf.net/
> Windows 2000/NT Fax Solutions: http://www.ntfaxfaq.com
> ------------------------------------------------------
> You are currently subscribed to this ISAserver.org Discussion List as:
> tshinder@xxxxxxxxxxxxxxxxxx
> To unsubscribe send a blank email to $subst('Email.Unsub')
> 
> ------------------------------------------------------
> List Archives: http://www.webelists.com/cgi/lyris.pl?enter=isalist
> ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp
> ISA Server FAQ: http://www.isaserver.org/pages/larticle.asp?type=FAQ
> ------------------------------------------------------
> Other Internet Software Marketing Sites:
> Leading Network Software Directory: http://www.serverfiles.com
> No.1 Exchange Server Resource Site: http://www.msexchange.org
> Windows Security Resource Site: http://www.windowsecurity.com/
> Network Security Library: http://www.secinf.net/
> Windows 2000/NT Fax Solutions: http://www.ntfaxfaq.com
> ------------------------------------------------------
> You are currently subscribed to this ISAserver.org Discussion List as:
> anmahmou@xxxxxxxxxx
> To unsubscribe send a blank email to $subst('Email.Unsub')
> 
> ------------------------------------------------------
> List Archives: http://www.webelists.com/cgi/lyris.pl?enter=isalist
> ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp
> ISA Server FAQ: http://www.isaserver.org/pages/larticle.asp?type=FAQ
> ------------------------------------------------------
> Other Internet Software Marketing Sites:
> Leading Network Software Directory: http://www.serverfiles.com
> No.1 Exchange Server Resource Site: http://www.msexchange.org
> Windows Security Resource Site: http://www.windowsecurity.com/
> Network Security Library: http://www.secinf.net/
> Windows 2000/NT Fax Solutions: http://www.ntfaxfaq.com
> ------------------------------------------------------
> You are currently subscribed to this ISAserver.org Discussion List as:
> johnlist@xxxxxxxxxxxxxxxxxxx
> To unsubscribe send a blank email to $subst('Email.Unsub')


------------------------------------------------------
List Archives: http://www.webelists.com/cgi/lyris.pl?enter=isalist
ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp
ISA Server FAQ: http://www.isaserver.org/pages/larticle.asp?type=FAQ
------------------------------------------------------
Other Internet Software Marketing Sites:
Leading Network Software Directory: http://www.serverfiles.com
No.1 Exchange Server Resource Site: http://www.msexchange.org
Windows Security Resource Site: http://www.windowsecurity.com/
Network Security Library: http://www.secinf.net/
Windows 2000/NT Fax Solutions: http://www.ntfaxfaq.com
------------------------------------------------------
You are currently subscribed to this ISAserver.org Discussion List as: 
ksmith@xxxxxxxxxxxxxx
To unsubscribe send a blank email to $subst('Email.Unsub')

Other related posts: