RE: MS-Blast vs exchange publishing
- From: "Jeff Sloan" <jsloan@xxxxxxxxxxxx>
- To: "ISALists" <isalist@xxxxxxxxxxxxx>
- Date: Thu, 14 Aug 2003 08:28:08 -0500
Its not infection, I've checked our machines, I'm wondering if it is
lots of traffic on the internet that could be interfering or something.
All our internal machines were updated, and antivirus updates on all of
them every day. Anyone else able to connect via dialup to their RPC
published Exchange?
Jeff Sloan
Network Administrator
Cross Oil Refining & Marketing, Inc.
484 E. 6th St.
Smackover, AR 71762
Phone 870-864-8688
Fax 870-864-8689
Cell 870-866-9941
-----Original Message-----
From: Quillman Shawn (RBNA/CIT1.1) *
[mailto:Shawn.Quillman@xxxxxxxxxxxx]
Sent: Thursday, August 14, 2003 8:22 AM
To: ISALists
Subject: [isalist] RE: MS-Blast vs exchange publishing
http://www.ISAserver.org
Quite possibly, unless you're blocking things on ISA. Look for a
process called msblaste.exe and/or a value called "windows auto update"
in HKLM\Software\Microsoft\Windows\CurrentVersion\Run on all machines in
the mix . If you find either one of those then you've got it. Delete
that value in the registry, delete \winnt\system32\msblast.exe and patch
your box(es).
-Shawn
-----
Shawn R. Quillman
Robert Bosch Corporation RBNA/CIT1.1
38000 Hills Tech Drive
Farmington Hills, MI 48331
(248) 553-1164 (P) (248) 848-2855 (F)
shawn.quillman@xxxxxxxxxxxx
-----Original Message-----
From: Jeff Sloan [mailto:jsloan@xxxxxxxxxxxx]
Sent: Thursday, August 14, 2003 9:17 AM
To: [ISAserver.org Discussion List]
Subject: [isalist] MS-Blast vs exchange publishing
http://www.ISAserver.org
Does this worm have anything to do with the fact that my external users
cant connect to our exchange server that is RPC published? I know it has
to do with RPC and port 135, which is where the publishing goes on.
I called earthlink thinking they may have blocked the protocol or ports,
but they say they haven't, yet we cant connect no matter how many
retries. Just started happening the last few days.
Thanks
Jeff Sloan
Network Administrator
Cross Oil Refining & Marketing, Inc.
484 E. 6th St.
Smackover, AR 71762
Phone 870-864-8688
Fax 870-864-8689
Cell 870-866-9941
------------------------------------------------------
List Archives: http://www.webelists.com/cgi/lyris.pl?enter=isalist
ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp
ISA Server FAQ: http://www.isaserver.org/pages/larticle.asp?type=FAQ
------------------------------------------------------
Other Internet Software Marketing Sites:
Leading Network Software Directory: http://www.serverfiles.com No.1
Exchange Server Resource Site: http://www.msexchange.org Windows
Security Resource Site: http://www.windowsecurity.com/ Network Security
Library: http://www.secinf.net/ Windows 2000/NT Fax Solutions:
http://www.ntfaxfaq.com
------------------------------------------------------
You are currently subscribed to this ISAserver.org Discussion List as:
shawn.quillman@xxxxxxxxxxxx To unsubscribe send a blank email to
$subst('Email.Unsub')
------------------------------------------------------
List Archives: http://www.webelists.com/cgi/lyris.pl?enter=isalist
ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp
ISA Server FAQ: http://www.isaserver.org/pages/larticle.asp?type=FAQ
------------------------------------------------------
Other Internet Software Marketing Sites:
Leading Network Software Directory: http://www.serverfiles.com No.1
Exchange Server Resource Site: http://www.msexchange.org Windows
Security Resource Site: http://www.windowsecurity.com/ Network Security
Library: http://www.secinf.net/ Windows 2000/NT Fax Solutions:
http://www.ntfaxfaq.com
------------------------------------------------------
You are currently subscribed to this ISAserver.org Discussion List as:
jsloan@xxxxxxxxxxxx To unsubscribe send a blank email to
$subst('Email.Unsub')
Other related posts:
