More on this... Take a look at your IIS logs, and look for the lines with something trying to access cmd.exe or many "../../../filename." You should recognize this as nimda (or other such worms). Now, find the IP address of the server sending this data to your IIS server, and try doing a: \\ip.add.re.ss on it - most likely you WILL get a username/password prompt. Also, there is probably about an 85% chance the local admin password will be blank, or the guest account will be enabled and in the admins group. My point is, if someone on the Net has a box open enough to allow a connection over 137:139, there are probably many other things wrong with it, and I doubt you would want to have any dealings with that server. Matt Walkowiak PS update your virus sigs before attempting to access that server :) -----Original Message----- From: Jim Harrison [mailto:jim@xxxxxxxxxxxx] Sent: Wednesday, July 03, 2002 8:37 AM To: [ISAserver.org Discussion List] Subject: [isalist] Re: How do I map to an external drive http://www.ISAserver.org ..that's by design and that's a good thing it is, too. Share mapping is a NetBIOS function that best not performed over the Internet at all (opens your system up WIDE). If you absolutely must do this, use a VPN tunnel between the LAT host and the remote machine. ISA Supports PPTP tunneling through it. Jim Harrison MCP(NT4, W2K), A+, Network+, PCG http://isaserver.org/authors/harrison/ Read the books! ----- Original Message ----- From: "Bob Cheeseman" <bob@xxxxxxxxxxx> To: "[ISAserver.org Discussion List]" <isalist@xxxxxxxxxxxxx> Sent: Wednesday, July 03, 2002 5:10 AM Subject: [isalist] How do I map to an external drive http://www.ISAserver.org From behind ISA how do I map to an administrative share i.e.: \\xxx.xxx.xxx.xxx\c$ on another machine out on the Internet? ISA seems to block this. Thanx Bob ------------------------------------------------------ You are currently subscribed to this ISAserver.org Discussion List as: jim@xxxxxxxxxxxx To unsubscribe send a blank email to $subst('Email.Unsub') ------------------------------------------------------ You are currently subscribed to this ISAserver.org Discussion List as: matt.walkowiak@xxxxxxxxxxxx To unsubscribe send a blank email to $subst('Email.Unsub')