That script mitigates the Opaserv virus problem where ISA is slammed by an infrcted LAT client. I'll bet your FWEXT log is chock full of UDP-137 traffic to non-LAT IPs. Jim Harrison MCP(NT4, W2K), A+, Network+, PCG http://isaserver.org/Jim_Harrison/ http://isatools.org Read the help / books / articles! http://www.ISAserver.org Hi Tom, It was either that or an ISA vulnerability, or a little of both. The ISA vulnerability was supposed to be something that was corrected in Fp1. I had that installed, so its tough to say what was happening. Anyway, running the script from PSS to delete the UDP Netbios Protocol fixed the problem. -Warren -----Original Message----- From: Thomas W Shinder [mailto:tshinder@xxxxxxxxxxxxxxxxxx] Sent: Tuesday, July 29, 2003 5:28 PM To: [ISAserver.org Discussion List] Subject: [isalist] RE: ISA Running out of resources? hack? http://www.ISAserver.org Hi Warren, Did you figure out if this was from the NetBIOS worm? Thanks! Tom Thomas W Shinder www.isaserver.org/shinder <http://www.isaserver.org/shinder> ISA Server and Beyond: http://tinyurl.com/1jq1 <http://tinyurl.com/1jq1> Configuring ISA Server: http://tinyurl.com/1llp <http://tinyurl.com/1llp> -----Original Message----- From: Warren Cundy [mailto:warrenc@xxxxxxxxxxxx] Sent: Thursday, July 24, 2003 10:27 AM To: [ISAserver.org Discussion List] Subject: [isalist] ISA Running out of resources? hack? http://www.ISAserver.org Hi guys, Over the last week or so, every 24-36 hours, ISA has been giving me "running out of resources" type errors, as follows: MS Web Proxy 14198 "The Web Proxy service failed to create a network socket... ISA already set the maximum number of ports to 65535, etc." I've noticed in the logs that the web proxy and firewall services seem to be stopped and starting themselves(?) Now, this is a brand new ISA install on Windows Server 2003. We were having these EXACT problems on our old Windows 2000 ISA server, and we built a new firewall machine for this and other reasons. Is this a virus? security hack? I haven't noticed any other symptoms typical of this stuff. Thanks -Warren ------------------------------------------------------ List Archives: http://www.webelists.com/cgi/lyris.pl?enter=isalist ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp ISA Server FAQ: http://www.isaserver.org/pages/larticle.asp?type=FAQ ------------------------------------------------------ Other Internet Software Marketing Sites: Leading Network Software Directory: http://www.serverfiles.com No.1 Exchange Server Resource Site: http://www.msexchange.org Windows Security Resource Site: http://www.windowsecurity.com/ Network Security Library: http://www.secinf.net/ Windows 2000/NT Fax Solutions: http://www.ntfaxfaq.com ------------------------------------------------------ You are currently subscribed to this ISAserver.org Discussion List as: warrenc@xxxxxxxxxxxx To unsubscribe send a blank email to $subst('Email.Unsub') ------------------------------------------------------ List Archives: http://www.webelists.com/cgi/lyris.pl?enter=isalist ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp ISA Server FAQ: http://www.isaserver.org/pages/larticle.asp?type=FAQ ------------------------------------------------------ Other Internet Software Marketing Sites: Leading Network Software Directory: http://www.serverfiles.com No.1 Exchange Server Resource Site: http://www.msexchange.org Windows Security Resource Site: http://www.windowsecurity.com/ Network Security Library: http://www.secinf.net/ Windows 2000/NT Fax Solutions: http://www.ntfaxfaq.com ------------------------------------------------------ You are currently subscribed to this ISAserver.org Discussion List as: jim@xxxxxxxxxxxx To unsubscribe send a blank email to $subst('Email.Unsub')