RE: ISA Server Installation
- From: "John Tolmachoff \(Lists\)" <johnlist@xxxxxxxxxxxxxxxxxxx>
- To: "'[ISAserver.org Discussion List]'" <isalist@xxxxxxxxxxxxx>
- Date: Tue, 27 Jan 2004 23:04:19 -0800
With each virus, it is different. However, in the case of Blaster, the virus
infected computer will make repeated pings to various and many IP addresses.
This can consume all of the resources on the ISA server processing these
requests for access to the Internet. There was much discussion on this list
about this problem, which is readily available in the archives. Jim has an
excellent tool on www.isatools.org to help combat this problem.
However, if you have one compromised computer on your network, your whole
network is suspect until cleaned. Therefore, your primary job is to find
that computer and shut it down. Easiest way is to go to your switch or hub
and disconnect patch cables one by one until found.
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
> -----Original Message-----
> From: Muttee Rehman [mailto:atmatli@xxxxxxxxxxx]
> Sent: Tuesday, January 27, 2004 10:46 PM
> To: [ISAserver.org Discussion List]
> Subject: [isalist] RE: ISA Server Installation
>
> http://www.ISAserver.org
>
>
> Dear sir,
>
> You mean because of one computer, the problem will remain to all unless
> the
> virus is cleaned on the computer which infected with virus right?
>
> Muttee
>
>
> >From: "John Tolmachoff (Lists)" <johnlist@xxxxxxxxxxxxxxxxxxx>
> >Reply-To: "[ISAserver.org Discussion List]" <isalist@xxxxxxxxxxxxx>
> >To: "[ISAserver.org Discussion List]" <isalist@xxxxxxxxxxxxx>
> >Subject: [isalist] RE: ISA Server Installation
> >Date: Tue, 27 Jan 2004 22:22:37 -0800
> >
> >http://www.ISAserver.org
> >
> >95% chance that one of your internal computers is infected with a virus
> and
> >is sending out, creating at DOS of sorts. Most likely, it is Blaster.
> >
> >John Tolmachoff
> >Engineer/Consultant/Owner
> >eServices For You
> >
> > > -----Original Message-----
> > > From: Barry [mailto:captnbaz@xxxxxxxxxxxxxx]
> > > Sent: Tuesday, January 27, 2004 7:39 PM
> > > To: [ISAserver.org Discussion List]
> > > Subject: [isalist] ISA Server Installation
> > >
> > > http://www.ISAserver.org
> > >
> > > I recently installed ISA Server and everything appeared fine
> >(initially).
> > > It certainly started working OK!
> > > Unfortunately I have the following problem - After I attach to the
> > > Internet, it starts running slower and slower until my access to the
> > > Internet stops. My only fix, is to shutdown and restart. Whereupon it
> > > initially accesses the Internet at full speed but progressively slows
> >down
> > > until it stops again etc, etc, etc.
> > > >From full speed to stop takes a varying amount of time from about 10
> to
> > > 30
> > > minutes.
> > > I think it is interesting to note, that if I look at the Status of my
> > > Internet Connection, it shows about 100 packets a second streaming out
> >of
> > > my computer on the 'sent' side but zero packets coming into my
> computer
> >on
> > > the 'received' side.
> > > Even though I should be receiving data (like the home page to
> > > isaserver.org).
> > > A typical situation might show 200,000+ packets 'sent' increasing at a
> > > steady 100 packets per second with about 2,000 packets 'received' and
> > > constant. Nothing else happening until my connection times-out!!
> > >
> > > Needless to say I would appreciate any help I can get!
> > >
> > > Regards,
> > >
> > > Barry
> > >
> > > ------------------------------------------------------
> > > List Archives: http://www.webelists.com/cgi/lyris.pl?enter=isalist
> > > ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp
> > > ISA Server FAQ: http://www.isaserver.org/pages/larticle.asp?type=FAQ
> > > ------------------------------------------------------
> > > Other Internet Software Marketing Sites:
> > > Leading Network Software Directory: http://www.serverfiles.com
> > > No.1 Exchange Server Resource Site: http://www.msexchange.org
> > > Windows Security Resource Site: http://www.windowsecurity.com/
> > > Network Security Library: http://www.secinf.net/
> > > Windows 2000/NT Fax Solutions: http://www.ntfaxfaq.com
> > > ------------------------------------------------------
> > > You are currently subscribed to this ISAserver.org Discussion List as:
> > > johnlist@xxxxxxxxxxxxxxxxxxx
> > > To unsubscribe send a blank email to
> >$subst('Email.Unsub')
> >
> >
> >------------------------------------------------------
> >List Archives: http://www.webelists.com/cgi/lyris.pl?enter=isalist
> >ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp
> >ISA Server FAQ: http://www.isaserver.org/pages/larticle.asp?type=FAQ
> >------------------------------------------------------
> >Other Internet Software Marketing Sites:
> >Leading Network Software Directory: http://www.serverfiles.com
> >No.1 Exchange Server Resource Site: http://www.msexchange.org
> >Windows Security Resource Site: http://www.windowsecurity.com/
> >Network Security Library: http://www.secinf.net/
> >Windows 2000/NT Fax Solutions: http://www.ntfaxfaq.com
> >------------------------------------------------------
> >You are currently subscribed to this ISAserver.org Discussion List as:
> >atmatli@xxxxxxxxxxx
> >To unsubscribe send a blank email to $subst('Email.Unsub')
>
> _________________________________________________________________
> MSN 8 helps eliminate e-mail viruses. Get 2 months FREE*.
> http://join.msn.com/?page=features/virus
>
>
> ------------------------------------------------------
> List Archives: http://www.webelists.com/cgi/lyris.pl?enter=isalist
> ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp
> ISA Server FAQ: http://www.isaserver.org/pages/larticle.asp?type=FAQ
> ------------------------------------------------------
> Other Internet Software Marketing Sites:
> Leading Network Software Directory: http://www.serverfiles.com
> No.1 Exchange Server Resource Site: http://www.msexchange.org
> Windows Security Resource Site: http://www.windowsecurity.com/
> Network Security Library: http://www.secinf.net/
> Windows 2000/NT Fax Solutions: http://www.ntfaxfaq.com
> ------------------------------------------------------
> You are currently subscribed to this ISAserver.org Discussion List as:
> johnlist@xxxxxxxxxxxxxxxxxxx
> To unsubscribe send a blank email to $subst('Email.Unsub')
Other related posts:
