ISA Server attacked by DOS from Bobax.

  • From: "Alfredo" <agms@xxxxxxxxxx>
  • To: isalist@xxxxxxxxxxxxx
  • Date: Thu, 20 May 2004 10:48:19 -0600

I have an ISA Server 2000 fully updated with Windows Server 2003 and
Antivirus fully updated, but some of the PCs in the internal network
became infected with Bobax.C and generate a lot of traffic on ports
5000,135,445 which causing the ISA Server to block access to the Internet.
The Server by itself can navigate but any user in the internal net can
not.
I tried blocking traffic from this ports using a port access rule denying
traffic with these ports as destination, but still get wacked by the 
virus traffic.
With only one PC with the virus active, the server won't let anyone to
navigate.
I wonder if this is normal behaviour of the ISA Server or I missing
something.
Any help would be greatly appreciated.

Regards,

Alfredo Medina
Universidad Francisco Marroquin
Guatemala


Other related posts: