RE: Running out of resources? hack?

  • From: Warren Cundy <warrenc@xxxxxxxxxxxx>
  • To: "'[ISAserver.org Discussion List]'" <isalist@xxxxxxxxxxxxx>
  • Date: Thu, 24 Jul 2003 08:41:09 -0700

Thanks Tom, what are the obvious signs of a netbios virus? 

-W


-----Original Message-----
From: Thomas W Shinder [mailto:tshinder@xxxxxxxxxxxxxxxxxx] 
Sent: Thursday, July 24, 2003 8:29 AM
To: [ISAserver.org Discussion List]
Subject: [isalist] RE: Running out of resources? hack?


http://www.ISAserver.org


Hi Warren,

Run a Network Monitor trace on the internal interface and see if you're
being attacked by a NetBIOS virus.

Thanks!
Tom

Thomas W Shinder
www.isaserver.org/shinder 
ISA Server and Beyond: http://tinyurl.com/1jq1
Configuring ISA Server: http://tinyurl.com/1llp

 


-----Original Message-----
From: Warren Cundy [mailto:warrenc@xxxxxxxxxxxx] 
Sent: Thursday, July 24, 2003 10:19 AM
To: [ISAserver.org Discussion List]
Subject: [isalist] Running out of resources? hack?


http://www.ISAserver.org


Hi guys,

Over the last week or so, every 24-36 hours, ISA has been giving me "running
out of resources" type errors, as follows:

MS Web Proxy
14198
"The Web Proxy service failed to create a network socket... ISA already set
the maximum number of ports to 65535, etc."

I've noticed in the logs that the web proxy and firewall services seem to be
stopped and starting themselves(?)

Now, this is a brand new ISA install on Windows Server 2003.  We were having
these EXACT problems on our old Windows 2000 ISA server, and we built a new
firewall machine for this and other reasons.  

Is this a virus?  security hack?  I haven't noticed any other symptoms
typical of this stuff.

Thanks

-W


------------------------------------------------------
List Archives: http://www.webelists.com/cgi/lyris.pl?enter=isalist
ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp
ISA Server FAQ: http://www.isaserver.org/pages/larticle.asp?type=FAQ
------------------------------------------------------
Other Internet Software Marketing Sites:
Leading Network Software Directory: http://www.serverfiles.com No.1 Exchange
Server Resource Site: http://www.msexchange.org Windows Security Resource
Site: http://www.windowsecurity.com/ Network Security Library:
http://www.secinf.net/ Windows 2000/NT Fax Solutions:
http://www.ntfaxfaq.com
------------------------------------------------------
You are currently subscribed to this ISAserver.org Discussion List as:
tshinder@xxxxxxxxxxxxxxxxxx To unsubscribe send a blank email to
$subst('Email.Unsub')

------------------------------------------------------
List Archives: http://www.webelists.com/cgi/lyris.pl?enter=isalist
ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp
ISA Server FAQ: http://www.isaserver.org/pages/larticle.asp?type=FAQ
------------------------------------------------------
Other Internet Software Marketing Sites:
Leading Network Software Directory: http://www.serverfiles.com No.1 Exchange
Server Resource Site: http://www.msexchange.org Windows Security Resource
Site: http://www.windowsecurity.com/ Network Security Library:
http://www.secinf.net/ Windows 2000/NT Fax Solutions:
http://www.ntfaxfaq.com
------------------------------------------------------
You are currently subscribed to this ISAserver.org Discussion List as:
warrenc@xxxxxxxxxxxx To unsubscribe send a blank email to
$subst('Email.Unsub')


Other related posts: