A new experience for me -
Call from client - Outlook sluggish - server overall slow. Remote
connection kept timing out so I went onsite. Problem is widespread in the
office and, server appears frozen. The SBS 2000 box shows a blank
background - cursor still moves. Zero hard-drive activity. (Dell PE4600)
Remote desktop from local machine doesn't work.
CTRL-ALT-DEL doesn't work.
Unplugged internet from server... and did a hard shutdown.
Two users admit openning up attachments on messages minutes before problem
seemed to start.
Scanned all workstations. Scans detected NetSky.B and C along with Jeem all
noticed and neutralized by InoculateIT within the last 24hrs with NetSky.B
being detected (and supposedly neutralized) just minutes before overall
problems noticed.
Reboot server - starts up normally.
Deleted handful (about 15) of outbound messages sitting in SMTP queue.
No viruses detected on actual sever box with VET and InoculateIT scans.
Reconnected internet.
Checked logs - complete blanks from shortly after I received call until
server was rebooted.
Last active messages were in regards to ISA - Block Attacker - then nothing
untill the reboot.
Checked Packet Filters and found a string of 20 or so new blocked attacks.
All from the same IP BUT the name as listed had an appending string
following this pattern:
{11A1A1A1-1111-1A11-11AA-1AA1AA1AA11A} (note: yes, I replaced the actual hex
with 1's and A's.)
No two of the codes were the same and the actuall IP on the remote port was
all the same.
That's the first time I've seen that type of notation posted by block
attacker.
Other than the obvious poor protocol followed by the users (in not reporting
virus incidents) and this strange event - I've got nothing else to go on.
The machine is generally good. HFNETCHK says the box is 100% patched. Dual
NIC's. All status reports "normal" immediately prior to and after the issue.
All machines and processes appear to be running within normal parameters
now.
Any thoughts?
If nothing else, a clear explanation of the bizarre Block Attacker
nomenclature would at least give me some peace of mind.
Thanks in advance.
db