Virus maybe? Please help.

[tekkid]

Hey folks,

My ISA Server crashed a few days ago, I rebuilt it and its semi working correctly now. On veiwing the log file this morning, I noticed that 3 of the other servers were doing all port scans to the isa server? The message it gives me is this " The ISA Sever detected an all port attack from internet protocol address 172.xxx.xxx.xxx" The address is from another one of our servers.. its doing this on about 3 different servers.

In the application log it says Windows cannot determine the user or computer name.

Network setup is:

All windows2k servers


I'm new to managing the ISA server so if anyone has any ideas on whats going on please post. If more info is needed please post and I'll get it for you.

Thanks for your time.

 

[zcolton]

Your problem isn't at the isa server, it's at the other servers where the port attack is coming from. Check out the other servers.