Microsoft Releases Procedures on Using ISA Server Firewalls to Protect Your Network from Sobig.F Worm Traffic

Reported by
Thomas W Shinder, M.D.

The Sobig.F worm is taking networks by storm. I've had to repair the damage on several of these networks myself. The good news is that none of these customers were shut down by their ISPs because their ISA Server firewalls were configured to protect them from both inbound and outbound worm traffic. In fact, it there weren't "out of band" laptop or VPN users bringing the dreaded payload into the network, they would have been completely protected.

However, I don't recommend that you depend on isolationism. Patch your systems ASAP and then head on over to the Microsoft ISA Server site and read the article Learn How Your ISA Server Helps Block Sobig.F Traffic. There's some great info in that article so consider it a must read.

After you're done with that paper, head on over to Jim Harrison's ISATools.org site and get his Sobig fixes at http://isatools.org/sobig.f.zip. There a block script and a fix script. Jim's Blaster scripts saved my own personal bacon a couple of days ago, so his worm whacking scripts get two fat thumbs up from this corner!

If you would like us to email you when Tom Shinder releases another update on ISAserver.org, subscribe to our 'Real-Time Article Update' by clicking here. Please note that we do NOT sell or rent the email addresses belonging to our subscribers; we respect your privacy!