Block Conficker Script ISA 2004 & ISA 2006

Download the script file from the link above.

Block_Conficker_Script

Execute on the server that ISA server installed by double clicking the file.

New HTTP signatures will be automaticly created.



Read more...

Finding source of denial of service attacks in AD/ Conficker Virus

Open Event Viewer on DC;

And Filter on Logon/Logoff events to start off with.
Event ID is 529 for locked and 675 for logon attempts.

Client address will be listed in the failure.
Read more...