Microsoft makes no warranties about this information. In no event shall Microsoft be liable for any damages whatsoever arising out of or with the use or spread of this information. Any use of this information is at the user's own risk.

Table 1 lists affected ports known to be used by MyDoom. You should block those ports. This data is current as of 01:24:53, Monday, February 09, 2004.

By default, servers running ISA Server in firewall or integrated modes effectively help protect against MyDoom by blocking the external attacks on the affected ports.

For the network protected by a server running ISA Server to be vulnerable, specific rules would need to be written to allow traffic on these ports.

• DO enable Internet protocol (IP) packet filtering.
  

Note:
Customers who have not enabled IP packet filtering should review the packet filtering section of this page.

Caution:
Do not create server publishing rules using the ports listed in Table 1.

Default installations of ISA Server in firewall or integrated mode prevent the spread of MyDoom to external networks. However, if your ISA Server is configured with an "allow all" policy for outbound traffic, then you must create protocol rules to block MyDoom on its known ports.

To help prevent outbound attacks through ISA Server:

• DO create protocol rules that block traffic on all ports listed in Table 1.
  

Note:
Customers who have not blocked this traffic should review the block outbound traffic procedure on this page. Blocking port 135 TCP outbound will prevent outbound RPC traffic from working across ISA Server.

Note:
TCP-3127 is a port also used by the Rueter Kobra application (thanks to William Robertson for this tip). If you need to provide access for this application, you must omit TCP-3127 from the blocked ports list.

• DO disable the Firewall Client for malicious MyDoom processes, if the Firewall Client is being used in your environment. If all outbound access is authenticated, this will prevent the worm from acting as a Firewall Client through ISA Server.
  

Note:
For instructions how to do this, review the disable malicious MyDoom processes section on this page.

A computer that has ISA Server installed is only vulnerable to attack by the MyDoom worm if:

1. You use an e-mail client on the ISA Server itself.
   
2. You execute an e-mail attachment delivered by MyDoom.
   

Caution:
To help protect the ISA Server computer itself from a MyDoom attack, do not use the computer running ISA Server as a workstation.

To enable IP packet filtering:

1. In ISA Management, expand Servers and Arrays, <ISA Server name>, Access Policy.
   
2. Right-click IP Packet Filters and select Properties.
   
3. Check the Enable Packet Filtering box.
   
4. Click OK.
   

To verify that no server publishing rules use MyDoom ports:

1. In ISA Management, expand Servers and Arrays, <ISA Server name>, Publishing Rules.
   
2. Click Protocol Definitions.
   
3. In the right-side pane, click the Port Number column header to sort the list by port number.
   
4. Write down the names of any protocol definitions that include the port and protocol combination as listed in Table 1.
   
5. In the left pane, expand Publishing.
   
6. Click Server Publishing Rules.
   
7. Examine all the server publishing rules. If anything in the Protocol column matches the name of a protocol definition that you wrote down in Step 4, that server publishing rule must be disabled or deleted. Use the ISA Server default protocols for RPC instead.
   

If you are using an "allow all" policy for outbound traffic, protocol definitions need to be created for all ports listed in Table 1. You should create a protocol definition for each port to be blocked, where:

• <port number> is the number of the port from the second column of Table 1
  
• <IP protocol> is TCP
  

Note:
Isatools.org hosts scripts that can automate some of the following manual tasks.

To block outbound traffic on known MyDoom ports listed in Table 1:

1. In ISA Management, expand Servers and Arrays, <ISA name Server>, Policy Elements.
   
2. Right-click Protocol Definitions, point to New, and then click Definition.
   
3. Type MyDoom (<port number>, <ip protocol>) in the Protocol Definition Name dialog box and then click Next.
   
4. Type <port number> in the Port Number dialog box.
   
5. Select <protocol type> in the Protocol Type drop-down list.
   
6. Select Outbound from the Direction dialog box.
   
7. Click Next.
   
8. Select No from the Do you want to use secondary connections? option, and then click Next.
   
9. Click Finish.
   

Note:
Because MyDoom uses a contiguous range of ports, you have to repeat the preceding Steps 2-8 for each port in the range.

To prevent traffic on known MyDoom ports:

1. In the left pane, expand Access Policy.
   
2. Right-click Protocol Rules, point to New, and then click Rule.
   
3. Type Block W32.MyDoom in the Protocol Rule Definition Name dialog box and then click Next.
   
4. Select Deny from the Response to client requests to use this protocol option.
   
5. Select Selected protocols from the Apply this rule drop-down list.
   
6. In Protocols, check the boxes for the newly created protocol definitions in Steps 1–9 and TFTP.
   
7. Click Next.
   
8. Select Always from the Use this schedule drop-down list and then click Next.
   

The malicious MyDoom process operates as explorer, shimgapi, and taskmon. A Firewall Client rule must be created to disallow access by these processes through the Firewall Client.

To disable the Firewall Client for malicious MyDoom processes:

1. In ISA Management, expand Servers and Arrays, <ISA Server name>.
   
2. Click Client Configuration.
   
3. In the right pane, right-click Firewall Client and then click Properties.
   
4. Click the Application Settings tab.
   
5. Click New.
   
6. Type msblast in the Application dialog box.
   
7. Select Disable from the Key drop-down list.
   
8. Select 1 from the Value drop-down list.
   
9. Repeat Steps 6-9 two more times, replacing explorer with the other process names (shimgapi and taskmon).
   
10. Click OK.
    
11. Click OK.
    

Disabling the Firewall Client for the malicious processes only prevents the malicious processes on an infected LAT host from acting as a Firewall Client. If the host is also configured as a SecureNAT client, then this setting may have no effect. (To prevent SecureNAT client access across ISA Server, make sure that no anonymous Site and Content or Protocol rules exist.)

• What You Should Know About the MyDoom Worm
  
• ISA Server Product Documentation