Hi,

Just a note to say many many thanks for your website. I'll give
a quick overview of my circumstances as it may well help others,
especially network admins.

I run a small network (5 pcs, 1 domain controller, mostly NT4,
1 Mac) with a shared internet connection which is filtered using
Deerfield's Wingate. Behind my firewall, I run my own DNS server
for various reasons which forwards to the firewall for external
resolution.

Shortly after connecting to ADSL (although I don't think that
the timeing was exactly related), I had problems with my DNS
server keeling over (although it was rare that I caught this
until too late before I started actively pursuing the problem).
Then Wingate started keeling over with errors which said simply
to contact the vendor. Wingate refused to reload without a full
reboot of the server and afterwards took nearly 30 minutes to
load.

The problem was TSADBOT.EXE on one of the networked PCs trying
to connect to conducent. As you state, TSADBOT refuses to
recognise when it is being told that a DNS entry does no longer
exist and instead chooses to send myriad requests to the set
DNS server ad infinitum (I got 10-15/second) and will continue
to do so until it gets an answer (impossible now that conducent
have finally gone out of business).

This was putting an unservable strain on my Microsoft DNS
Server with the final result that the DNS server itself
managed to develop a memory leak which managed to consume all
of the available resources on the server (although I haven't
actually managed to find any information regarding a specific
leak in M$ DNS Server apart from the issues which are
(apparently) fixed in the NT ServicePacks) and eventually
crashed. In turn, the DNS Server forwarded the requests to the
Wingate server which keeled over when it was unable to
service the sheer volume of requests passing through it. I
contacted Deerfield about the problem and they have provided
me with considerable support services and even an upgrade to
the latest version. However, the latest version will still
keel over, it just takes a little longer. Deerfield are
apparently working on a solution as this problem was unknown.

The problem with the Wingate server taking so long to reload
was the size of the logfiles that had been generated  by the
continual DNS requests for a non-existant server.

My first experience with this nasty little piece of
software was in November and I have just been re-infected
by the Photocopier utility from Nico2000.com. Unfortunately
it is a good utility (IMHO) and I can't find any mention of
Spyware being installed with it.

I don't know if this will help or not but I hope that it will
let some people know what can be causing problems with their
Wingate servers et al. It took me a while to figure it out
and realise exactly what was going on and your website is an
excellent resource for this and related problems.


Many thanks,

Myran