nanog mailing list archives

SQL Server Worm?


From: Dave Stewart <dbs () dbscom com>
Date: Sat, 25 Jan 2003 02:50:32 -0500


I can't say for certain, not having taken an exhaustive look (it is, after all, almost 3 in the morning out here on the right coast), but on the one MS SQL server here, there do not appear to be new files installed, and after rebooting, the server is *not* spewing forth traffic as it was earlier.

I don't see any new stored procedures at a glance, so perhaps rebooting resolves the issue.

Of course:

access-list xxx deny udp any any eq 1434

helps, as well, in my case... lotta incoming hits to 1434... but none outbound in the past 20 minutes

Current thread: