nanog mailing list archives

Re: New worm / port 1434?

From: "Dr. Mosh" <nanog () zeromemory com>
Date: Sat, 25 Jan 2003 00:38:51 -0800


We had to go through each VLAN to determine which boxes were compromised,
looks like W2K SQL.

This thing is spreading fast.

-D

 0.  Pete Ashdown <pashdown () xmission com> farted:


* Avleen Vig (lists-nanog () silverwraith com) [030124 23:50] writeth:


It seems we have a new worm hitting Microsoft SQL server servers on port
1434.


Affirmative.  Be sure to block 1434 UDP on both the inbound and the
outbound.  Infected servers are VERY NOISY.


-- 
--------------
http://www.zeromemory.com - metal for your ears.

Current thread:

New worm / port 1434? Avleen Vig (Jan 24)
- Re: New worm / port 1434? Dave Stewart (Jan 24)
  - Re: New worm / port 1434? Lloyd Taylor (Jan 25)
- Re: New worm / port 1434? Pete Ashdown (Jan 24)
  - Re: New worm / port 1434? Gary Coates (Jan 25)
    - Re: New worm / port 1434? Peter van Dijk (Jan 25)
  - Re: New worm / port 1434? Dr. Mosh (Jan 25)
- Re: New worm / port 1434? Josh Richards (Jan 25)
  - Re: New worm / port 1434? Jake Khuon (Jan 25)
  - Re: New worm / port 1434? Josh Richards (Jan 25)
- Re: New worm / port 1434? Mike Tancsa (Jan 25)
  - Re: New worm / port 1434? Simon Lockhart (Jan 25)
    - Re: New worm / port 1434? Curtis Maurand (Jan 25)
  - Re: New worm / port 1434? Adam "Tauvix" Debus (Jan 25)
  - Re: New worm / port 1434? Jack Bates (Jan 25)
    - Re: New worm / port 1434? Mike Tancsa (Jan 25)
- Re: New worm / port 1434? Troy Rader (Jan 25)

(Thread continues...)