New worm / port 1434?

Dr. Mosh nanog at zeromemory.com
Sat Jan 25 08:38:51 UTC 2003


We had to go through each VLAN to determine which boxes were compromised,
looks like W2K SQL.

This thing is spreading fast.

-D

 0.  Pete Ashdown <pashdown at xmission.com> farted:
> 
> * Avleen Vig (lists-nanog at silverwraith.com) [030124 23:50] writeth:
> >
> >It seems we have a new worm hitting Microsoft SQL server servers on port
> >1434.
> 
> Affirmative.  Be sure to block 1434 UDP on both the inbound and the
> outbound.  Infected servers are VERY NOISY.

-- 
--------------
http://www.zeromemory.com - metal for your ears.



More information about the NANOG mailing list