25 Jan
2003
25 Jan
'03
3:38 a.m.
We had to go through each VLAN to determine which boxes were compromised, looks like W2K SQL. This thing is spreading fast. -D 0. Pete Ashdown <pashdown@xmission.com> farted:
* Avleen Vig (lists-nanog@silverwraith.com) [030124 23:50] writeth:
It seems we have a new worm hitting Microsoft SQL server servers on port 1434.
Affirmative. Be sure to block 1434 UDP on both the inbound and the outbound. Infected servers are VERY NOISY.
-- -------------- http://www.zeromemory.com - metal for your ears.