W32.SQLExp.Worm!!!

[eraser]

In questo momento i server di no-ip.com sono sotto attacco ddos:

No-IP.com Network status update:
The Level(3) network, as well as many other internet providers are currently under a distributed denial of service (DDOS) attack based on a MS SQL exploit. The Level(3) network engineers are currently focusing all efforts on this issue. We will keep you posted as to the status of this issue.

Currently web redirects and access to the No-IP website is affected. Update clients will most likely receive a connection failed warning.

DNS resolution is available via our remote site as well as the spooling of mail.

There is now an article posted on slashdot.org regarding this issue. Here is the posting:

"Since about midnight EST almost every host on the internet has been receiving a 376 byte UDP payload on port ms-sql-m (1434) from a random infected server. Reports of some hosts receiving 10 per minute or more. internetpulse.net is reporting UUNet and Internap are being hit very hard. This is the cause of major connectivity problems being experienced worldwide. It is believed this worm leverages a vulnerability published in June 2002. Several core routers have taken to blocking port 1434 outright. If you run Microsoft SQL Server, make sure the public internet can't access it. If you manage a gateway, consider dropping UDP packets sent to port 1434." bani adds "This has effectively disabled 5 of the 13 root nameservers."

Last updated: Jan 25, 04:51 PDT

causa questo virus

W32.SQLExp.Worm is a worm that targets servers running Microsoft SQL. Since this worm exists only in memory, it cannot be detected by traditional antivirus scanners. As a result, Symantec Security Response will not be posting virus definitions for this threat.

The worm sends 376 bytes to 1434/udp - the SQL Server Resolution Service Port. Beginning at 5:31am GMT, we started to see a significant increase in the unique number of source IPs scanning for 1434/udp. Symantec Security Response highly recommends all MS-SQL server system administrators to audit their machines for known security vulnerabilities immediately.

Symantec Security Response also recommends configuring perimeter devices to block 1434/udp traffic from untrusted hosts.

The worm has the unintended payload of performing a Denial of Service due to the large number of packets it sends out.

fonti: 1 2 3

Ciao

Eraser

[Pola]

Come d'accordo chiudo questo thread dato che tutte le info, comprese questa, sono qui:
http://forum.hwupgrade.it/viewtopic.php?t=385699

Grazie Eraser.