W32.SqlSlammer

Mailman List Mirror (Read Only)
1

By the way, I know you guys probably don't care but McAfee is saying that if
you have SP3 on your windows2000 server you will not be infected with
SQLSlammer, this is absolutely NOT true, I have a box with sp3 and it IS
infected.

-Drew

2

They probably meant MS SQL Service Pack 3.

3

I think you'll find it's SP3 for SQLServer you need, not SP3 for Win2k.

Simon

4

Drew,

There *IS* a difference between windows SP3 and Microsoft SQL2000 SP3.. you
do know that right?

-Scotty

By the way, I know you guys probably don't care but McAfee is saying that

if

5

By the way, I know you guys probably don't care but McAfee is saying that if
you have SP3 on your windows2000 server you will not be infected with
SQLSlammer, this is absolutely NOT true, I have a box with sp3 and it IS
infected.

SP3 for W2K or SP3 for SQL Server? They are two different things...

C

6

Are you referring to Windows 2000 Service Pack 3 or MSSQL Service Pack 3?
If MSSQL Service Pack 3, approximately when would you guesstimate the patch
was installed?

Andrew

7

To clarify, we're talking about Microsoft SQL Server 2000, Service Pack 3, not the Windows 2000 Service Pack 3 (which also exists). Two completely different animals

I've got one machine with SQL 2K on it, and it, too, was infected. Then I installed SQL Server 2000 SP3, and put it back on the net. Just to be sure, I opened up port 1434 to it, and sat back and watched.

Lotta traffic to port 1434, but nothing happened. It got hit several times, and never joined the crowd spewing traffic.

If you have an infected machine, pull it off the 'net... immediately, if not sooner. Then go download the service pack for the SQL Server at:

http://www.microsoft.com/downloads/details.aspx?FamilyId=9032F608-160A-4537-A2B6-4CB265B80766&displaylang=en

Getting the 44 meg file over to the disconnected server is left as an exercise for the reader (remember SneakerNet?)

8

MSSQL SP 3