Virus Alert: More Slammer Details

The virus that slowed traffic on the Internet over the weekend and early Monday takes advantage of a vulnerability in Microsoft SQL Servers to send Denial of Service attacks against corporate network servers.

SQLSlammer caused some network disruptions Monday morning as U.S. workers returned to their jobs. The worm, first discovered in the U.S. on Friday, can cause e-mail services failure, network blocking and Internet connection slowdown.

Since home users and software developers can install SQL Server 2000 Desktop Engine in the Windows 98, Millenium, NT and 2000 Professional operating systems, SQLSlammer also can infect their computers, according to Panda Software officials.

To find out if you are running one of the affected products and for more information, visit this Microsoft page.

For alias information and technical details on the worm, visit this Symantec Web page.

This virus is not a mass-mailer and does not propagate through e-mail traffic. It can only spread as an in-memory process on unpatched Microsoft SQL Server 2000 and the Microsoft SQL Server Desktop Engine (MSDE), according to MessageLabs.

The impact makes accessing Web pages markedly slower and in some cases almost unusable. The virus is being compared in many ways with the CodeRed virus that hit the Internet in the summer of 2001.

The virus only exists in memory and never actually writes anything to the infected computer's hard disk, so traditional anti-virus scanners cannot detect it. Rebooting the server can clean an infected machine; however, it will soon get re-infected if the appropriate patches are not applied before reconnecting it to the Internet.

To download the patch that fixes the vulnerabilities found by the worm, go to this Microsoft page.

Sadhound.A Virus Discovered

Also over the weekend, the virus W32/Sadhound.A was intercepted by MessageLabs. While nothing has so far been confirmed, initial analysis suggests this is a dropper-program, depositing a mass-mailer with a backdoor and a mIRC component.

The copies that have been intercepted have all originated from the same IP address in the Netherlands and the e-mail may be composed as follows:

Subject:

I Miss You

The following text is contained in the e-mail body:

I Miss You...

Attachment file names include:

Bloods.jpg (11,507) -- a picture of a sad-looking bloodhound, hence the name

bgg.jpg (2,680) -- a background image

Missingyou.htm .pf.htm -- or Missingyou.pif (11,296) since the name and filename are different in the MIME header.

To check for updates on the virus, visit this MessageLabs site.

Compiled by Esther Shein.