Applied SP2 for SQL 2000 now I have network issues

• PhazeZer0

  SSC Enthusiast

  Points: 142

  More actions

  June 10, 2002 at 9:48 pm

  #78584

  Hello,

  I am developer and new to SQL Server. I applied SP2, specifically

  Database Components and Analysis Services Components.

  Since this update I noticed traffic on my network when I was other wise idle.

  Here is some output.

  =======================

  Administrator@GAEA ~

  $ netstat

  Active Connections

  Proto Local Address Foreign Address State

  TCP gaea:1204 msgr-cs51.msgr.hotmail.com:1863 ESTABLISHED

  TCP gaea:2179 190.103.78.143:ms-sql-s SYN_SENT

  TCP gaea:2180 190.103.78.144:ms-sql-s SYN_SENT

  TCP gaea:2181 190.103.78.145:ms-sql-s SYN_SENT

  TCP gaea:2182 190.103.78.146:ms-sql-s SYN_SENT

  TCP gaea:2183 190.103.78.147:ms-sql-s SYN_SENT

  TCP gaea:2184 190.103.78.148:ms-sql-s SYN_SENT

  TCP gaea:2185 190.103.78.149:ms-sql-s SYN_SENT

  TCP gaea:2186 190.103.78.150:ms-sql-s SYN_SENT

  TCP gaea:2187 190.103.78.151:ms-sql-s SYN_SENT

  TCP gaea:2188 190.103.78.152:ms-sql-s SYN_SENT

  TCP gaea:2189 190.103.78.153:ms-sql-s SYN_SENT

  TCP gaea:2190 190.103.78.154:ms-sql-s SYN_SENT

  TCP gaea:2191 190.103.78.155:ms-sql-s SYN_SENT

  ...

  ..... it keeps going

  ==============

  Could someone point me in the right direction of where to look.

  I would like to at least know why this is happening.

  This behavior happens even if I stop all services on SQL Server

  Services Manager.

  Thanks in advance!

  Joe Curran

  Edited by - PhazeZer0 on 06/10/2002 9:52:42 PM

• Antares686

  SSC Guru

  Points: 125444

  More actions

  June 11, 2002 at 6:06 am

  #430654

  Wth AS take a look here and see if fits your situation http://support.microsoft.com/default.aspx?scid=kb;en-us;Q278325

  "Don't roll your eyes at me. I will tape them in place." (Teacher on Boston Public)

• PhazeZer0

  SSC Enthusiast

  Points: 142

  More actions

  June 12, 2002 at 4:53 pm

  #430759

  Thanks for the reply...

  It is more simple and embarrassing. It was the Spida Worm.

  this link has steps to remove the worm.

  http://www.eeye.com/html/Research/Tools/sqlworm.html

  Thanks again.

• Antares686

  SSC Guru

  Points: 125444

  More actions

  June 12, 2002 at 7:29 pm

  #430766

  Ouch, but at least it has been corrected and you learned something. I had nimda on one of our boxes we thought was patched but found SP2 on Windows 2000 removed that patch later. Happens, just have to be preparred to handle and looks like you got it.

  "Don't roll your eyes at me. I will tape them in place." (Teacher on Boston Public)