KB 253

Why do you keep sending me info about some slammer worm?

Article:253
Created:2003-09-17 11:36:32
Categories:
  Windows 98
  Windows NT 4
  Virus Information
  Windows 2000
  Windows XP

Question or Symptom

I keep getting notifications from you that one of my machines has the Slammer worm. What is that and what do I do about it?

Resolution

The Slammer Worm is a worm that targets the systems running Microsoft SQL Server 2000, as well as Microsoft Desktop Engine (MSDE) 2000. The worm sends 376 bytes to UDP port 1434, the SQL Server Resolution Service Port. Because the Worm seeks to infect other systems it can fill up your pipe to the internet and cause other systems on your network problems trying to reach the internet.

We receive reports for several monitoring organizations when a machine in our IP space is probing for other machines to infect, or otherwise sending out virus or worm related traffic.

The URLs below give you some information on how the worm works, how to get rid of it, and what patches you need to apply to keep from getting re-infected.

Related URLS

 http://www.microsoft.com/security/slammer.asp
 http://securityresponse.symantec.com/avcenter/venc/data/w32.sqlexp.worm.html