Re: SQLsnake

[email protected] Wed, 22 May 2002 12:09:00 -0500

Newsgroups	gmane.org.user-groups.luni.general
Message-ID	<[email protected]>

On Wed, May 22, 2002 at 09:53:09AM -0500, Martin Maney wrote:
>   http://online.securityfocus.com/news/429

So _that's_ why I'm seeing so many port 1433 probes recently!

Thanks for the lead.  I've got several clients that use MS-SQL and
they might be vulnerable.

Here are some other URLs about this:

	http://www.incidents.org/diary/diary.php?id=156
	http://www.incidents.org/diary/diary.php?id_6

An infected system will have a (hidden) services.exe file in
system32\drivers.

-- 
Fred Yankowski      [email protected]           tel: +1.630.879.1312
OntoSys, Inc	    PGP keyID: 7B449345        fax: +1.630.879.1370
www.ontosys.com     38W242 Deerpath Rd, Batavia, IL 60510-9461, USA