Alert degree: ★★★★★★★ Attack time: random virus type: worm virus transmission mode: network infection object: network

Virus profile: 654381October 25th was intercepted by Rising Company for the first time in China. It takes advantage of the vulnerability of SQL Server 2000 system and uses the technology of "buffer overflow" to carry out network infection and network attack, thus causing serious harm to the network and server. At present, it has spread in a large area around the world, madly attacking the network, and causing paralysis of major network systems around the world in a short time! This virus is similar to the Red Team virus. It spreads directly in memory through vulnerabilities, not through files, emails and other media. It will create a large number of fake IP addresses and then attack them. Due to the aimless spread of this virus, the network will be seriously blocked, resulting in the complete paralysis of the SQL Server 2000 server and the obstruction of users' access to the Internet. We must make full use of network antivirus software, firewall, intrusion detection and other means to effectively prevent and eliminate harm. Discovery and removal of virus: This virus will have the following characteristics. If users find these features in their computers, they are probably infected with this virus: 1. The virus will send a specially formatted UDP packet with a packet length of 376 bytes to the port 1434 of the SQLServer server, and use the vulnerability of SQL Server to execute the virus code. In order to find virus attacks, only some network monitoring tools can be used. 2. The virus will seriously block the backbone network and make the SQL Server 2000 server refuse to serve, which means that users can't log on to some websites. 3. If users find all or part of the above phenomena in their computers, they are likely to be infected with "Worm.netkiller2003" virus.

Users can clear it in the following ways: 1. Unplug the network cable and patch the system. The address of patch download is: Microsoft system patch download:/service /service/technology/tool.htm3 For users of Rising Online Edition, please upgrade to the latest version, and then turn on memory monitoring to disinfect the whole network memory. 4. Users with firewalls can set it on the firewall or router: it is forbidden to access UDP/ 1434 port from outside to inside and from inside to outside.