Re: Blaster Worm.... I think

From: Dave (noone_at_nowhere.com)
Date: 05/21/04 

Date: Fri, 21 May 2004 10:56:30 -0000

have you scanned only for blaster or do you have an up to date full virus
scanner? have you run scans for adware and spyware? is this machine
exposed to the internet directly or behind a firewall? sqlmangr i don't
think is the sql server itself, it is the interface that allows starting and
stopping the server, but on my older system it is named sqlmgr.exe, now
maybe they have changed the name but it makes me suspicious of it to start
with. and blaster was an rpc exploit, wasn't it 'slammer' that was the sql
worm??

"David Sampson" <sampson@directlink.net> wrote in message
news:esf18nvPEHA.3420@TK2MSFTNGP11.phx.gbl...
> for over a year I have been dealing with, what I think, is the Blaster
Worm
> on my machine.
>
> The symptom I experience is that when ever I activate ms sql server...
after
> a few minutes sqlserver begins taking over my outbound internet
connection.
> eventually I can't get anything coming in or out.
>
> When I open up Task Manager I can see sqlmangr.exe taking over my CPU,
using
> up 100% of my CPU time.
>
> The only way I know of to get out of this state is to reboot and not
> activate SQL Server... which makes it impossible to do any development on
> this machine.
>
> I have run blasterfix.exe (I think that is what it is called). I have
> scanned my machine with the software suggested by microsoft by Symantec
and
> 3 other 3rd parties. One displayed a msg box saying it found the worm and
> deleted it. None of the other 3 scan's indicated finding anything. So....
I
> rebooted, thinking that it was finally gone, but after starting sqlserver
> again the symptoms returned.
>
> I even reinstalled my operating system a few months ago (for a different
> reason) and unintalled and reinstalled sql server.... but this symptom
> remains.
>
> Any thoughts or suggestions???
>
> David
>
>