Robert Fox wrote:
Main Mandrake Cooker site: sunsite.uio.noit's because of a major worm attack friday night saturday morning on ms sqlserver 2000. over 22000 systems were infected with the worm at the beginning of the attack and not all have been cleaned yet.
I use it frequently using rsync and fmirror
In the last few days, the performance has dropped dramatically. Is it
just me? or is everyone experiencing this?
I have a 2.3M ADSL line in Germany - here's the trace:
[root@foxbase rfox]# traceroute sunsite.uio.no
traceroute to spheniscus.uninett.no (158.36.2.10), 30 hops max, 38 byte
packets
1 217.5.98.64 (217.5.98.64) 57.151 ms 57.127 ms 52.929 ms
2 217.237.153.234 (217.237.153.234) 51.437 ms 50.971 ms 51.963 ms
3 62.154.32.86 (62.154.32.86) 56.727 ms 57.190 ms 69.081 ms
4 62.67.38.241 (62.67.38.241) 76.290 ms 73.971 ms 73.863 ms
5 ae0-20.mp2.Hamburg1.Level3.net (195.122.140.202) 74.434 ms 77.849
ms 73.969 ms
6 so-4-1-0.mpls2.Stockholm1.Level3.net (212.187.128.225) 97.708 ms 98.573 ms 97.781 ms
7 213.242.68.83 (213.242.68.83) 98.376 ms 98.635 ms 97.844 ms
8 213.242.69.18 (213.242.69.18) 838.370 ms 835.256 ms 846.024 ms
9 sw-gw.nordu.net (193.10.252.129) 841.173 ms 840.579 ms 838.895 ms
10 no-gw.nordu.net (193.10.68.30) 840.251 ms 840.422 ms 843.958 ms
11 oslo-gw1.uninett.no (193.10.68.50) 841.841 ms 852.246 ms 850.663
ms
12 spheniscus.uninett.no (158.36.2.10) 855.967 ms 856.664 ms 851.438
ms
[root@foxbase rfox]# ping sunsite.uio.no
PING spheniscus.uninett.no (158.36.2.10) 56(84) bytes of data.
64 bytes from spheniscus.uninett.no (158.36.2.10): icmp_seq=1 ttl=53
time=842 ms
64 bytes from spheniscus.uninett.no (158.36.2.10): icmp_seq=2 ttl=53
time=843 ms
64 bytes from spheniscus.uninett.no (158.36.2.10): icmp_seq=3 ttl=53
time=844 ms
64 bytes from spheniscus.uninett.no (158.36.2.10): icmp_seq=4 ttl=53
time=845 ms
64 bytes from spheniscus.uninett.no (158.36.2.10): icmp_seq=5 ttl=53
time=843 ms
--- spheniscus.uninett.no ping statistics ---
6 packets transmitted, 5 received, 16% packet loss, time 6272ms
rtt min/avg/max/mdev = 842.266/843.772/845.071/1.485 ms
It would appear that somewhere between Stockholm and Oslo there's a
problem.
How do I report this and to whom?
Thx,
R.Fox
the worm pings any sql server repeatedly, causing a dos and possible server crash. the exploit was patched almost 6 months ago, but the infected servers were never updated.
( a major backbone and routing hub in washinton dc area is still suffering the effects, and the sysadmins have been at work since early hours of satuday morning to get it cleaned and patched. ( apparently this center has over 1500 infected systems they have to rebuild while offline to clean them.))
