AppDetective™ Update 2.5.34 - 22 May 2002

NEW CHECK

Microsoft SQL Server (Audit)

Title: Infected with Spida worm

Description: Check if Microsoft SQL Server is infected with the Spida worm.

Summary: The Spida worm is a self-propagating attack program that discovers SQL Server on the default port 1433. Once found it attempts to connect to sa with a blank password. If successful, it takes control of the machine, collects sensitive information on the local server, and attempts to propagate to other SQL Servers.