Greetins to one and all.

Running Win-XP-Pro/SP2 with all the latest updates.

According to the good folkes at securityresponse.symantec.com this is
normally a server problem. Hell I don't even have MS Office installed.

After my Norton Firewall pops up to brag about blocking the *MS SQL
PacketResolution DoS attact* I am than unable to resume my life on the
internet for about an hour.

I have a 2Wire 1000SW DSL modem/router/firewall.

Any ideas what's going on. Found very little on Google. Looks like onle one
outher person has had this bug.

Image of buggy=boo
http://wipkip.us/PacketResolution.png

--
D?

In article <Xns989ABE5399EBBHi@207.115.17.102>, Duende wrote:

> According to the good folkes at securityresponse.symantec.com this is
> normally a server problem. Hell I don't even have MS Office installed.
>
> After my Norton Firewall pops up to brag about blocking the *MS SQL
> PacketResolution DoS attact* I am than unable to resume my life on the
> internet for about an hour.

The Microsoft SQL Server 2000 Desktop Engine (MSDE) is a
freely-distributable, stripped-down version of SQL Server meant to be
packaged with applications that need a database backend. I believe the
SQL 2005 version is called SQL Server 2005, Express Edition.

You can download it at no cost from Microsoft, and I bet there are a
fair number of apps that use it.

If you're running something newer than 98 or Millenium Edition, you
can check whether it's installed by looking for the MSSQL Service in
the Service Control Manager...

And if it is installed, you're probably vulnerable.



--
Steve Sobol, Professional Geek ** Java/VB/VC/PHP/Perl ** Linux/*BSD/Windows
Victorville, California PGP:0xE3AE35ED

It's all fun and games until someone starts a bonfire in the living room.

On 15 Dec 2006 Steven J. Sobol wrote in alt.www.webmaster

> In article <Xns989ABE5399EBBHi@207.115.17.102>, Duende wrote:
>
>> According to the good folkes at securityresponse.symantec.com this is
>> normally a server problem. Hell I don't even have MS Office installed.
>>
>> After my Norton Firewall pops up to brag about blocking the *MS SQL
>> PacketResolution DoS attact* I am than unable to resume my life on the
>> internet for about an hour.
>
> The Microsoft SQL Server 2000 Desktop Engine (MSDE) is a
> freely-distributable, stripped-down version of SQL Server meant to be
> packaged with applications that need a database backend. I believe the
> SQL 2005 version is called SQL Server 2005, Express Edition.
>
> You can download it at no cost from Microsoft, and I bet there are a
> fair number of apps that use it.
>
> If you're running something newer than 98 or Millenium Edition, you
> can check whether it's installed by looking for the MSSQL Service in
> the Service Control Manager...
>
> And if it is installed, you're probably vulnerable.
>
>

Nothing like that running. Very strange. Just started today and did it
twice.

Thanks Steven

--
D?

Fleeing from the madness of the http://yorkshirepete.com/ jungle
Duende <EMAIL REMOVED> stumbled into news:alt.www.webmaster
and said:

> Greetins to one and all.

How-de-doo-dah

> Running Win-XP-Pro/SP2 with all the latest updates.
>
> According to the good folkes at securityresponse.symantec.com this is
> normally a server problem. Hell I don't even have MS Office installed.
>
> After my Norton Firewall pops up to brag about blocking the *MS SQL
> PacketResolution DoS attact* I am than unable to resume my life on the
> internet for about an hour.

Does Norton uindicate if the DoS is incoming or outgoing?

> I have a 2Wire 1000SW DSL modem/router/firewall.

Does your firewall generate any useful logs?

Never heard of that particular issue but a DoS would indicate some type
type of network flooding.

--
William T***o

http://williamt***o.com/words/what-is-usenet.asp

On 15 Dec 2006 William T***o wrote in alt.www.webmaster

> Fleeing from the madness of the http://yorkshirepete.com/ jungle
> Duende <EMAIL REMOVED> stumbled into news:alt.www.webmaster
> and said:
>
>> Greetins to one and all.
>
> How-de-doo-dah
>
>> Running Win-XP-Pro/SP2 with all the latest updates.
>>
>> According to the good folkes at securityresponse.symantec.com this is
>> normally a server problem. Hell I don't even have MS Office installed.
>>
>> After my Norton Firewall pops up to brag about blocking the *MS SQL
>> PacketResolution DoS attact* I am than unable to resume my life on the
>> internet for about an hour.
>
> Does Norton uindicate if the DoS is incoming or outgoing?

It indicates that my computer is the intruder as ar as I know. So that
would be outgoing

>
>> I have a 2Wire 1000SW DSL modem/router/firewall.
>
> Does your firewall generate any useful logs?

12/15/2006 10:41:22 PM,Intrusion: MS SQL PacketResolution DoS.,
Intrusion: MS SQL PacketResolution DoS.
Intruder: 172.16.0.1(53).
Risk Level: Medium.
Protocol: UDP.
Attacked IP: 0.0.0.0.
Attacked Port: ms_sql-m(1434).

172.16.0.1 is my default gateway.
I have no idea what IP: 0.0.0.0 is.

>
> Never heard of that particular issue but a DoS would indicate some type
> type of network flooding.
>

--
D?

On Sat, 16 Dec 2006 08:29:24 +0000, Duende wrote:

> On 15 Dec 2006 William T***o wrote in alt.www.webmaster
>
>> Fleeing from the madness of the http://yorkshirepete.com/ jungle
>> Duende <EMAIL REMOVED> stumbled into news:alt.www.webmaster
>> and said:
>>
>>> Greetins to one and all.
>>
>> How-de-doo-dah
>>
>>> Running Win-XP-Pro/SP2 with all the latest updates.
>>>
>>> According to the good folkes at securityresponse.symantec.com this is
>>> normally a server problem. Hell I don't even have MS Office installed.
>>>
>>> After my Norton Firewall pops up to brag about blocking the *MS SQL
>>> PacketResolution DoS attact* I am than unable to resume my life on the
>>> internet for about an hour.
>>
>> Does Norton uindicate if the DoS is incoming or outgoing?
>
> It indicates that my computer is the intruder as ar as I know. So that
> would be outgoing
>
>>
>>> I have a 2Wire 1000SW DSL modem/router/firewall.
>>
>> Does your firewall generate any useful logs?
>
> 12/15/2006 10:41:22 PM,Intrusion: MS SQL PacketResolution DoS.,
> Intrusion: MS SQL PacketResolution DoS.
> Intruder: 172.16.0.1(53).
> Risk Level: Medium.
> Protocol: UDP.
> Attacked IP: 0.0.0.0.
> Attacked Port: ms_sql-m(1434).
>
> 172.16.0.1 is my default gateway.
> I have no idea what IP: 0.0.0.0 is.

That means all IPs, so everyone is included

--
Dancin' in the ruins tonight
Tayo'y Mga Pinoy

In article <Xns989B4FA85A91Hi@207.115.17.102>, Duende wrote:

>> Does Norton uindicate if the DoS is incoming or outgoing?
>
> It indicates that my computer is the intruder as ar as I know. So that
> would be outgoing

At a Windows command prompt,

netstat -a -b

will show you open TCP and UDP ports and what has them open.

I ***ume Norton is fully updated to the latest virus/spyware defs...
right?

IP 0.0.0.0 means you have a program binding to all available IPs on
the computer. Nothing unusual, actually.

--
Steve Sobol, Professional Geek ** Java/VB/VC/PHP/Perl ** Linux/*BSD/Windows
Victorville, California PGP:0xE3AE35ED

It's all fun and games until someone starts a bonfire in the living room.

On 16 Dec 2006 Steven J. Sobol wrote in alt.www.webmaster

> In article <Xns989B4FA85A91Hi@207.115.17.102>, Duende wrote:
>
>>> Does Norton uindicate if the DoS is incoming or outgoing?
>>
>> It indicates that my computer is the intruder as ar as I know. So that
>> would be outgoing
>
> At a Windows command prompt,
>
> netstat -a -b
>
> will show you open TCP and UDP ports and what has them open.

Hey that was cool. If it happens again mabe I can find out what's causing
it.
>
> I ***ume Norton is fully updated to the latest virus/spyware defs...
> right?

Yup, Norton is as up-to-date as possible.
>
> IP 0.0.0.0 means you have a program binding to all available IPs on
> the computer. Nothing unusual, actually.
>

Thanks Steven,

--
D?