What to do if the system is attacked by Worm King

Virus name:

Virus signature: The worm attacks an NT-Series server with Microsoft SQL installed, the virus attempts to probe the 1434 UDP port of the attacked machine, and if the probe is successful, sends a 376-byte worm**. UDP port 1434 is an open port for Microsoft SQL.

This port has a buffer overflow vulnerability on the unpatched SQL Server platform, which gives the worm's subsequent ** an opportunity to run on the compromised machine for further propagation, causing the system to be paralyzed and out of service. Most of the attack targets are XP and NT, and 9X is not attacked

Solution: Upgrade the virus database of the antivirus software. Or with a killing tool. Installing a patch can also avoid being attacked, but individual users don't need it, and tools such as Kingsoft net darts can be intercepted, you can rest assured!

Don't use Jinshan, take a look at this forum.

**Kaspersky is very easy to use Its active defense capability is the most powerful, which can effectively prevent virus invasion! And the killing toxicity is also good, but I recommend you Kaba and Rising are both ** down, but don't open them all Set Kaba to boot up Rising Don't take Kaba to kill it again when you kill the virus, and then level Kaba and then open Ruixing to scan it again So that as long as your virus database is new, all viruses will be finished Explain why** 2 kill soft: because there is only one special code for Kaba's virus and Rising has two kinds of file special code and memory special code

If the virus escapes the Kaba file scan, it can exist in the system, and Rising scans the play files and then scans the memory, so it is recommended. However, Kaba's virus database is very comprehensive and very powerful, as long as you have a new virus database, it is difficult to escape Kaba's scanning.

Install a good firewall.

No way... A lot of ads... Isolation system files with gkr trial version do not continue to be modified injection + Trojan scavenger (trial version) scanning...

Restore it first to see if the virus is on the C drive, if not, then see if there are any suspicious files, and then delete it, and then it doesn't work, or reinstall the system. After installing it, the next antivirus software,Personally, I think it's Kaba and 360 to use。 Be careful when you drop something and don't place suspicious files.

Now that you've been blocked by Rising, what are you worried about?

Update the virus database and use a dedicated killing tool to detect and kill viruses.

First, your XP has been updated.

Second, you have Windows Firewall or some other firewall on.

In both cases, it is safe and has little impact on the system.

It doesn't matter, just prevent it.

Redo the program, and install a nod32 again

Turn on the automatic update function of the system and install the patch.

Wouldn't it be a firewall to ignore him?

Judging from what you said, it should be attacked by the Worm King!

If I'm not mistaken, you are using Rising antivirus software and Rising Firewall, I have also used Rising for a month is the same, Rising is not good with this, use it every day someone attacks, the last Trojan horse, the whole is a horse, and finally the grid is reloaded, now I don't want to send me Rising, I use Jiangmin + Micro Point + 360 instead, and the attack is much less.

This kind of virus will stay in the memory, you have to restart Press F8 to enter safe mode, use Trojan Killer or Trojan Scavenger to kill it, otherwise there will still be a virus in the reinstall system! I've had problems like this.

Is the firewall prompting you to say that you are protecting against the attack of Worm King?

If yes, then you don't need to do anything because there's a firewall there.

If not, install a firewall.

Your computer is safe, 360 is fine, it's Rising's problem, hehe.

At first glance, it is the Rising Firewall, and now only the Rising Firewall in the world's firewalls will prompt the "Worm King 2003 Attack". It's understandable that the product is backward, but it's unbearable to be backward like this.

If you look closely, the firewall should indicate the port, and this so-called "worm king attack" (actually Rising) is a connection attempt to the SQL database. This means that computers on the network are trying to connect to the SQL database on your computer (most computers don't have this software installed).

This is a very common intrusion attempt to scan a large number of computers on the Internet in the early stage (usually tens of millions of computers are scanned at once, and the time is also very fast, about 2 hours can be scanned). With a 1 in 1 million success rate, you don't have to worry about this kind of attack, as long as you don't have SQL installed on your computer (this software is not something we can use in our daily life, only professionals install it, and it is not available on our computers by default) you don't have to worry about this kind of attack.