Help Please!

[ChArMs_RT142]

Heya people's my internet has been getting halted by trend micro saying

MS02-039_SQL_SERVER_RESOLUTION_EXPLOIT

What does that mean ? how can i fix it!?

Its started happening few weeks ago did scans and still comes up stupid crap

[Conquest]

Looks like it is some sort of SQL server vulnerability whatever that means but basically you have been infected with malicious software. However lucky for you it doesn't seem to be a problem for Windows XP but I guess the pop up is still annoying.

This site tells you how to patch your system;

http://www.trendmicro-middleeast.com/enter...;VAdvisories=14

You could try Trend Micro housecall and see what that finds

http://housecall.trendmicro.com/

Failing that i'd recommend starting Windows in safe mode and running Adaware, Spybot & Anti Virus Scans...

Edited January 14, 2007 by Conquest

[ChArMs_RT142]

Thanks Conquest did a online scan nothing came up

wanting to know what patch i need to download

[Conquest]

Have you tried scanning your system in safe mode?

Anyway as I said unless you are running an SQL server (and chances are you're not) then you have nothing to worry about.

There is a patch here;

http://www.microsoft.com/downloads/details...;DisplayLang=en

But I doubt whether it it will make any difference, otherwise you could also just try blocking UDP port 1434 on your modem or router.

EDIT: Blocking the port is probably the easiest way to fix it, I don't know whether your modem/router has a built in firewall but mine is set to block almost all incoming connections.

EDIT 2: You can test your port on this site - https://www.grc.com/port_1434.htm - and click 'probe port'

If it shows as open then you should block it through either your hardware or software firewall...

Edited January 15, 2007 by Conquest

[ChArMs_RT142]

Haven't gotten a chance to restart the computer yet lol i'll do it today though

downloaded the patch but dont know what to open it with :o

Had a look at modem folder cant see and firewall or settings with a name UDP port 1434

I'll go to the site you wrote and see what comes up thanks heaps for helping :)

Done the test says Status = Stealth :o

[Conquest]

Done the test says Status = Stealth :o

Well that's a good sign, I dunno what else you can do then

[ChArMs_RT142]

I though stealth ment open?

How do i install the patch it says open with program but too many to select lol

Sheesh I Dont Like Computers

[silver_stivo]

Hey Charms,

As conquest has pointed out this vulnerability will not affect your system (assuming your running windows Xp), This popup message has been displayed due to a some malicious code trying to visit your system and your internet security/virus software is making you aware of this.

here is a paragraph I found on a security bulletin from Trend Micro regarding this warning message.

IMPORTANT NOTE:

This detection is not a detection for the vulnerability of your machine. If you got this warning, it is an indication that a malicious piece of code passed through your network or your machine, but was detected by Trend Micro as MS02-039_SQL_SERVER_RESOLUTION_EXPLOIT.

if you wish to disable these messages here are some further instructions on how to do so, just be aware this will stop all warning messages from being displayed.

Disabling Network Virus Emergency Center Pop-ups

If you have already patched your system, and want to turn the pop-up messages off, please refer to the following Knowledge Base solutions:

* For PC-cillin Internet Security 2005 Users:

<a href=http://kb.trendmicro.com/solutions/solutionDetail.asp?solutionID=22606>Knowledge Base Solution ID 22606</a>

* For PC-cillin Internet Security 2004 Users:

<a href=http://kb.trendmicro.com/solutions/solutionDetail.asp?solutionID=22608>Knowledge Base Solution ID 22608</a>

Note: Disabling the network virus pop-up display option means you will not be alerted for ALL network attacks to your system, not just this particular exploit attack.

I'm not sure what trend software you are using SO i have included all the information that might be relevant and at least helpful.

As to why your internet is stopping, I can only do some basic troubleshooting and guessing.

also, to ensure your PC is upto date with the microsoft patches, check that the windows update service on your PC is set to automatic.

I hope this will be helpful!

[Conquest]

I though stealth ment open?

Nah stealth is good, it means that that port cannot be seen from the internet.

You can try putting a special rule into your firewall blocking any connection attempts on that port but i'm not sure if that would make a difference.

How do i install the patch it says open with program but too many to select lol

Well it's an .exe file so normally you just double click it and it should run. The system requirements also say that you need to install the SQL Service Pack 2 (I don't know whether that makes a difference) but IMO that's probably a waste of time for something you won't use.

if you wish to disable these messages here are some further instructions on how to do so, just be aware this will stop all warning messages from being displayed.

As to why your internet is stopping, I can only do some basic troubleshooting and guessing.

Hmm I just guessed it was stopping when these messages came up & while you can disable the messages that doesn't really fix the problem.

also, to ensure your PC is upto date with the microsoft patches, check that the windows update service on your PC is set to automatic.

Yep that's some good advice, or at least set it to notify you of new updates.

You could also visit http://update.microsoft.com and do an express install to patch any high priority security risks assuming your copy of Windows is legitimate ;)

Edited January 15, 2007 by Conquest

[ChArMs_RT142]

i dont know if my windows in legit laptop is secondhand

the exe file patch i downloaded said i have to extract to i did then a couple files came out of it hence why i ask which program to open with cause thats what it says :o

ill run another scan in safe mode didnt work proply b4

[alarum]

i dont know if my windows in legit laptop is secondhand

If you check the base of the laptop, if there's a sticker with a code on it, the laptop has a legit version of Windows on it. Otherwise, it's an illegal copy :D

[ChArMs_RT142]

i have a sticker underneath with code

Question i use firefox could it be the problem?

As of trying to do a scan in safe mode can not do it ! says:

no network device was found or there is a conflict with excisting antivirus or security software .. only virus scan& security scan but doesn't says i need to unistall conflicting software or connect to a network & restart the program

jeeee willlyyy i sayy! LoL

[Conquest]

i have a sticker underneath with code

Question i use firefox could it be the problem?

Heh well that certainly isn't a problem ;) And if your code is good then you should be able to update from Microsoft, the only reason I suggested it is because if you're running an illegal copy then the Windows Validation tool might screw up your computer..

As of trying to do a scan in safe mode can not do it ! says:

no network device was found or there is a conflict with excisting antivirus or security software

Are you talking about a local scan or are you trying to use that housecall link I gave earlier?

If you want to get onto the net then you need to go into safe mode 'with networking' however if you're trying to run Adaware/Spybot etc then there shouldn't be a problem...

[ChArMs_RT142]

oh ok i get ya .

Um trend micro im talking about the one i bought and install on my computer..

ill do the scan with safe mode networking tommorow .. ive done it normaly nothing can up with trend micro house call

adware/spybot works just trend micro doesnt