Virus Encyclopedia

Welcome to the Virus Encyclopedia of Panda Security.

Slammer
Threat Level Damage Distribution

Infection strategy 

Slammer follows the infection routine below:

• When it reaches the computer it goes memory resident.
• It loads three Winsock (network management standard) API functions:
  Socket and Sendto (WSW_32.DLL), in order to send itself out.
  GetTickCount (KERNELL32.DLL), to generate random IP addresses in order to try and infect other machines.
• It sends multiple packets containing the worm's code through port 1434.
• The worm constantly sends multiple packets, which results in a DoS (denial of service) attack on the port.

Slammer does not create or modify files or entries in the Windows Registry.

Means of transmission 

Slammer is sent to the affected server from another SQL server. Once it gets into the machine, Slammer looks for other machines that act as SQL servers in order to infect them. It does this by exploiting a buffer overrun vulnerability, which exists in servers that do not have Service Pack 3 installed.