advice about a worm intrusion alert

XP Home, limited user account. Newbie to this group - I know next to
nothing about ports but am an experienced computer user otherwise.
Can anyone interpret this for me - just started to get these recently -
this is only the second one. Got it while using a user account in my XP
Home machine.
Security Alert - Medium Rick
Norton Internet Worm Protection has detected and blocked an intrusion
attempt.
The text in More Info was as follows:
Intrusion: MS SQL PacketResolution DoS
Intruder: 192.168.1.1 (domain(53))
Risk Level: Medium.
Protocol: UDP
Attacked IP: COMPUTER NAME (192.168.1.2)
Attacked Port: ms-sql-m(1434)
The Intruder address was my router, to which one Win98SE computer is
connected by ethernet (not mentioned in report) and the other on the
192.168.1.2 address is my XP Home machine, wirelessly connected to the
router.
I clicked OK and then the wireless connection lost its IP and
connectivity - and I had no internet access on the wireless XP machine.
Router was still connected to internet fine - all lights glowing properly.
Computer upstairs 192.168.1.3 was on and could connect to the internet -
no one was using it at the time of the alert. It has Zone Alarm free
version to prevent any outgoing stuff, and also NAV and Spybot S&D
resident (teatimer). It is on Win98SE. No alerts showing.
This machine runs Windows XP Home (user account) has NAV, Counterspy and
Zone Alarm free. Wireless network is WPA-PSK with 63 character pw.
Log off and on did not restore the wireless (always does usually).
Log off and then on to Admin acct - again wireless network did not work
but I got a windows error - windows is recovering from a serious error.
Still no connection.
Did a warm reboot and then everything was back to normal.
I do a Norton AV and Counterspy scan daily. Clear.
I think all the Windows/wireless hassle was due to the Norton blocking
the request, and I think the "intrusion" was legitimate - but I don't
want to "allow" it unless someone can explain the details to me. Many
thanks to any network gurus who can interpret please.
Rev Robert M Jones, Wimborne Baptist Church, UK
http://www.wimborne-baptist.org.uk
Free trial of Mailwasher Pro - effective email spam filter - (commission
goes to our partners in Bulgaria)
http://fta.firetrust.com/index.cgi?id=420Port 1434 is the SQL Browser service used for locating SQL Servers.
I would NOT allow Ports 1434 or 1433 to be open to the outside.
Is this a NAT router directly connected to your DSL/Cable modem?
Arnie Rowland, Ph.D.
Westwood Consulting, Inc
Most good judgment comes from experience.
Most experience comes from bad judgment.
- Anonymous
You can't help someone get up a hill without getting a little closer to the
top yourself.
- H. Norman Schwarzkopf
"Robert M Jones" <robert53newsgroups-ms2@.NOSPAMyahoo.co.uk> wrote in message
news:uTWSOL$DHHA.4620@.TK2MSFTNGP04.phx.gbl...
> XP Home, limited user account. Newbie to this group - I know next to
> nothing about ports but am an experienced computer user otherwise.
> Can anyone interpret this for me - just started to get these recently -
> this is only the second one. Got it while using a user account in my XP
> Home machine.
> Security Alert - Medium Rick
> Norton Internet Worm Protection has detected and blocked an intrusion
> attempt.
> The text in More Info was as follows:
> Intrusion: MS SQL PacketResolution DoS
> Intruder: 192.168.1.1 (domain(53))
> Risk Level: Medium.
> Protocol: UDP
> Attacked IP: COMPUTER NAME (192.168.1.2)
> Attacked Port: ms-sql-m(1434)
> The Intruder address was my router, to which one Win98SE computer is
> connected by ethernet (not mentioned in report) and the other on the
> 192.168.1.2 address is my XP Home machine, wirelessly connected to the
> router.
> I clicked OK and then the wireless connection lost its IP and
> connectivity - and I had no internet access on the wireless XP machine.
> Router was still connected to internet fine - all lights glowing properly.
> Computer upstairs 192.168.1.3 was on and could connect to the internet -
> no one was using it at the time of the alert. It has Zone Alarm free
> version to prevent any outgoing stuff, and also NAV and Spybot S&D
> resident (teatimer). It is on Win98SE. No alerts showing.
> This machine runs Windows XP Home (user account) has NAV, Counterspy and
> Zone Alarm free. Wireless network is WPA-PSK with 63 character pw.
> Log off and on did not restore the wireless (always does usually).
> Log off and then on to Admin acct - again wireless network did not work
> but I got a windows error - windows is recovering from a serious error.
> Still no connection.
> Did a warm reboot and then everything was back to normal.
> I do a Norton AV and Counterspy scan daily. Clear.
> I think all the Windows/wireless hassle was due to the Norton blocking the
> request, and I think the "intrusion" was legitimate - but I don't want to
> "allow" it unless someone can explain the details to me. Many thanks to
> any network gurus who can interpret please.
> --
> Rev Robert M Jones, Wimborne Baptist Church, UK
> http://www.wimborne-baptist.org.uk
> Free trial of Mailwasher Pro - effective email spam filter - (commission
> goes to our partners in Bulgaria)
> http://fta.firetrust.com/index.cgi?id=420|||Arnie Rowland wrote:
> Port 1434 is the SQL Browser service used for locating SQL Servers.
> I would NOT allow Ports 1434 or 1433 to be open to the outside.
> Is this a NAT router directly connected to your DSL/Cable modem?
>
Thanks for the reply. This is all a mystery to me.
Set up is an ADSL Router with NATS firewall incorporated. I have Skype
if that is relevant - the entry for that against its icon in Zone Alarm
is "Listening to Port(s) TCP:80,443,14695"
The router is set with IP Filtering enabled, for filtering inbound
traffic - there are no entries in the table in that section.
The section on Virtual Server Configuration DMZ host has:
"Those IP packets from the Internet that do NOT belong to any
applications configured in the port forwarding table will be: Discarded"
There is nothing set up in the port forwarding section
Any more checking I should do? The router NATS seems to do its job in
terms of the Shields Up tests, but I haven't then disabled the NATS to
test the actual ZA software firewall on the machine itself.
Rev Robert M Jones, Wimborne Baptist Church, UK
http://www.wimborne-baptist.org.uk
Free trial of Mailwasher Pro - effective email spam filter - (commission
goes to our partners in Bulgaria)
http://fta.firetrust.com/index.cgi?id=420|||>>> On 11/24/2006 at 11:03 AM, in message
<uTWSOL$DHHA.4620@.TK2MSFTNGP04.phx.gbl>, Robert M
Jones<robert53newsgroups-ms2@.NOSPAMyahoo.co.uk> wrote:
> Security Alert - Medium Rick
> Norton Internet Worm Protection has detected and blocked an
> intrusion
> attempt.
> The text in More Info was as follows:
> Intrusion: MS SQL PacketResolution DoS
> Intruder: 192.168.1.1 (domain(53))
> Risk Level: Medium.
> Protocol: UDP
> Attacked IP: COMPUTER NAME (192.168.1.2)
> Attacked Port: ms-sql-m(1434)
Do you even have SQL installed on your machine? My guess is that you
don't.
As a result, port 1434 is not used by any specific program, but is
available for any program that needs a new UDP port to use.
Because of this, the DNS resolver is using it to make a DNS request
(your name server is probably set as 192.168.1.1). Your DNS server
responds to port 1434. However, Norton incorrectly classifies this as
an attack. It probably isn't.|||Joel Maslak wrote:
> <uTWSOL$DHHA.4620@.TK2MSFTNGP04.phx.gbl>, Robert M
> Jones<robert53newsgroups-ms2@.NOSPAMyahoo.co.uk> wrote:
> Do you even have SQL installed on your machine? My guess is that you
> don't.
> As a result, port 1434 is not used by any specific program, but is
> available for any program that needs a new UDP port to use.
> Because of this, the DNS resolver is using it to make a DNS request
> (your name server is probably set as 192.168.1.1). Your DNS server
> responds to port 1434. However, Norton incorrectly classifies this as
> an attack. It probably isn't.
That's sort of what I thought - but until I can be sure I did not want
to give Norton any instructions to allow or remember - just saying "ok"
when I get the block message.
Any advice on checking I can do (other than routine AV and spyware
scans) most welcome.
Rev Robert M Jones, Wimborne Baptist Church, UK
http://www.wimborne-baptist.org.uk
Free trial of Mailwasher Pro - effective email spam filter - (commission
goes to our partners in Bulgaria)
http://fta.firetrust.com/index.cgi?id=420sql

AdventureWorks Sample Reports

Hi folks,

Newbie question. Anyone knows how to create dropdown selection boxes in a report just like in the Employee Sales Summary report? Cheers!

Moving thread to the Reporting Services Group|||

If you install the sample reports, you can just open them in report designer and investigate the Report - Report Parameter settings in the VS menu. The Employee Sales Summary report uses a query to determine the valid values list of the parameter - which results in the drop down being shown.

Alternatively, this MSDN topic should get you started: http://msdn2.microsoft.com/en-us/library/ms155917.aspx

-- Robert

Adventureworks sample reports

Newbie Q. Can I view Adventureworks sample reports with SSX? Storefront? Thanks.

Sorry - what is SSX?

Regarding Storefront - do you mean these folks: http://www.storefront.com/?

What is it you're trying to do? Do you mean can you deliver reports to be printed using a standard online printing solution? If so then yes it is possible. No we can't do it out of the box, but you can write a delivery extension to send report output to the online service provider if they expose an API for submitting requests programmatically. You can learn about delivery extensions here: http://msdn2.microsoft.com/library/ms154672.aspx

Hope that helps,

-Lukasz

This posting is provided "AS IS" with no warranties, and confers no rights.

|||

Hi Lukasz,

I have seen other posts refering to SQL Server Express using the acronym SSX.

I have been trying to run Adventureworks samples/reports and keep getting error messages that I don't have the application/version to load/run files with the extension .csproj or .rptproj. I have downloaded/installed SSX, Adventureworks samples, VBX, CSX, Visual Web Developer, SSNSX and the .Net Framework 2.0 SDK.

Storefront is a sample project included in the Adventureworks sample package. It is intended to illustrate a sample web page for the fictitous Adventureworks company.

I wish to be able to view sample reports included in the sample package.

I have been successful at connecting to the database. I can view database stucture/tables/links. I have not been able to view a report, form or any "front-end" views.

Being new to these programs and this level of programing, I don't know if I the programs listed above lack this functionality or if I haven't gone thru the correct procedures to run/view these samples.

Any help would be greatly appreciated.

Thanks in advance,

Randy

|||

Wow - was I ever off the mark .

Ok - here's what you're looking for. I don't know about csproj - I don't think the web developer allows you to compile C# projects. You might need to invest in a full edition of Visual Studio 2005 C# to be able to compile these.

In order to handle rptproj you'll need to download the evaluation edition of reporting services (http://www.microsoft.com/sql/downloads/trial-software.mspx) and install the report designer component.

SQL Server Express (also SSX/SSE, adnausium) doesn't come with Reporting Services yet - we're working on a SKU that provides this functionality as we speak. So you'll need the evaluation edition of reporting services.

Hope that helps,

-Lukasz

This posting is provided "AS IS" with no warranties, and confers no rights.

sql

Advanced SELECT for a newbie

I have a table full of Latitudes, Longitudes, address, customername, etc. , I need to grab some input(Latitude, Longitude, range) from the user. So now I have a source lat, long(user) and destination lat, long(rows in dbase). I need to take the 2 points and compute a distance from the user given lat, long to every lat, long in the database and check that distance againt the range given from the user. If the distance is below the range, I need to put that row into a temp table and return the temp table at the end of the stored proc.

As of right now I am completely lost and need some guidance.

I would also like to be able to add the computed distance to a table. Here is the function and stored procedure i have so far...

ALTER PROCEDURE [dbo].[sp_getDistance]

@.srcLat numeric(18,6),
@.srcLong numeric(18,6),
@.range int
AS
BEGIN
SET NOCOUNT ON;

SELECT * FROM dbo.PL_CustomerGeoCode cg
WHERE dbo.fn_computeDistance(@.srcLat, cg.geocodeLat, @.srcLong, cg.geocodeLong) < @.range

END

CREATE FUNCTION fn_computeDistance
(
-- Add the parameters for the function here
@.lat1 numeric(18,6),
@.lat2 numeric(18,6),
@.long1 numeric(18,6),
@.long2 numeric(18,6)
)
RETURNS numeric(18,6)
AS
BEGIN
-- Declare the return variable here
DECLARE @.dist numeric(18,6)

IF ((@.lat1 = @.lat2) AND (@.long1 = @.long2))
SELECT @.dist = 0.0
ELSE
IF (((sin(@.lat1)*sin(@.lat2))+(cos(@.lat1)*cos(@.lat2)*cos(@.long1-@.long2)))) > 1.0
SELECT @.dist = 3963.1*acos(1.0)
ELSE
SELECT @.dist = 3963.1*acos((sin(@.lat1)*sin(@.lat2))+(cos(@.lat1)*cos(@.lat2)*cos(@.long1-@.long2)))

-- Return the result of the function
RETURN @.dist

Thanks,

Kyle

What's the problem you're facing? If you want to add a computed column for the distance to the table, you can use something like:

ALTER TABLE dbo.PL_CustomerGeoCode ADD ComputedDistance AS dbo.fn_computeDistance(@.srcLat, cg.geocodeLat, @.srcLong, cg.geocodeLong)

advanced parameter tutorial, lesson 5, multipart identifier error

Hello,

Hope I'm asking this question in the correct forum.

I'm a newbie in Reporting Services and currently working my way through the tutorials with AdventureWorks. Came across this error while doing the MSDN tutorial for Advanced Features, lesson 5 - user defined functions.

http://msdn2.microsoft.com/en-us/library/aa337435.aspx

Created a new report, copied the following to the query screen:

SELECT udf.ContactID, udf.FirstName + N' ' + udf.LastName AS Name,
c.Phone, c.EmailAddress, udf.JobTitle, udf.ContactType
FROM ufnGetContactInformation(@.ContactID) udf
JOIN Person.Contact c ON ufn.ContactID = c.ContactID

I'm following the directions to the letter, and consistently get the following error:

"The multi-part identifier "ufn.ContactID" could not be bound."

"The multip-part identifier "ufn.ContactID" could not be bound. (Microsoft SQL Server, Error: 4104)"

I'm running SQL 2005 Enterprise on Windows XP.

Any help you can give will be much appreciated! Thank you.

Looks like typo in a sample query

try udf.ContactID instead of ufn.ContactID

|||Thank you very much! Now it works.

admin realted questions

Hi

Few questions more newbie kind of things hope you can help out:

1- SQL 2000 on Windows 2000 ( and XP ), how can I utilize performance
monitoring tools on a daily basis to detect workload, usage and keep
it in a text file as a base line. What are thye most important parms
to set? Is perf monitor is part of SQL server or part of win2k or both
exacyly same?

2- Current activity in EM, has process info, locks/P ID and lock
Object. When these things can be really useful? Do I have to watch
them manually or is the a way to set it up? Is scripts do the better
job?

3- how can I see how much physical mem sql server used? how is the
process and memeory utilization? Can I set alarm if it goes very up I
get inform. How

4- Some basic scripts but important for daily DB check?

Thankssoalvajavab1@.yahoo.com (David McGeorge) wrote in message news:<bc907f76.0407271400.4e764384@.posting.google.com>...
> Hi
> Few questions more newbie kind of things hope you can help out:
> 1- SQL 2000 on Windows 2000 ( and XP ), how can I utilize performance
> monitoring tools on a daily basis to detect workload, usage and keep
> it in a text file as a base line. What are thye most important parms
> to set? Is perf monitor is part of SQL server or part of win2k or both
> exacyly same?

Performance monitor is an operating system tool, and it has numerous
counters for monitoring MSSQL. Check out "Monitoring Server
Performance and Activity" in Books Online for information about it,
and other tools such as Profiler. You might also find this helpful:

http://www.sql-server-performance.com/q&a84.asp

>
> 2- Current activity in EM, has process info, locks/P ID and lock
> Object. When these things can be really useful? Do I have to watch
> them manually or is the a way to set it up? Is scripts do the better
> job?

When one process is blocking another, you can use this information to
see what's going on, although personally I prefer sp_who2 for that
purpose.

>
> 3- how can I see how much physical mem sql server used? how is the
> process and memeory utilization? Can I set alarm if it goes very up I
> get inform. How

Performance Monitor can tell you the memory used by any process,
including MSSQL, and you can set alerts based on a threshold, either
from Perfmon itself or from the SQL Server Agent alerts dialogue. Note
that MSSQL will take all the memory on the server by default (unless
you configure it not to) - this is not a bad thing, unless you have
other applications running on the same server.

> 4- Some basic scripts but important for daily DB check?

Probably the easiest way to get going quickly is to create a
maintenance plan in Enterprise Manager. The plan can backup your
databases and/or perform integrity checks on them.

Simon