Virus doing spam port scan on 1433

Posted on 2004-09-10
Last Modified: 2013-12-04
Several computers with SQL 2000 service pack 3a installed are doing this occasionally. And I discovered it's a executable which show up as "sysdevice.exe" under task manager that's doing it.

I have no idea how it got there or what triggered it to run at random times. I can't find this exe anywhere on my computer to get rid of it. Right now to prevent ISP police shutting down our internet we are having the firewall block all outgoing packet to port 1433 except our remote SQL server's IP.

Anyidea what this virus is and/or how to get rid of it?
Question by:gotdough
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 3
  • 3
  • 2
  • +1

Expert Comment

ID: 12031681
Are the systems running hp OpenVMS there are varns in that and you could be getting some issues from them.

Author Comment

ID: 12031695
No, I'm not running any of those. I think this might be a new virus
Threat Trends for MSPs to Watch

See the findings.
Despite its humble beginnings, phishing has come a long way since those first crudely constructed emails. Today, phishing sites can appear and disappear in the length of a coffee break, and it takes more than a little know-how to keep your clients secure.


Author Comment

ID: 12031715
I did complete check with Norton Spybot and Adaware all with latest updates under safe mode. Nothing came up.

Expert Comment

ID: 12032531

Gives more info on SQL's port 1433 usage.

Expert Comment

ID: 12033882
If you are part of a company, then any employee could have downloaded it from the web. There's some really nasty network-spreading viruses around, a lot of which hijack connections to send out messages or weaken the system. I recently got a virus which started off on a Windows XP system and managed to jump it's way through our wireless network untill all of the computers (asbout 20 or so) were infected. I had to totally disconnect us from the internet to stop hackers using the open ports the virus created to destroy our network. It took me weeks to fix, because it bound itself to other files. In the end I had to back up any documents we needed and re-format everything.

If the virus is running as "sysdevice.exe" try doing the following:
1) Start -> Run, type "regedit" (no quotes)
2) Navigate to "HKEY_LOCAL_MACHINE/SOFTWARE/Microsoft/Windows/CurrentVersion/Run"
3) Look for any values which contain "sysdevice.exe" in their data.
4) If you find any, go to step 5, otherwise, check "HKEY_CURRENT_USER/SOFTWARE/Microsoft/Windows/CurrentVersion/Run". If you still get nothing, skip the rest of this and read about MSConfig at the bottom of this answer.
5) Use Ctrl-Alt-Del to close the process, if it refuses to close, go to Start -> Run and type in "cmd", then type "taskkill /IM sysdevice.exe /F" (no quotes)
6) Find and delete the EXE file in explorer, the directory shown in the registry key you found. If it's not there, it may be hidden and you might not be showing hidden files. To show hidden files, click Tools -> Folder Options, go to the "View" tab, and make sure that "Show hidden files and folders" is selected.
7) Delete the registry value that attempts to run the virus at login by highlighting it (left-click) and pressing the "Delete" or "Del" key. You can also right click it and select "Delete".
8) Restart the computer. The virus should be gone.

If you couldn't find any bootup values, use MSConfig. To do this, click Start -> Run, and type "msconfig" (no quotes). Check for anything called sysdevice in the services tab and disable it. Also, look in the startup tab for any bootup values.

Hope it's useful!

Expert Comment

ID: 12033930
Oh yeah, I forgot to say this...

MSConfig will only delete the registry value, the file will still be there. You need to delete the file as well. I would suggest closing the virus process before you use MSConfig.

Another good idea is to Google the process name.
I just did it and it appears not to be a virus in the first place. It's a driver controller for OpenVMS that handles things like mailboxes and null drivers.

It goes to show that Google really is useful, and it should be the first place to check.

Oh well, what I said above is perfectly useful for removing viruses, if you want to stop the program, follow the anwer above but don't delete the file.

Accepted Solution

burningmace earned 125 total points
ID: 12033943
The program is probably triggered by somebody checking their mail, or a driver being loaded. I would leave it well alone to be honest. The "spam" is probably mail and some network communication. If the program is infected by a virus (which I very much doubt), Kaspersky Anti-Virus will find it. I'm not joking, it'll find Jesus in your RAM if you ask it to, hehe.
But seriously, this process is nothing to worry about.

Author Comment

ID: 12035660
Yeah I did go thru registry not only just under the Run folder but also did a complete search. Google doesn't show anything on sysdevice.exe either. I think this is just a brand new virus somehow.

The spam is what I have captured on packet sniffer, it port scans about 20 ip addresses every second. And it stopped once I terminates the exe

Featured Post

Get 15 Days FREE Full-Featured Trial

Benefit from a mission critical IT monitoring with Monitis Premium or get it FREE for your entry level monitoring needs.
-Over 200,000 users
-More than 300,000 websites monitored
-Used in 197 countries
-Recommended by 98% of users

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Container Orchestration platforms empower organizations to scale their apps at an exceptional rate. This is the reason numerous innovation-driven companies are moving apps to an appropriated datacenter wide platform that empowers them to scale at a …
OfficeMate Freezes on login or does not load after login credentials are input.
NetCrunch network monitor is a highly extensive platform for network monitoring and alert generation. In this video you'll see a live demo of NetCrunch with most notable features explained in a walk-through manner. You'll also get to know the philos…
Monitoring a network: why having a policy is the best policy? Michael Kulchisky, MCSE, MCSA, MCP, VTSP, VSP, CCSP outlines the enormous benefits of having a policy-based approach when monitoring medium and large networks. Software utilized in this v…
Suggested Courses

630 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question