Reason: login failed for user 'sa'. Please verify SQL Server is running and check your SQL Server Registration properties (by right-clicking on the SERVER1 node) and try again.</pre> ...

The worm searches for servers running SQL Server by scanning for port 1433, which is the SQL Server default port. If the worm finds a server, it logs on with a blank (NULL) sa password.