Avast WEBforum

Other => Viruses and worms => Topic started by: stevejrc on November 24, 2003, 06:58:47 PM

Title: Win32:SQLSlammer (stopped - COOL)
Post by: stevejrc on November 24, 2003, 06:58:47 PM

My screen saver scan (mem and startup) picked up Win32:SQLSlammer and just had OK button available, it was a memory resident worm, so I guess it just dumped it. I dont think it was false alarm as the Sygate traffic log had an attempted connection on the port it comes in (at the same time), although it said it was blocked, odd.

Well if it wasnt a false alert, Avast was COOL.  ;D ;D ;D

Title: Re:Win32:SQLSlammer (stopped - COOL)
Post by: .: Mac :. on November 25, 2003, 01:17:57 AM

the slammer worm is still active? I though everyone would have applied the patch by now :-\

Title: Re:Win32:SQLSlammer (stopped - COOL)
Post by: Vlk on November 25, 2003, 01:21:15 AM

Steve, do you have SQL installed?

I'm sorry to say that but it's not very likely that avast would actually pick it in a file (it doesn't infect any files) -- or it detected it in a memory block?

Title: Re:Win32:SQLSlammer (stopped - COOL)
Post by: .: Mac :. on November 25, 2003, 01:25:32 AM

Vlk would slammer hit my XP laptop?

Title: Re:Win32:SQLSlammer (stopped - COOL)
Post by: Vlk on November 25, 2003, 01:28:44 AM

Well if you had MS SQL installed and running... otherwise hardly.
But another thing is that remote sites infected by SQLSlammer may still be scanning your machine for the vulnerability.

Title: Re:Win32:SQLSlammer (stopped - COOL)
Post by: .: Mac :. on November 25, 2003, 01:31:08 AM

Thanks I dont run SQL i dont even know what its for

Title: Re:Win32:SQLSlammer (stopped - COOL)
Post by: stevejrc on November 25, 2003, 02:05:11 AM

Think it was in memory block. I dont think I even have SQL installed, how would I know, theres nothing in add/remove programs or start button...called SQL or anything. I have MS Visual Studio 6.0 installed and MSDN disks.

I have the latest windows updates (from IE6 update option). If it was a false alert why, I dont see how it could be a false positive.