Win32: SQLSlammer keeps showing up

[Notar]

   Hi, I have risked using  WebShield again with Opera browser . Last night I ran an offline scan and detected this virus in C:\Program Files\Sygate\SPF\rawlog.log.

Now, whilst I am online I ran a scan of this file and twice as of this moment I have found this virus in this abovementioned folder.   I also checked this file with AVG anti virus.   Also, have just completed Trend Micro Housecall online scan. Both came up clean.  Could this be a false positive  by avast.

 It would appear WebShield and Sygate are incompatible as expessed in several recent threads.

Should I just give up on using Webshield with Sygate Firewall free version?

 I will not give up using Sygate as I have been using it for years and  consider it to be a very good firewall.

I hope somebody can advise some workaround.

[Vlk]

There're basically two questions in your post. Let's answer them one by one.

Last night I ran an offline scan and detected this virus in C:\Program Files\Sygate\SPF\rawlog.log.

If it was SQLSlammer, it's not such a deal. I mean, I can imagine such a situation very well. The Sygate RawLog file (given its name) probably stores individual packets coming to your machine, on certain ports. So it's quite possible that a remote machine send you a packet with SQLSlammer payload, and avast is now picking it up in the log... There's nothing to worry about here, really...

It w

ould appear WebShield and Sygate are incompatible as expessed in several recent threads.

I think you misunderstood the problem. It's the fact that Sygate has problems with local proxies, in the sense that it's not able to control traffic going thru them. However, in build 4.6.623, WebShield was modified in the sense that it's now opt-in only. I.e. it filters traffic coming from certain processes only, thus mitigating the problem to a large extent.

For more, please a number of Sygate-WebShield related threads on this forum.


Thanks
Vlk

[stevejrc]

I asked same question in sygate forum and they also said its just the packet data blocked at the firewall. Avast picks it up as its heuristics see a "sign" of slammer. You can disable full packet logging (it only slows pc down and unnecessary unless troubleshooting) or delete the file (its recreated by sygate).

[Notar]

  @ stevejrc

   Thanks for the information.  I have deleted this file and realised that it  recreates itself. I noticed that the packet logging is  a default setting and was wondering how to disable it.

[stevejrc]

in options (right click sygate icon or tools>options in sygate screen) untick "full packet logging" under the Log tab. I think its normally unticked by default.

[Notar]

 LOL I  haven't looked in options in years.  I have unticked it now. Thanks