Author Topic: Win32:SQLSlammer (stopped - COOL)  (Read 6375 times)

0 Members and 1 Guest are viewing this topic.

stevejrc

  • Guest
Win32:SQLSlammer (stopped - COOL)
« on: November 24, 2003, 06:58:47 PM »
My screen saver scan (mem and startup) picked up Win32:SQLSlammer and just had OK button available, it was a memory resident worm, so I guess it just dumped it. I dont think it was false alarm as the Sygate traffic log had an attempted connection on the port it comes in (at the same time), although it said it was blocked, odd.

Well if it wasnt a false alert, Avast was COOL.  ;D ;D ;D

Offline .: Mac :.

  • Avast Überevangelist
  • Ultra Poster
  • *****
  • Posts: 5093
Re:Win32:SQLSlammer (stopped - COOL)
« Reply #1 on: November 25, 2003, 01:17:57 AM »
the slammer worm is still active? I though everyone would have applied the patch by now :-\
"People who are really serious about software should make their own hardware." - Alan Kay

Offline Vlk

  • Avast CEO
  • Serious Graphoman
  • *
  • Posts: 11658
  • Please don't send me IM's. Email only. Thx.
    • ALWIL Software
Re:Win32:SQLSlammer (stopped - COOL)
« Reply #2 on: November 25, 2003, 01:21:15 AM »
Steve, do you have SQL installed?

I'm sorry to say that but it's not very likely that avast would actually pick it in a file (it doesn't infect any files) -- or it detected it in a memory block?
If at first you don't succeed, then skydiving's not for you.

Offline .: Mac :.

  • Avast Überevangelist
  • Ultra Poster
  • *****
  • Posts: 5093
Re:Win32:SQLSlammer (stopped - COOL)
« Reply #3 on: November 25, 2003, 01:25:32 AM »
Vlk would slammer hit my XP laptop?
"People who are really serious about software should make their own hardware." - Alan Kay

Offline Vlk

  • Avast CEO
  • Serious Graphoman
  • *
  • Posts: 11658
  • Please don't send me IM's. Email only. Thx.
    • ALWIL Software
Re:Win32:SQLSlammer (stopped - COOL)
« Reply #4 on: November 25, 2003, 01:28:44 AM »
Well if you had MS SQL installed and running... otherwise hardly.
But another thing is that remote sites infected by SQLSlammer may still be scanning your machine for the vulnerability.
If at first you don't succeed, then skydiving's not for you.

Offline .: Mac :.

  • Avast Überevangelist
  • Ultra Poster
  • *****
  • Posts: 5093
Re:Win32:SQLSlammer (stopped - COOL)
« Reply #5 on: November 25, 2003, 01:31:08 AM »
Thanks I dont run SQL i dont even know what its for
"People who are really serious about software should make their own hardware." - Alan Kay

stevejrc

  • Guest
Re:Win32:SQLSlammer (stopped - COOL)
« Reply #6 on: November 25, 2003, 02:05:11 AM »
Think it was in memory block. I dont think I even have SQL installed, how would I know, theres nothing in add/remove programs or start button...called SQL or anything. I have MS Visual Studio 6.0 installed and MSDN disks.

I have the latest windows updates (from IE6 update option). If it was a false alert why, I dont see how it could be a false positive.