Found a worm - is it real though?

[Mike]

I ran AVG 6.0 today and it said it detected Slammer-SQL in my firewall
log. I did some research and decided to run a few online scans such as
Housecall and Symantec and they both said I have no worm.
From what I read in a forum, it looks like AVG just thinks there's a
worm in my firewall log.

So the question is, do I have a worm or not? I don't think I do but
I'd like to make sure. If I do have the worm it's just in that one
file, it hasn't infected the whole computer, yet. Anyone have
suggestions on what to do? I'm hestitant about just moving the file to
the virus vault because I'm not sure if it's important. I may end up
having to reinstall my firewall, which I don't want to have to do -
it's a pain.

So what should I do? The infected file is rawlog.log from Sygate
Personal Firewall.

 

[Gabriele Neukam]

On that special day, Mike, ([email protected]) said...

I ran AVG 6.0 today and it said it detected Slammer-SQL in my firewall
log. I did some research and decided to run a few online scans such as
Housecall and Symantec and they both said I have no worm.

No wonder, as the service abused by Slammer, the Internet Indexing
Service, is only running on Microsoft system based Webservers. And you
don't run any webserver.

These are attempts at finding and crompomising software, which doesn't
exist on your machine. As there is nothing there to be exploited,
nothing can be infected. That is, why your virus scanner couldn't find
anything.


Gabriele Neukam

(e-mail address removed)

 

[Uncle Mortimer]

I ran AVG 6.0 today and it said it detected Slammer-SQL in my firewall
log. I did some research and decided to run a few online scans such as
Housecall and Symantec and they both said I have no worm.
From what I read in a forum, it looks like AVG just thinks there's a
worm in my firewall log.

So the question is, do I have a worm or not?

No, as I recall the fact that the attempt was logged means that the exploit attempt was not successful.