Date:2006-04-23 20:00:29
Who:Ilyas Khasyanov
Action, new status:Add comment, User response needed
Data:Virus analysts confirmed that it is false alarm.

Please download again Dr.WEB CureIt! with updated virus database.

 Date:2006-04-23 21:07:23
Who:Pavel Ershov
Action, new status:Add comment, User response needed
Data:Win32.SQL.Slammer - is an small Internet worm that affects Microsoft
SQL Server 2000. To get into victim machines the worm exploits a
buffer overrun vulnerability. The worm sends multicast packets. The
worm is memory only, and it spreads from an infected machine's memory
to a victim machine's memory. The worm does not drop any additional
files and does not manifest itself in any way.

In your case it turns out so, that packets with a worm-code get in the
buffer of reception of your firewall. Memory scanner cannot know,
whether really this code works or is "a dead cargo" in address space
of your firewall. So, if the worm-code is found in memory the process
(containing that code) - process will be cured by the scanner.

Workaround:

- empty (clear) the cashe of your firewall, or

- unload the firewall before check of memory by the scanner.