PlanetZ forums - scopeusers.com

I've just rebooted my machine and my firewall has faithfully reported to me that SFP.exe has changed since the last time i used it and that it was trying to access 224.0.0.22... strange - I didn't know scope accessed the net .. any ideas?

Thanks

Andrew

Virus? Worm?

are you protected?

sure i am. I've got sygate firewall on and avg virus scanner fully up to date

Well, i don't think scope access the net, normally.

hmmmm... I'll do a full virus scan when i get home

andrew wrote:
I've got sygate firewall

Is that the free version? I can't vouch for the commercial one, but my opinion of the Sygate one after trying it out was that it was somewhat flaky.

I now use a "proper" SPI/NAT Open Source (GPL) combination running on my router (a lot of routers use GPL licenced software ... sometimes without declaring the licence!)

I'm fortunate in that our company uses Sophos AV software, which allows all its employees to install a "home" version. Sophos is IMO te best AV out there, but unfortunately, it's only licenced out to businesses, not to home users.

Unless the Sygate FW is confused, it does sound likely that your SFP.exe has been infected. If your AV software doesn't detect anything and you want to be absolutely sure, feel free to zip it up and send it to me and I'll check it with Sophos.

Royston

that reminds me: the SFP.exe isn't necessarily the Scope one - it was mentioned here (quite) some time ago in context with network activity.

cheers, Tom

thanks royston, and astroman

I'll do the scan when i get home - will also check which .exe my desktop shortcut to scope 4.0 is pointing to.

Andrew

SFP.EXE might be the System File Protection utility. Can't see why it would try to connect to what I believe is a multicast address.

okay -

just checked - it was indeed c:sfp\app\bin\sfp.exe that sygate reported trying to access the internet.

Whether this is sygate getting confused or not I'm not sure. I've done a virus scan with avg virus scanner (free edition) with the latest updates, and found no viri

I'll zip it and send it to Counterparts in Bath for detailed analysis.

Thanks guys!

Andrew


<font size=-1>[ This Message was edited by: andrew on 2004-12-08 14:48 ]</font>

On 2004-12-08 14:47, andrew wrote:
, and found no viri

I'll zip it and send it to Counterparts in Bath

Andrew

Will Counterparts drown the executable in his Bath?


Cheers,
Rob

Hi Andrew,
I'm a user of Sygate Pro, and I can confirm that sometimes it gets confused and doesn't report the correct program name.
It doesn't happen a lot (once a week for me maybe?), but when it does the problem seems to disappear after a reboot.
It's quite annoying, but usually I'm reassured by the fact that the program is trying to access a site that I know about. For example most of the times some random program is reported as attempting to contact the McAfee site, and I know it's actually just the mcafee daemon trying to check for an update..
Voila!
Camed

hmmmmm... thankyou camed!

I guess if the pro version does that then the 'amateur' version must do too!!!



nice one guys!! big up planet z!

Andrew

If you would like to send me the file, zip it up and post to:

rday at mpc hyphen data dot co dot uk

Royston

I did last night mate.

I got your email from the little icon under your post

Andrew

Oddness, I didn't see it, but it could be that my rather harsh Spam Assassin settings clobbered it! Quite likely...

Was the attachment zipped up by the way? I know that .exe attachments will get blocked before they reach me.

If you put "SFP" in the subject line, and try again, I'll filter it into a folder where I'll spot it

Royston

okay - i try again later

smiley!

Had the same issue some time ago, go here to see the responses I got back then, he says shamelessly adverting his own threads .

Issue persisted but was not a showstopper, and just as I changed from Symantec to Norman, I got a hunch that SFP tried to reach an internal port in my own PC. Norman does not seem to be responsing to this phenomenon, but that might as well be some configuration issue ?

Anyone ?
Stubbe

just keep your computer off the net when making music and you can turn the firewall off................

enjoying MSN or surfing the net while Cubase/Scope is playing my song, without any firewall or virus scanner active or even installed...
What a fun