Anilrgowda

Risk Assessment - Home Users: Low - Corporate Users: Low Date Discovered: 12/19/2006 Date Added: 12/19/2006 Origin: N/A Length: Varies Type: Virus SubType: Internet Worm DAT Required: 4922 Virus Characteristics

W32/Sagevo.worm is an internet worm that propagates through exploiting a vulnerability in Symantec Client Security and Symantec Antivirus products. It can also be downloading further malware when installed.
When run, it makes a copy of itself at:

• %Windir%\System32\wins\svchost.exe

It scans the local network segments for other machines to remotely exploit a stack buffer overflow in several Symantec products via TCP port 2967. More details of this vulnerability is described here:

• CVE-2006-2630 (under review)

It can also be downloading further malware, such as BackDoor-CPI.dll, from the following IP address(es):

• 61.172.xx.xx

Indications of Infection

• Presence of the mentioned file(s).
• Unexpected network connections to the mentioned port(s) and IP range(s).

Method of Infection

W32/Sagevo.worm is an internet worm that propagates through exploiting a vulnerability in Symantec Client Security and Symantec Antivirus products



Removal Instructions

All Users:
Use specified engine and DAT files for detection and removal.
Modifications made to the system Registry and/or INI files for the purposes of hooking system startup, will be successfully removed if cleaning with the recommended engine and DAT combination (or higher).
Additional Windows ME/XP removal considerations