Network Computing is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them. Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Symantec: Another Surge In Worm Scanning For Unpatched Antivirus Software: Page 2 of 3

The most recent wave of scans had already crested, Weafer says. "The number of infected machines remains small, about 70."

Symantec's written alert, however, noted that the worm's slow propagation was not only unusual, but could also change at any time.

"With minimal effort this worm could be modified so that the hardcoded IP address is replaced with the address of the attacking computer," read the warning issued Friday by the DeepSight system. "This would significantly increase the propagation capabilities of this worm.

"The potential of this simple modification should be enough to convince administrators to deploy patches if they are not already deployed."

The hard-coded IP address mentioned in the alert is the server -- which has been offline all week -- that the worm connects to after an infection. The downed server means that Sagevo cannot replicate to other machines from an infected PC. "This is a strange feature of the malicious code," read the DeepSight warning, "and could indicate a testing phase. The behavior is more indicative of bot behavior rather than traditional worms."