SagetTVService Virus Win32.Agent.dwo

[Ponchera]

I'm running Kaspersky IS 7.0 and today it started alerting me that I had a virus in sageTV. Not sure if a virus decided to camouflage itself renaming itself SageTV or if their is a vulnerability with SageTV.

This is what it says:


detected: Trojan program Backdoor.Win32.Agent.dwo

File: c:\program files\sagetv\sagetv\sagetvservice.exe

Description of virus:
http://www.viruslist.com/en/search?V...wo&referer=kis

Backdoor.Win32.Agent.dwo

Detection added Jan 20 2008 18:10 GMT
Update released Jan 20 2008 21:50 GMT
Behavior Backdoor

Currently there is no description available for this program.

As many viruses and worms are modifications of earlier versions, it may help you to check the descriptions of similar programs. If such descriptions are available, they will be listed at the top of the page.

Our virus analysts work hard to ensure that descriptions of the commonest and most potentially dangerous software are available to users. The Virus Encyclopedia is updated on a regular basis.

If you cannot find the description you need, please check back later, or contact us on webmaster@viruslist.com.

[bcjenkins]

Have you emailed this to support?

B

[gplasky]

This isn't the first time Kapersky had issues with their updates.

False positive diasaster
Kapersky tech news

Gerry

[Opus4]

What version of SageTV are you using?

I'll also suggest it is a false positive -- this has happened before on the forum.

- Andy

[Ponchera]

version 6.2.10.152

I'm guessing i'll get "please update to 6.3" as the next reply =)

[gplasky]

Since 6.3.5 is the latest production version and you are the only one receiving a possible virus alert with the last previous production version from among hundreds if not over a thousand people that are probably running this program I would suggest you contact Kapersky with your Kapersky logs and the executable and have them verify if it is a false positive or an actual trojan.

Or please upgrade to 6.3.

Your choice. I'm not quite sure what response you were expecting with only you having reported this issue.

Gerry

[LazyGun]

Bizarrely I got the same issue. Well, not quite the same, but I got the same virus warning during the installation of sage 6.3.5. Kaspersky said that C:\Config.MSI\c4b333f.rbf had that virus in it.
It then deleted. Sage seemed to install ok afterwards, and the service is running fine, so I assume that a) it was a false positive, and b) it didn't bugger up the install.
On a side note, the noise Kaspersky makes when it finds a virus scares the crap out of me .... ok...yes, I'm a wuss