Full Version of this article can be found here

sagate.exe

sagate.exe

What is it?
sagate.exe is a file associated with the W32.gaobot.BOW worm

What does it do?
W32.Gaobot.BOW is a network-aware worm that has backdoor capabilities and can be controlled through IRC channels

When W32.Gaobot.BOW is executed, it performs the following actions:

Copies itself as %System%sagate.exe.

Note: %System% is a variable that refers to the System folder. By default this is C:WindowsSystem (Windows 95/98/Me), C:WinntSystem32 (Windows NT/2000), or C:WindowsSystem32 (Windows XP).

Adds the value:

"Sagate Security Firewall" = "sagate.exe"

to the registry keys:

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersion
RunServices

so that the W32.Gaobot.BOW runs when you start Windows.

Connects the backdoor component to the remote IRC server lud.b0b.org on TCP port 7000 and awaits commands from a remote attacker.

The backdoor allows the attacker to perform some of the following actions on the compromised system:
Opens three randomly selected TCP ports.

Overwrites bystem%driversetchosts with the following lines:
Attempts to copy itself to the following shares on randomly generated IP addresses:using it's own list of user names and passwords

Sends HTTP GET messages to the following hosts (to measure connection speed):Attempts to steal CD keys for a number of computer games

More info and Removal
@symantec