There is an increase on port 2967 attempts which is associated to the SAV worm for the last few days:
http://isc.sans.org/port_details.php?port=2967

eEye has a nice technical write up which provide an analysis of this worm. Check it out during your free time.
http://research.eeye.com/html/alerts/AL20061215.html

Symantec has also released virus definition pertaining to this worm:
Backdoor.Wualess.B
W32.Sagevo