W32/Korgo-S is a network worm which uses the LSASS exploit to propagate (MS04-011) . When executed the worm copies itself to the Windows system folder using a randomly generated name and creates the following registry entry so that the worm starts when a user logs on:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
System Update = <Windows system>\<random name>.exe
During infection the worm will also use the registry value
HKLM\Software\Microsoft\Wireless\ID = <random letters>
W32/Korgo-S deletes the file FTPUPD.EXE, if it exists. The worm also attempts
to terminate processes such as SysTray, WinUpdate and avserve.exe and
deletes the corresponding entries in the registry, if they exist at the following
location:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
W32/Korgo-S scans random IP addresses attempting to exploit them, the results
of the scans being transmitted to one of several IRC servers and channels.