W32/Korgo-M is a network worm which uses the LSASS exploit to propagate. When executed the worm copies itself to the Windows system folder using a randomly generated name and creates the following registry entry so that the worm starts when a user logs on:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Windows Update
<Windows system>\<random name>.exe
During infection the worm will also use the registry value
HKLM\Software\Microsoft\Wireless\ID = <random letters>
W32/Korgo-M deletes the file FTPUPD.EXE, if it exists. The worm also attempts to terminate processes such as SysTray, WinUpdate and avserve.exe and deletes the corresponding entries in the registry, if they exist at the following location:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
W32/Korgo-M scans random IP addresses attempting to exploit them, the results of the scans being transmitted to one of several IRC servers and channels.