high
Summary
Summary
Action- More Information
| Protection available since | 25 June 2004 07:59:11 (GMT) |
|---|---|
| Detected by | All Sophos products |
Free virus scan
- Free virus, spyware, and adware scan
- Test your existing anti-virus protection
- Find threats your anti-virus missed
Action
- Summary
- Action
- More Information
Please follow the instructions for removing worms.
Please read the instructions for removing W32/Korgo-T.
More Information
W32/Korgo-T is a network worm which uses the LSASS exploit (MS04-011) to propagate. When executed the worm copies itself to the Windows system folder using a randomly generated name and creates the following registry entry so that the worm starts when a user logs on:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
Windows Update = <Windows system>\<random name>.exe
During infection the worm will also use the registry value
HKLM\Software\Microsoft\Wireless\ID = <random letters>
W32/Korgo-T deletes the file FTPUPD.EXE, if it exists. The worm also attempts
to terminate processes such as SysTray, WinUpdate and avserve.exe and
deletes the corresponding entries in the registry, if they exist at the following
location:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
W32/Korgo-T scans random IP addresses attempting to exploit them, the results
of the scans being transmitted to one of several IRC servers and channels.
|
