Content
W32/Korgo.worm.b
- Type
- Virus
- SubType
- Worm
- Discovery Date
- 05/24/2004
- Length
- 10,240 bytes
- Minimum DAT
- 4363 (05/26/2004)
- Updated DAT
- 4364 (06/02/2004)
- Minimum Engine
- 5.1.00
- Description Added
- 05/26/2004
- Description Modified
- 05/26/2004 2:34 PM (PT)
Risk Assessment
- Corporate User
- Low-Profiled
- Home User
- Low-Profiled
Tab Navigation
Characteristics
-- Update May 26, 2004 --
The risk assessment of this threat was upgraded to Low-Profiled due media attention at the following link:
http://www.internetnews.com/dev-news/article.php/3359681
This self-executing worm spreads by exploiting a Microsoft Windows vulnerability:
- MS04-011 vulnerability (CAN-2003-0533)http://www.microsoft.com/technet/security/bulletin/MS04-011.mspx
The worm spreads with a random filename and acts as a remote access server to allow an attacker to control the compromised system.
Symptoms
The worm copies itself to the WINDOWS SYSTEM directory (such as c:\windows\system32) using a random file name, and creates a registry run key to load automatically at system startup:
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\
Run "WinUpdate" = C:\WINDOWS\System32\[random name] .exe
An additional marker key is created:
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Wireless
The worm listens on TCP ports 113, 2041, 3067 and attempts to connect the following IRC servers on TCP port 6667:
- irc.kar.net
- gaspode.zanet.org.za
- lia.zanet.net
- london.uk.eu.undernet.org
- washington.dc.us.undernet.org
- los-angeles.ca.us.undernet.org
- brussels.be.eu.undernet.org
- caen.fr.eu.undernet.org
- flanders.be.eu.undernet.org
- graz.at.eu.undernet.org
- moscow-advokat.ru
Method of Infection
This worm exploits vulnerable Microsoft Windows systems. The worm scans random IP addresses, sending SYN packets on TCP port 445 to identify potential victims. Exploit code is then sent to the host to overflow a buffer in LSASS.EXE and execute the virus on the victim system.
Removal
All Users:
Use current engine and DAT files for detection and removal.
Modifications made to the system Registry and/or INI files for the purposes of hooking system startup, will be successfully removed if cleaning with the recommended engine and DAT combination (or higher).
Variants
Variants
N/A
All Information
Overview -
This is a virus detection. Viruses are programs that self-replicate recursively, meaning that infected systems spread the virus to other systems, which then propagate the virus further. While many viruses contain a destructive payload, it's quite common for viruses to do nothing more than spread from one system to another.
Aliases
- W32.Korgo.B (symantec)
- Worm.Win32.Padobot.b (AVP)
Characteristics
Characteristics -
-- Update May 26, 2004 --
The risk assessment of this threat was upgraded to Low-Profiled due media attention at the following link:
http://www.internetnews.com/dev-news/article.php/3359681
This self-executing worm spreads by exploiting a Microsoft Windows vulnerability:
- MS04-011 vulnerability (CAN-2003-0533)http://www.microsoft.com/technet/security/bulletin/MS04-011.mspx
The worm spreads with a random filename and acts as a remote access server to allow an attacker to control the compromised system.
Symptoms
Symptoms -
The worm copies itself to the WINDOWS SYSTEM directory (such as c:\windows\system32) using a random file name, and creates a registry run key to load automatically at system startup:
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\
Run "WinUpdate" = C:\WINDOWS\System32\[random name] .exe
An additional marker key is created:
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Wireless
The worm listens on TCP ports 113, 2041, 3067 and attempts to connect the following IRC servers on TCP port 6667:
- irc.kar.net
- gaspode.zanet.org.za
- lia.zanet.net
- london.uk.eu.undernet.org
- washington.dc.us.undernet.org
- los-angeles.ca.us.undernet.org
- brussels.be.eu.undernet.org
- caen.fr.eu.undernet.org
- flanders.be.eu.undernet.org
- graz.at.eu.undernet.org
- moscow-advokat.ru
Method of Infection
Method of Infection -
This worm exploits vulnerable Microsoft Windows systems. The worm scans random IP addresses, sending SYN packets on TCP port 445 to identify potential victims. Exploit code is then sent to the host to overflow a buffer in LSASS.EXE and execute the virus on the victim system.
Removal -
Removal -
All Users:
Use current engine and DAT files for detection and removal.
Modifications made to the system Registry and/or INI files for the purposes of hooking system startup, will be successfully removed if cleaning with the recommended engine and DAT combination (or higher).
Additional Windows ME/XP removal considerations
Variants
Variants -
N/A
