high
Summary
Summary
Action- More Information
| Included in our products from | August 2004 (3.84) |
|---|---|
| Protection available since | 21 June 2004 14:48:51 (GMT) |
| Detected by | All Sophos products |
Action
- Summary
- Action
- More Information
Please read the instructions for removing W32/Korgo-L.
More Information
W32/Korgo-L is a network worm using the LSASS exploit to propagate (for more information please see Microsoft Security Bulletin MS04-011). When
executed the worm copies itself to the Windows system folder using a
randomly generated name and creates the following registry entry so that the
worm starts when a user logs on:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
Windows Update = <Windows system folder>\<random name>.exe
During infection the worm will also use the temporary registry value
HKLM\Software\Microsoft\Wireless\
Client = 1
W32/Korgo-L scans random IP addresses attempting to exploit them, the
results of the scans being transmitted to one of several IRC servers and channels.
|
