W32/Korgo.P Worm

 Information about the W32/Korgo.P worm:

W32/Korgo.P is a worm. This worm infects systems running on Windows 2000/XP/2003. The worm spreads through networks. This worm exploits LSASS vulnerability present in Windows as explained by Microsoft Security Bulletin MS04-011.

Upon execution of the worm, it modifies the Windows registry at the following location to run itself at the each startup.

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

The worm tries to copy itself to Windows System folder as <variable string>.exe. The worm searches for the file ftpupd.exe in the folder where the worm is executed. If found it deletes the file. It also creates a mutex called uterm17 to check if the worm is already in memory. It modifies the Windows registry at the following location.

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\Software\Microsoft\Wireless

To propagate the worm randomly scans for the random IPaddress and ports in the network. If found then the worm downloads a copy of the worm to the victim computer. The worm has a capability to remove the entries made by other few worms.

Microsoft has released a patch for this MS04-011 vulnerability. It can be downloaded from the following link:

http://www.microsoft.com/technet/security/bulletin/MS04-011.mspx

Users should apply the patch downloaded from the link provided above to remove the vulnerability inherent in the system.

This worm first appeared on 21st June 2004.

 Other names of W32/Korgo.P worm:

This worm is also known as WORM_KORGO.P, W32.Korgo.P.

Download the FREE Evaluation copy of Protector Plus antivirus software