MS04-01: Korgo L and P: more variants emerge

Welcome to Bleeping Computer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.
Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Important Announcement: The winners of the BC Million Post contest have been announced. You can read who the winners are at this post.

- BleepingComputer Management

BleepingComputer.com > Security > AntiVirus, Firewall and Privacy Products and Protection Methods

MS04-01: Korgo L and P: more variants emerge

Options

harrywaldron View Member Profile	Jun 18 2004, 01:51 PM Post #1
Security Reporter Group: News Reporters Posts: 491 Joined: 10-April 04 From: Roanoke, Virginia Member No.: 107	The Korgo L and P variants are highlighted today for unpatched MS04-011 workstations or servers. The author continues to improve the worm capabilities with each release. KORGO.L http://secunia.com/virus_information/10136/korgo.l/ http://www.sarc.com/avcenter/venc/data/w32.korgo.l.html http://www.trendmicro.com/vinfo/virusencyc...me=WORM_KORGO.L W32.Korgo.L is a variant of W32.Korgo.I. This worm attempts to propagate by exploiting the Microsoft Windows LSASS Buffer Overrun Vulnerability (described in Microsoft Security Bulletin MS04-011) on TCP port 445. It also listens on TCP ports 113, 3067, and other random ports (256-8191). KORGO.P http://secunia.com/virus_information/10138/korgo.p/ http://vil.nai.com/vil/content/v_126341.htm http://www.f-secure.com/v-descs/korgo_p.shtml This worm exploits vulnerable Microsoft Windows systems. The worm scans IP addresses in the class A or class B subnets as well as random IP addresses, sending SYN packets on TCP port 445 to identify potential victims. Exploit code is then sent to the host to overflow a buffer in LSASS.EXE and excute the virus on the victim system. This Korgo (aka Padobot) variant was found on June 17th, 2004. It is a bit modified comparing to previous Korgo variants. Korgo.P worm spreads throughout the Internet using a vulnerability in Microsoft Windows LSASS. A description of the vulnerability can be found in Microsoft Security Bulletin MS04-011: http://www.microsoft.com/technet/security/...n/MS04-011.mspx -------------------- Microsoft Security Journal

« Next Oldest · AntiVirus, Firewall and Privacy Products and Protection Methods · Next Newest »

1 User(s) are reading this topic (1 Guests and 0 Anonymous Users)

0 Members:

Display Mode: Standard · Switch to: Linear+ · Switch to: Outline

Track this topic · Email this topic · Print this topic · Subscribe to this forum

Lo-Fi Version

Time is now: 22nd November 2008 - 04:45 AM

Advertise \| About Us \| Terms of Use \| Privacy Policy \| Contact Us \| Site Map \| Chat \| Tutorials \| Uninstall List
Discussion Forums \| The Computer Glossary \| Resources \| RSS Feeds \| Startups \| The File Database \| Malware Removal Guides