Korgo worm detection

  1. Network Vulnerabilities
  2. Malware
  3. Korgo worm detection
Summary
The remote host is probably infected with Korgo worm. It propagates by exploiting the LSASS vulnerability on TCP port 445 (as described in Microsoft Security Bulletin MS04-011) and opens a backdoor on TCP ports 113 and 3067.
Solution
- Disable access to port 445 by using a firewall - Apply Microsoft MS04-011 patch.
References
Updated on 2015-03-25
Severity
High Severity
Classification
Related Vulnerabilities