# MA-075.062004: MyCERT Advisory - W32.Korgo Worm

**Date:** 25 Jun 2004  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-075.062004  
**Advisory ID:** MA-075.062004

---

#### 1.0 Description
#### 1.1 Overview
MyCERT had been receiving few reports from users and organizations for the past few days regarding the propagation of a W32.Korgo worm and its variants. Korgo (aka Padobot) is a network worm written by the Russian Hangup Team virus group. It spreads throughout the Internet using a vulnerability in Microsoft Windows LSASS. A description of the vulnerability can be found in Microsoft Security Bulletin MS04-011.
The first discovery of the Korgo worm was on 22nd May and the latest variant W32.Korgo.Q on June 24 2004.
This worm attempts to exploit a buffer overflow vulnerability in the Windows Local Security Authority Service Server (LSASS). This vulnerability allows a emote attacker to execute arbitrary code with SYSTEM privileges. More information on this vulnerability is available in Vulnerability Note VU#753212 and Microsoft Security Bulletin MS04-011.
This worm propagates by scanning random IP addresses on port 445/tcp to identify vulnerable systems. Upon finding a vulnerable system, the worm will attempt to exploit the LSASS vulnerability. If successful, the worm will open a connection on port 113/tcp or port 3067/tcp or 6667/tcp or 2041/tcp and may attempt to connect to a list of pre-determined IRC servers.
#### 1.2 Aliases
Padobot
#### 1.3 Variants
Ranges from variant W32.Korgo.A to variant W32.Korgo.Q
#### 1.4 Type
Network-based Worm.
#### 1.5 Propagation
Propagates through ports: TCP 445, 113, 3067, and 6667. May listen on random ports as well.
#### 1.6 Systems Affected
Unpatched Windows 2000 and Windows XP vulnerable to the Microsoft LSASS Windows exploit.
#### 1.7 Payload
- May degrade overall network performance.
- Backdoor functionality allows unauthorized access to the infected machine.
- Backdoor functionality may compromise security setting, i.e Anti-virus and Personal Firewall functions.
### 2.0 Possible Steps
#### 2.1 Identification
**2.1.1 At Workstations/PCs**
1. Run an updated version of Anti-virus software to detect the presence of the worm in the PC.
Anti-virus software can be downloaded at:
[https://www.mycert.org.my/portal/articles-content?menu=4b05e0fb-afa1-408f-90ca-ea0edf4aca8b&id=b83f4c4d-f1e2-4a9d-ab55-6389ae1f6efc](https://www.mycert.org.my/portal/articles-content?menu=4b05e0fb-afa1-408f-90ca-ea0edf4aca8b&id=b83f4c4d-f1e2-4a9d-ab55-6389ae1f6efc
)
**2.1.2 At Network/Organization Level**
1. System Administrators may download and install an IDS, i.e Snort to detect the worm by its signatures.
Download Snort at:
http://www.snort.org
SNORT with the LSASS signature:
http://www.snort.org/snort-db/sid.html?sid=2514
Since there are many variants, there are several of these signatures. It is recommended to get the signature from http://www.snort.org website, at the 'search message', type 'lsass'.
Other unofficial snort signatures are the following:
http://www.stevehendrie.com/article.php?story=20040503110706616
2. Administrators should analyze their log files for any failed attempts by internal systems to establish an IRC session to destination TCP port 6667 as a possible sign of a compromised/infected system.
3. System Administrators may download and install the Microsoft MS Scanner or any scanner to detect vulnerable machines within the network to the LSASS exploit. Once the machine is identified, it should be kept disconnect from the network until it is patched.
Scanner to search LSASS vulnerability:
http://msmvps.com/donna/archive/2004/05/03/5788.aspx
http://www.foundstone.com/resources/freetools/dsscan.zip
#### 2.2 Containment
1. Infected machines should be disconnected from the network.
2. Organizations may consider to disconnect their VLAN to block the propagation of the worm within their organization.
3. System Administrators may consider to block TCP 445, 113, 3067,2041,6667 and any suspicious random TCP ports between 256 and 8191.
#### 2.3 Eradication
1. Apply the MS04-011 patch which is available at:
Microsoft
http://www.microsoft.com/technet/security/bulletin/MS04-011.mspx
2. Disable system restore (for Windows XP only).
3. Update the antivirus signature file.
4. Run a full system scan and delete all the files detected as Korgo worm.
5. Other wise, clean up the infected by using an automatic removal tool, as it is the easiest way of cleaning up the worm.
The tool can be downloaded at:
Symantec
http://securityresponse.symantec.com/avcenter/venc/data/w32.korgo.removal.tool.html
6. Re-scan the machine with an updated version of Anti-virus to make sure the worm has been totally eradicated.
7. Enable Sytem Restore.
#### 2.4 Verification and Recovery
1. May re-connect the cleaned machine to the network.
NOTE: For organizations, they need to clean up all machines first, prior to re-connecting to the network.
#### 2.5 Prevention
1. Install an Anti-virus software on machine, if you do not have and make sure it is updated with latest signature file.
2. Install a Personal Firewall which is capable to block the propagation of the by blocking ports that the worm propagates through.
3. Always update machines with latest patches. This can be done online at:
Microsoft
http://www.windowsupdate.com
### 3.0 More Information
> **3.1 Symantec**
> http://www.symantec.com
>
> **3.2 F-Secure**
> http://www.f-secure.com
>
> **3.3 Trend Micro**
> http://www.viruslist.com