Korgo worm detection

The remote host is probably infected with Korgo worm. It propagates by exploiting the LSASS vulnerability on TCP port 445 as described in Microsoft Security Bulletin MS04-011 and opens a backdoor on TCP ports 113 and 3067. SPDX-FileCopyrightText: 2004 David Maciejak Some text descriptions might b...

Korgo Worm Detection

Nessus found that TCP ports 113 and 3067 are open. The Korgo worm is known to open a backdoor on these ports. It propagates by exploiting the LSASS vulnerability on TCP port 445 as described in Microsoft Security Bulletin MS04-011 Note that Nessus did not try to talk to the backdoor, so this migh...