It propagates by exploiting the LSASS vulnerability on TCP port 445 (as described in Microsoft Security Bulletin MS04-011) Note that Nessus did not try to talk to the backdoor, so this might be a false positive. On the downside, Removal Tool has not been updated for a pretty long time. The Korgo worm is known to open a backdoor on these ports. It has a good response time to commands and works well, without causing the OS to hang, crash or pop up error dialogs. The program is very low-demanding when it comes to the CPU and RAM, thus it doesn't put a strain on the computer's overall performance. This triggers Removal Tool to automatically look into the computer for any infections of the aforementioned virus, and remove the files on the spot. Win32 Korgo O worm aka Worm/Padobot.O, Win32/Korgo.R.worm,, , W32/Korgo.worm,, Worm/Padobot.U I bet you didnt kept/keep your system up-to-date with all security patches/updates from Microsoft. The interface of the tool is made from a simple-to-use layout, where all you can do is start the scanning task by clicking a button. What's important to keep in mind is that the Windows Registry section does not get entry updates, and files do not remain on the HDD after removal. Alternatively, you can move Removal Tool to a USB flash disk or similar storage unit, in order to run it on any workstation with minimum effort, as long as you have administrative rights. It is very simple to handle, thanks to its overall simplicity.Īs installation is not a prerequisite, you can just save the executable file anywhere on the hard disk and run it directly. Removal Tool is a compact and portable piece of software that eliminates files infected with the virus and other Korgo variants, namely, ,, ,, ,, and.

Korgo worm virus