Symantec warns of worsening threat of 'W32.Korgo.F' worm

The worm can open backdoors allowing unauthorised access to your PC if no action is taken to block it.

Senior Symantec officials have urged PC users to immediately apply patches; and for longer term security, to keep their virus definitions files updated.

Due to an increase in submissions in the last several hours, Symantec Security Response has upgraded W32.Korgo.F from a Level 2 to a Level 3 threat, said a Symantec statement released here today.

"W32.Korgo.F includes backdoor functionality that could leave systems open to unauthorised access. This backdoor functionality could result in a loss of confidential data and may also compromise security settings," said Kevin Isaac, Symantec Regional Director for the Middle East & Africa.

"This threat is another strong example of why it is critical for computer users to be diligent in applying security patches, keeping virus definitions updated, and following best practices," Isaac said.

W32.Korgo.F is a worm that attempts to propagate by exploiting a Microsoft Windows vulnerability publicly announced on 13th April 2004.

This blended threat affects computer users on Windows 2000 and Windows XP. W32.Korgo.F will listen on TCP ports 113 and 3067 and could potentially open backdoors on those ports.

Threats to privacy and confidentiality have been the fastest growing threat in recent months, with the Symantec Internet Threat report released in March showing a 514% growth in volume of submissions within the top ten.

"The rising incidents of blended threats with the potential to open backdoors demonstrate the importance of an integrated approach to security within the infrastructure," commented Isaac.

"A firewall will block unusual port traffic by default, and when combined with updated anti-virus and intrusion detection systems, it offers top level protection. If users are affected, there is a free removal tool as well as manual removal instructions on http://securityresponse.symantec.com,".

He said Symantec Security Response strongly advises users to apply the patch provided by Microsoft for the LSASS Buffer Overrun Vulnerability as soon as possible. In addition, Symantec recommends that users update their antivirus definitions to prevent exploitation of this threat. Users should also check that their firewall is configured to block ports 113 and 3067.