Please create an account to participate in the Slashdot moderation system

 



Forgot your password?
typodupeerror
×
Windows Operating Systems Software Bug Security

Windows Users Fear Korgo Virus 533

An anonymous reader writes "A new virus is on the prowl that can infect your Windows XP/2K system and record every key you hit on your keyboard. The keys are then sent back to the virus creator where he/she can steal your passwords and credit card information. The virus named, Korgo, started showing up in the last week of May but it now has at least six different variants. To protect yourself from this nasty virus, Microsoft is urging all users to download the KB835732 Security Update. As with the Sasser worm, you'll get the Korgo virus without even knowing it. It does not arrive by email, but simply by being connected to a network or to the Internet without having a patched machine or a properly configured firewall."
This discussion has been archived. No new comments can be posted.

Windows Users Fear Korgo Virus

Comments Filter:
  • Details: (Score:5, Informative)

    by ack154 ( 591432 ) * on Friday June 04, 2004 @03:35PM (#9338266)
    According to Symantec [sarc.com], the F variant of this seems to be the worst, or most prominent. Currently a level 3, here's the SARC page for it: Korgo.F [sarc.com]. There is a removal tool [sarc.com] available as well.

    Main details from top of SARC page:
    W32.Korgo.F is a minor variant of W32.Korgo.E. It is a worm that attempts to propagate by exploiting the Microsoft Windows LSASS Buffer Overrun Vulnerability (BID 10108) on TCP port 445. It also listens on TCP ports 113, 3067, and other random ports.
    Happy cleaning.
    • by Steve_Jobs_HNIC ( 513769 ) on Friday June 04, 2004 @03:39PM (#9338328) Journal
      Microsoft Security Bulletin MS04-011
      Security Update for Microsoft Windows (835732)

      Issued: April 13, 2004
      Updated: May 4, 2004
      Version: 1.3
      • by Tenareth ( 17013 ) on Friday June 04, 2004 @04:44PM (#9339185) Homepage
        Yes, and the 011 patch also killed about 5% of the machines it was installed on before the May 4 update. Now it only kills about 1%, or about 100 machines in our case. Not to mention the several apps it killed.

    • by Overly Critical Guy ( 663429 ) on Friday June 04, 2004 @04:19PM (#9338796)
      What a surprise it wasn't mentioned that this was patched months ago, right?

      This vulnerability is the LSASS Buffer Overrun Vulnerability, already patched way back on April 13. Slashdot probably had at least two or three articles on it back then as well if you wanna do a search for "sasser."

      If you haven't patched after two months, you're just the same as all those people who got hit with Blaster, which was also already patched beforehand. Linux distros issue security patches for their vulnerabilities [linuxsecurity.com] weekly and nobody complains, but when Microsoft releases a patch, suddenly it's this huge issue to run a tiny executable that plugs security flaws, and then people bitch at Windows two months later when a virus comes out to exploit it...

      Just saying. How can one criticize their security if they won't apply their security patches? Almost all major software is gonna require a patch eventually. I don't get this steadfast need to avoid patching Windows boxes while freely recompiling Linux kernels on a whim for production servers when a minor point release comes out.
      • Definitely +5 Insightful.

        But IMO, part of the problem is that these people are just "aware" that they have to do updates. I can't count the number of people I've told to go to WindowsUpdate to keep up to date and I get the most clueless looking face I've ever seen...

        I think Windows is at the very least, doing an admirable job of patching it's flaws, but you can't force people to update. It's another good step to include the Automatic Updating with Windows now, but it's not automatically turned on.
      • by foidulus ( 743482 ) * on Friday June 04, 2004 @04:49PM (#9339253)
        Certain places can't just go and blindly patch. If you are running anything critical, you have to throroughly test the patch befor you apply it. If the patch brings down your application/business, then it might not be much worse than a virus. I don't know about Linux, but Microsoft has released some bad patches in the past(that would slow certain functions down to a crawl).
        For someone sitting at their pc, the risk of a patch is low, but some people cannot afford to risk their systems on haphazard patching.
      • Most Windows viruses use security flaws patched many months before. I think automatic downloading and installation of patches should be mandatory for internet connected computers.
        • Yeah, except that some patches are known to break other programs. (generally badly programed software, but not always) They almost always require a reboot to install (forget about mission critical 24x7 servers). They don't always install correctly. (this last is my fault for running 2000 with "only" 64mg of ram, but what else can I do when a DIMM gets bad memory?)

          Thats ignoring new systems which don't come patched from the factory. The only [easy] way to get patched is to connect to the Internet wh

      • Who says that an unpatched system has be definition to be in the hands of an ignorant or incompetent sysadmin?

        What about those who just bought a new PC that was shipped at tha factory (just) prior to this patch becoming available? Who even guarantees that HP or Dell ship their boxes with the patch on it already?

        Or what about someone like me, who is about to reinstall the entire Winblows mess from scratch after a disk crash? Yes, this system had the patch installed within a day of the latter becoming ava

  • KB835732 (Score:5, Interesting)

    by thebra ( 707939 ) * on Friday June 04, 2004 @03:36PM (#9338268) Homepage Journal
    The company that I work at pushed the KB835732 patch out to a few thousand machines. It caused some incompatability issue that cause Windows to blue screen with the error "Winsrv.dll missing or corrupt", its been a blast removing the patch through recovery console, especially walking remote users through it.
    • Re:KB835732 (Score:5, Insightful)

      by Bender Unit 22 ( 216955 ) on Friday June 04, 2004 @03:41PM (#9338361) Journal
      Yes and then people fail to understand why it takes some time to patch up all machines.
      At work we do the releases in steps, first the IT dept, then the superusers. And then we take the rest in steps to prevent too much trouble.
      But it just not install the patch on 2000 machines as soon it comes out.
      • I agree with the original poster. Waiting a week and a half is totally useless is a corporate environment. It's kind of silly to wait a week and half, as everyone is doing this more and more basically you wind up finding all the same problems a week and a half later.

        You're assuming that someone out there in the world is going to install, test and have somewhat of a similiar environment to yours. In other words, you're hoping someone else will do the work for you.

        I think a better rule of thumb is to have a
      • Re:KB835732 (Score:3, Insightful)

        Not me man, I wade right into that shit hip deep. My bosses have laid down the law here and insist that I get everyone patched ASAP. I've tried to explain about the balance between being safe and being sure but they don't want to hear any of that so the way I see it "Fuck em".

        Now granted I've got closer to 500 machines (But I'd do the same thing if they gave me 2000, or even 20,000) but I still patch every single one of them the moment Microsoft spits it out.

        One day, one fine day Microsoft is going t
  • Hmmm.... (Score:5, Informative)

    by Mz6 ( 741941 ) * on Friday June 04, 2004 @03:36PM (#9338280) Journal
    For some reason the poster left out the following, critical, piece of information (oh.. and for those that don't RTFA). This virus uses the exact same flaw as the Sasser virus -- LSASS Buffer Overrun Vulnerability. What's weird is that the infections are still climbing meaning that after almost 2 months (patch released on April 13) and a HUGE rash of infections from Sasser, there are some folks that have still refused to apply the Microsoft patch. As much as I hate to say it, IMHO, they almost deserve it...

    For those that have just come out from their rock, here is a removal tool for this latest worm [symantec.com]

    And IIRC, shouldn't any good (read: non-XP) firewall automatically be blocking these ports (or atleast 445) right out-of-the-box?

    • Re:Hmmm.... (Score:5, Informative)

      by Ayaress ( 662020 ) on Friday June 04, 2004 @03:44PM (#9338394) Journal
      If you think that's bad, I recently reformatted a relative's Win2k computer because of a trashed partition. I then connected to the internet to download Zonelarm onto it and run windows update, and it was almost immediately infected with W32Blaster. Getting on a year after the patch came out, and most of a year since the virus made such a mess of things, there's still enough people out there with this virus (and hence, without the patch to protect against it) to make it dangerous to unpatched computers.
      • Re:Hmmm.... (Score:5, Informative)

        by FattMattP ( 86246 ) on Friday June 04, 2004 @04:08PM (#9338685) Homepage
        I then connected to the internet to download Zonelarm onto it and run windows update, and it was almost immediately infected with W32Blaster.
        What made you think putting an unsecured machine on a network unprotected would be a good idea, even to get patches? As you saw, it'll get infected in minutes. Maybe you should put Zonealarm on a CD or a USB memory key and move it over that way.
    • Not surprising. (Score:5, Insightful)

      by AbyssLeaper ( 22238 ) <.jnduvall. .at. .gmail.com.> on Friday June 04, 2004 @03:46PM (#9338422) Homepage Journal
      Let's not forget that most users (which wouldn't be reading /.) don't have any idea about this stuff. This confuse virus scanners with firewall, and think patching is something you do with clothes. So no, they don't really deserve it.

      Like it or not, they want their PC to work like their television. As much as you or I don't like it, they are the people that are keeping Windows suppport folks employed.

      I can't say how many times I've helped with someone's machine, and they've had multiple virus infections, spyware and general crap on their machine because they don't know any better. It's a fact of life that Microsoft is going to have to own up to if they want to stay on top. They raised the beast, now they need to teach it the rules.
    • Re:Hmmm.... (Score:5, Insightful)

      by bigrat ( 25898 ) on Friday June 04, 2004 @03:47PM (#9338427)
      I work at the tech bench at Best Buy part-time.


      Despite the default config of 2k/XP to inform you that updates are available, we've been fixing hundreds of machines infected with Sasser, and even Blaster. Users simply ignore the update warning, or outright refuse to run it. One user mentioned "Why would I need to run that?"


      Even Microsoft can't prevent ignorance.

    • Re:Hmmm.... (Score:5, Interesting)

      by Fig, formerly A.C. ( 543042 ) on Friday June 04, 2004 @04:09PM (#9338696)
      And IIRC, shouldn't any good (read: non-XP) firewall automatically be blocking these ports (or atleast 445) right out-of-the-box?

      Forgive my ignorance, but shouldn't the lightweight consumer-grade routers (Linksys and such) with NAT be effective as well at blocking this sort of thing?

      • Re:Hmmm.... (Score:3, Insightful)

        by ForestGrump ( 644805 )
        Yes, it should be able to block off most worms. This is because of how NAT works. If a remote machine was try connecting on a certain port, and the port is not "port fowarded", then the router will simply dump the data because it doesn't know where to foward it to.

        With NAT routers being so inexpensive, I believe that everyone should have one of these. Even if it is simply 1 box connecting to the internet.

        -Grump
  • Advisory (Score:5, Informative)

    by michaelhood ( 667393 ) on Friday June 04, 2004 @03:37PM (#9338288)
    Symantec's Advisory [symantec.com]. Listens on TCP ports 113, 2041, and 3067. 113 is identd, 2041 is interbase, 3067 seems invented. Firewall as appropriate.
  • You know... (Score:4, Insightful)

    by Anonymous Coward on Friday June 04, 2004 @03:38PM (#9338300)
    I wish that, just once, a lot of people will get ripped off. The credit card companies will cover any losses (they have to by law), and people will actually realise that yes, keeping up to date with patches is a good idea.
    • Re:You know... (Score:3, Informative)

      by psbrogna ( 611644 )
      Cards with a MC/Visa logo only protect you if they're actually a credit card. If they're an ATM you're SOL.
    • by Scott Richter ( 776062 ) on Friday June 04, 2004 @04:01PM (#9338594)
      I wish that, just once, a lot of people will get ripped off. The credit card companies will cover any losses (they have to by law), and people will actually realise that yes, keeping up to date with patches is a good idea.

      It's easy for us to say that, we're computer users who (presumably) know what we're doing. But if one is to condemn non-patchers in that way - I assume you also change your oil every 3000 miles, go to the dentist every 6 months, floss daily, get an annual physical, clean the lint filter in your dryer after every load, eat 6 daily servings of vegetables, rotate your tires every 20,000 miles, have all your car's factory recalls done, change the air filters in your heater monthly, and perform all the other mindless routine maintenance you're supposed to do.

      The bottom line is, no one on earth outside the most anal retentive person alive does all that stuff. Not doing any of them could have consequences, but people simply don't have time to do all this shit.

      So yes, I do blame microsoft. One shouldn't have to constantly check symantec's web page just to keep your computer usable. Computers are appliances now. They should just work, dammit.

      • I just posted a similiar rant. :)

        You're absolutely right. I have a friend who was completely anal about a lot of things. His car was his favorite toy. He's 30-something now, and has started becoming more lax. He hasn't been rotating his tires, or even taking a good look at them. He was occasionally glancing at the outside edge, seeing the tread looked ok, and assumed all was fine.

        A couple weeks ago, on a wet road, he slid off the road, and his car ended up in a lake. Why? Because his alignm
      • by skifreak87 ( 532830 ) on Friday June 04, 2004 @05:12PM (#9339537)
        Both of my parents have close to know idea how a computer works. They're computer got the sasser worm or some variant that kept restarting before they could do anything (solution, have a bootable disc to use so as not to boot off the hard-drive). What they didn't understand is that they CAN get viruses/worms by just being on the internet. Next thing, why wasn't their XP up to date, they thought it would cost money to get the updates so they never did (since they couldn't tell windows update notices apart from the mcaffee security center update notices - which do cost money once your subscription runs out) and never thought they could get viruses/worms except through email.

        Both my parents are quite intelligent and can work a computer for what they need (word processor/quicken/email/browser) fairly competently. The problem, IMHO, is that computer users view a computer as any other appliance, it should just work, and think if they follow some common-sense (such as not opening strange attachments) they wont have problems. People don't understand why it's important to patch a computer or even how to do it, so they don't.
      • rotate your tires every 20,000 miles

        I rotate my tyres every single mile I drive. It kind of happens automatically with this whole 'wheel' thing.

  • Morbo? (Score:4, Funny)

    by FlipmodePlaya ( 719010 ) on Friday June 04, 2004 @03:38PM (#9338318) Journal
    Puny humans fear Korgo...
  • Worm vs Virus (Score:5, Informative)

    by DJ-Dodger ( 169589 ) on Friday June 04, 2004 @03:40PM (#9338333) Homepage
    If you "just get it" without having to run anything, it's a worm, not a virus. It's not complicated.
    • Re:Worm vs Virus (Score:4, Informative)

      by hovis ( 660250 ) <hovis-slashdot@meat-shiel d . c o m.com> on Friday June 04, 2004 @04:07PM (#9338677)
      It's kinda more complicated than that::

      VIRUS: File infector, Self-Replicating A virus will insert it's own code into another _pre-existing_ file. It also replicates automatically every time it's run.

      WORM: Self replicating
      A worm self-replicates liek a virus, but it does not infect pre-existing files. A worm will create a whole new file that is pure viral code (usually with a spoofed name like iexplorer.exe as opposed to the legit file iexplore.exe)

      TROJAN:
      A trojan is also it's own file of pure viral code, but does not self-replicate (However, they frequently facilitate remote control of the Trojan that can be used to replicate it)

      Symantec has a document on this, the link is... What is the difference between Viruses, Trojans and Worms? [symantec.com]

  • by Flexagon ( 740643 ) on Friday June 04, 2004 @03:41PM (#9338341)
    Though the listed viruses may be new, the actual update was released over a month ago and those of us here should already know better. This is the kind of "timely" information I get from Comcast support.
  • As For Me (Score:4, Funny)

    by Anonymous Coward on Friday June 04, 2004 @03:45PM (#9338402)
    I for one salute our new script kiddie overlords.
  • Okay, you got me... (Score:3, Interesting)

    by DigitalSorceress ( 156609 ) on Friday June 04, 2004 @03:48PM (#9338442)
    I read the post and immediately thought "oh gosh, here we go again" and went to MS windows update to update my workstation while I downloaded the patch. Then I realized that I'd already updated everyone here at the office back when the patch first came out.

    Damn, I gotta rtfa *grin*

    Seriously though, even though I check for new updates religously and try to keep all the users on my network up to date, I guess I'm still a little gun-shy.
  • by Anonymous Coward on Friday June 04, 2004 @03:51PM (#9338482)
    is not slashdotted? They are running Windows Server 2003 with IIS and everyone here knows that is bad...
  • updating (Score:3, Interesting)

    by millahtime ( 710421 ) on Friday June 04, 2004 @03:54PM (#9338513) Homepage Journal
    Since only legal users of XP can install the updates, does this mean that all those people using illegal copies can't get the update?

    Figuring so, a lot of people could get screwed.
    • Re:updating (Score:3, Insightful)

      by RTMFD ( 69819 )
      Damn, so if I go rip off my neighbor's Pontiac should I be pissed off when the steering column catches on fire because I couldn't take it back to the dealer during the recall? This issue looks like a common sense to me.

      Committing theft takes away your right to be upset about such things, IMHO.
  • Not Exactly... (Score:5, Informative)

    by mexnix ( 709302 ) on Friday June 04, 2004 @03:57PM (#9338560)
    F-Secure Weblog [f-secure.com] says Korgo doesn'ts install a key logger by default, but that the "cracker team" uses Korgo's backdoor to do so. So, you wont necessarily have the key logger installed if you have any of the Korgo variants. At least, none up to this point...
  • When I first saw this I thought I read a virus named Torgo! It wobbles around, moves slowly, and takes care of your computer while you're away.

  • by G4from128k ( 686170 ) on Friday June 04, 2004 @03:58PM (#9338572)
    Are the logged keystrokes of most of these viruses transmitted in the clear? If so, then couldn't one create a outbound traffic monitor that watched for certain key character strings (such as passwords, account numbers, etc.) and if the monitor see sensitive data strings in clear text, it would halt the transmission and alert the owner. This could also be used to halt snooping of files and directory structures -- just create a file with a monitor-prohibitted file name and contents.

    As a side benefit, the system would also catch insecure site logins - seeing which websites are asking for unencrypted sensitive data such as passwords.
  • Easy fix (Score:5, Funny)

    by staticdaze ( 597246 ) on Friday June 04, 2004 @03:58PM (#9338573)
    Just cache all your passwords and credit card info in your browser's form remembering thing.
  • by picklepuss ( 749206 ) on Friday June 04, 2004 @04:01PM (#9338593) Homepage
    Thank God I trust Internet Explorer enough to remember my bank password for me... now I don't have to worry about viruses that log my keystrokes!
  • Gee (Score:4, Funny)

    by the_mad_poster ( 640772 ) <shattoc@adelphia.com> on Friday June 04, 2004 @04:04PM (#9338626) Homepage Journal

    Good thing I'm not dumb enough to type anything important of my own on a Windows box. I guess if I'm infected at work, they'll get the company's code, and if I'm infected at home, they'll found out that I like to cast "Magic Missile" in conjunction with "Flamestrike" when facing strong magic users to disrupt their concentration then hit them with a heavy blast while my warriors move in for the kill.

    I'm sure that latter piece is exceptionally valuable information...

  • by smcavoy ( 114157 ) on Friday June 04, 2004 @04:05PM (#9338652)
    Korgo sounds so much better then sasser.
    Not quite fear-of-god inducing, but whatever.

  • by kelzer ( 83087 ) on Friday June 04, 2004 @04:25PM (#9338888) Homepage

    The virus named, Korgo, started showing up . . .

    A panda walks into a café. He orders a sandwich, eats it, then draws a gun and fires two shots in the air.

    "Why?" asks the confused waiter, as the panda makes towards the exit. The panda produces a badly punctuated wildlife manual and tosses it over his shoulder.

    "I'm a panda," he says, at the door. "Look it up."

    The waiter turns to the relevant entry and, sure enough, finds an explanation.

    "Panda. Large black-and-white bear-like mammal, native to China. Eats, shoots and leaves."

    I highly recommend that the submitter (Anonymous User) immediately head over to his/her favorite online book retailer and purchase Eats, Shoots and Leaves [eatsshootsandleaves.com].

  • by bob_jenkins ( 144606 ) on Friday June 04, 2004 @04:31PM (#9338982) Homepage Journal
    Most people who have computers use them as one tool among many. They don't have to maintain their phone weekly or even monthly, or their hammers, or their sofas. Smoke alarms are supposed to be tested once a month, but who does that?

    I have a lot of relatives who used to use computers but have mostly given up on them. What with spam, and viruses, and worms, and trojans, and spyware, I can't blame them. Unless they give you a whole lot in return, they're not worth the hassle.
  • short lived? (Score:3, Interesting)

    by abertoll ( 460221 ) on Friday June 04, 2004 @05:10PM (#9339505) Homepage Journal
    "The keys are then sent back to the virus creator"

    I've always wondered about this sort of thing... doesn't that make the creator pretty easy to catch?
  • by rspress ( 623984 ) on Friday June 04, 2004 @06:21PM (#9340231) Homepage
    They seem to code better and faster than Microsofts own people. Plus they know something about security, which seems to be lacking in Redmond.

    If SP2 does not fix these holes like Microsoft claims it will then they should be libel for the money that business lose due to badly written software. Microsoft needs to change the way it updates its software. Instead of releasing a service pack and charging for it when it does come out they should step to releases every month or two, like the way OS X does.

    As a matter of fact Microsoft seems to be in the same state Apple was in before Jobs came back. Lost and clueless developing products that they were not good at and had a directionless system software development. This far into WindowsXP MS should have had nearly all of the framework for longhorn laid out and most of the coding done, yet we hear of announced features being dropped because it won't meet their deadline which is two years off. Something is wrong in Redmond and now is the time for Linux and OS X take advantage of it, if they don't do it now they may not have another chance. Unless of course longhorn is the worst mistake they have ever made.

  • by bfg9000 ( 726447 ) on Friday June 04, 2004 @06:21PM (#9340236) Homepage Journal
    "Windows Users Fear Korgo Virus" screams the headline, reading not so much like news as just another WindowsXP sales pitch. Yes, it's true -- Windows users DO fear the Korgo virus, while the insignificant and ostracized Mac and Linux users of the world are left, yet again, fearing only the sheer and utter BOREDOM of not having any viruses or trojans to fix due to their curious choice of OS. In the area of viruses, trojans, and worms, Linux and the Mac really do stand out as being "second class citizens", trapped in a virus-free ghetto with no salvation in sight. The discrepancy is so obvious, the ultra-competitive Microsoft doesn't even feel the need to buy themselves an Official Gartner Group Research Study to prove that Windows is light-years ahead in this area. Even the most staunch Linux or Mac advocate is forced to admit it -- off the record, of course. Virus writers, known to be excellent coders who take pride in their tight, bugfree code, have overwhelmingly standardized on Microsoft Windows as their targeted system of choice in the deployment of their ongoing suite of virus applications.

    And it doesn't look like the situation is going to get better any time soon.

    One bearded Linux coder, who refused to be identified publicly, confessed "we just don't have the selection -- or quality -- of viruses on our platform that is available to Windows users free of charge. And it's tearing us up inside knowing that the battle is over, and Microsoft has clearly won." Similarly, a guy with an Apple logo shaved into the back of his head admitted the following once we turned off the cameras. "I don't mean to break ranks and insult our software selection," he whispered furtively, "but usually if we DO manage to get a virus that will even install on OS X, it's not that great, and we're left... disappointed, realizing that if we had simply stuck with the unwashed smelly masses, we too could be enjoying a daily barrage of free software delighting us by installing itself on our computers as a surprise gift. Instead, I'm stuck with the weak consolation prize of 40 Academy Awards for my work on Lord Of The Rings. But it's not the same. No amount of awards or million dollar paycheques can heal the feelings of neglect or massive abandonment issues this whole thing has given me."

    "Is this the reason so many people choose Windows?", his innocent young son, Moof, asked me, looking like the kid off the Dave software box. [thursby.com]

    "What do you think, little one? Look at the Windows dominance in the virus field, then look at the marketshare of Windows. That ain't no coincidence, Moof. The other guys just can't keep up with the Microsoft Juggernaut. Microsoft is fighting hard to keep themselves Number One, just like the Titanic was the biggest and bestest ship, or the Hindenberg was the coolest and most flammable Zeppelin, or the dinosaurs were the toughest animals ever. How do you compete with that?"

    =============

    Yes, sitting here at my desk 16 hours later, WindowsXP Restore Disks in hand, I can't help but let a little smile shine across my face. Those poor fools, I think, using a non-Microsoft OS really does take away most of the joy of computing and replaces it with all that productivity and recreation crap. And where's the challenge in that?

    Please insert Microsoft Windows XP Restore Disk 2

    Ahhh, I sigh contentedly. It's gonna be a long night.

THEGODDESSOFTHENETHASTWISTINGFINGERSANDHERVOICEISLIKEAJAVELININTHENIGHTDUDE

Working...