12/05/2008

2004 KORGO worm re-appearing again

len04

This is a worm from 2004 but that seems to be re-appearing - like so many older viruses that still are active because patches aren't installed or distributed.

You should block access to port 6667 or any IRC service on your network firewall

and especially to those

  • gaspode.zanet.org.za
  • lia.zanet.net
  • irc.tsk.ru
  • london.uk.eu.undernet.org
  • washington.dc.us.undernet.org
  • los-angeles.ca.us.undernet.org
  • brussels.be.eu.undernet.org
  • caen.fr.eu.undernet.org
  • flanders.be.eu.undernet.org
  • graz.at.eu.undernet.org
  • moscow-advocat.ru
  • gaz-prom.ru
  • some of these servers we also get to see in another listing of top attacking servers

    http://www.symantec.com/security_response/writeup.jsp?doc...

    09:57 | Permalink | Comments (0) | Email this | |  del.icio.us | | Digg! Digg |  Facebook

    Post a comment