Quote:
When W32.Korgo.V is executed, it performs the following actions:
Deletes the file, ftpupd.exe, from the folder in which the worm was executed.
Creates the mutex "uterm19" to ensure that only one instance of the worm is executed on the computer.
Creates the event object "u19x."
Opens the following event objects:
u19
u18
u17
u16
u15
u14
u13i
u13
u12
u11
u10
u18x
u17x
u16x
u15x
u14x
u13x
u12x
u11x
u10x
Deletes the values:
"Windows Security Manager"
"Disk Defragmenter"
"System Restore Service"
"Bot Loader"
"SysTray"
"WinUpdate"
"Windows Update Service"
"avserve.exe"
"avserve2.exeUpdate Service"
"MS Config v13"
one more thing when i run nestat -an it said some port is listening. but the foreign address is 0.0.0.0:0. is it posibility because of the virus activity, if yes how do i disable it.