New virus targeting bank accounts

New Viruses Hit 30-Month High June 3, 2004
Sophos says there were 959 new viruses released on the Internet last month, the most since December 2001.
By TechWeb News

The number of new viruses released on the Internet in May hit a 2-1/2-year high last month, an anti-virus vendor says.
Five new viruses released in May made Sophos' Top 10 for the month. Included are Sasser, Netsky-Z, Sober-G, Bagle-AA, and Lovgate-V, the company said Wednesday. Sasser led the pack in the number of infected machines reported.

Sophos found a total of 959 new viruses on the Internet in May, the highest number since December 2001. That number includes new viruses that were variants of older ones.

Also, security vendor Symantec Corp. on Wednesday upgraded the Korgo.F virus to a level 3 from a level 2, because of an increase in submissions, the company said.

"W32.Korgo.F includes backdoor functionality that could leave systems open to unauthorized access," Alfred Huger, senior director at Symantec Security Response, said in a statement. "This backdoor functionality could result in a loss of confidential data and may also compromise security settings."

Korgo.F attempts to propagate by exploiting a Windows XP and 2000 vulnerability reported by Microsoft on April 13.

W32.Korgo.F now a Level 3 threat

Date: 03 June 2004 Issue: ninetyone (31/05/04 - 05/06/04)
(ICT World)
Category: Technical


Due to an increase in submissions in the last 12 hours, Symantec Security Response has upgraded W32.Korgo.F from a Level 2 to a Level 3 threat.

"W32.Korgo.F includes backdoor functionality that could leave systems open to unauthorised access," says Alfred Huger, senior director, Symantec Security Response. "This backdoor functionality could result in a loss of confidential data, and may also compromise security settings. This threat is another strong example of why it is critical for computer users to be diligent in applying security patches, keeping virus definitions updated, and following best practices."

According to Symantec W32.Korgo.F is a worm that attempts to propagate by exploiting a Microsoft Windows vulnerability publicly announced on April 13 - Microsoft LSASS Buffer Overrun Vulnerability. This blended threat, says the company, affects computer users on Windows 2000 and Windows XP.

Symantec says W32.Korgo.F will listen on TCP ports 113 and 3067 and could open back doors on those ports.

Threats to privacy and confidentiality, says the company, have been the fastest growing threat in recent months, with the Symantec Internet Threat report released in March showing a 514% growth in volume of submissions within the top ten.

"The rising incidents of blended threats with the potential to open backdoors, demonstrates the importance of an integrated approach to security within the infrastructure" says Kevin Isaac, regional director, Middle East & Africa. "A firewall will block unusual port traffic by default, and, when combined with updated anti-virus and intrusion detection systems, offers top level protection. If users are affected, there is a free removal tool, as well as manual removal instructions on http://www.securityresponse.symantec.com."

Symantec says it strongly advises users to apply the patch provided by Microsoft for the LSASS Buffer Overrun Vulnerability as soon as possible. In addition, Symantec recommends that users update their anti-virus definitions to prevent exploitation of this threat. It says that users should also check that their firewall is configured to block ports 113 and 3067.

More information and virus definitions are available at http://securityresponse.symantec.com/avcenter/venc/data/w32.korgo.f.html.