F - K O R G O
-------------

The F-Korgo utility disinfects computers infected with Korgo.P 
(also known as Padobot.G) and Korgo.Q (also known as Padobot.H) 
worm variants.

Disinfection procedure should be as follows:

1. Unpack the F-Korgo utility from the provided ZIP archive 
either with WinZip or PkUnzip utilities. A trial version of 
WinZip archiver can be downloaded from the following website:

http://www.winzip.com/ddchomea.htm
                                   
2. Run the unpacked F-Korgo.exe file from a hard disk to 
eliminate the infection. You can run the utility by either 
doubleclicking on it from Windows Explorer or you can start it 
from a command interpreter (COMMAND.COM or CMD.EXE) by typing its 
name at command prompt and pressing 'Enter' (for advanced users).

First the F-Korgo utility will kill Korgo worm's processes in 
memory. Then the utility will remove Registry entries created by 
the worm. Finally the utility will scan all hard drives for 
infected files and delete them.

3. Restart a computer. After restart your system should be clean.


You can get a trial version of F-Secure Anti-Virus and the latest 
updates for it from our website:

http://www.europe.f-secure.com/download-purchase/list.shtml
http://www.europe.f-secure.com/download-purchase/updates.shtml


IMPORTANT NOTES
---------------

Korgo worm uses LSASS exploit to spread to remote computers. That 
is why it is very important to install the security patch against 
LSASS vulnerability to avoid re-infection. The security patch can 
be downloaded from Microsoft's website:

http://www.microsoft.com/technet/security/bulletin/MS04-011.mspx

During disinfection of Korgo worm variants the F-Korgo utility 
will have to temporarily close Explorer.exe file (one of the main 
Windows components) that will result in disappearing of all icons 
on a desktop and a taskbar on the bottom of the screen. This is 
normal, the tool will restart Explorer.exe file as soon as 
scanning of a hard drive is finished. Also in some cases a new 
Explorer window may appear after disinfection. This is also a 
normal behaviour.

If a computer with Windows NT, 2000 or XP system is being 
disinfected, please log in as Administrator or as a user with 
local admin rights, otherwise the F-Korgo utility might not 
disinfect the system correctly.

If you have Windows ME or XP, it is recommended to disable System 
Restore feature of these operating systems to prevent your 
computer from re-infection with Korgo worm. The fact is that 
System Restore feature of these operating systems might save the 
infected file into the special folder and copy it back to a hard 
drive it every time it's been deleted by F-Korgo utility. The 
instructions on how to disable System Restore feature are here:

Windows ME:
http://www.europe.f-secure.com/v-descs/sfc_dis.shtml

Windows XP:
http://www.europe.f-secure.com/v-descs/sfc_dis1.shtml

If you have any problems using this utility please contact us on 
'anti-virus-support@f-secure.com' address.

Copyright (C) 2004 F-Secure Corporation. All rights reserved.