Summary
The remote host is probably infected with Korgo worm.
It propagates by exploiting the LSASS vulnerability on TCP port 445 (as described in Microsoft Security Bulletin MS04-011) and opens a backdoor on TCP ports 113 and 3067.
Solution
- Disable access to port 445 by using a firewall
- Apply Microsoft MS04-011 patch.
References
