Stinger utilizes next generation scan engine technology, including process scanning, digitally signed DAT files, and scan performance optimizations. It propagates by exploiting the LSASS vulnerability on TCP port 445 (as described in Microsoft Security Bulletin MS04-011) Note that Nessus did not try to talk to the backdoor, so this might be a false positive.

McAfee AVERT Stinger is not a substitute for the full anti-virus protection, but rather a tool that assists administrators and users when dealing with an infected system. The Korgo worm is known to open a backdoor on these ports. Stinger is a stand-alone utility used to detect and remove specific viruses. It is not a substitute for full anti-virus protection, but rather a tool to assist administrators and users when dealing with an infected system. Stinger is a FREE stand-alone utility from McAfee used to detect and remove specific viruses. Anti-virus firms have detected yet another worm exploiting the Local Security Authority Subsystem Service (LSASS) vulnerability that was patched by Microsoft in its April batch of security updates.

Korgo worm virus