W32/Lovgate Worm

 Information about the W32/Lovgate worm:

W32/Lovgate is an email worm. This worm also has the backdoor characteristics. This worm will infect Windows systems. The worm spreads through email and shared network drives. 

The worm arrives with a random subject. The subject is a combination of words randomly chosen by the worm.

The content of the mail is a combination of the messages randomly chosen by the worm.

The names of the infected attachments of the worm are randomly generated from the words contained in a list of its own.

When the worm is executed, it copies itself to the SYSTEM folder of Windows as rpcsrv.exe, syshelp.exe, WinGate.exe, winprc.exe and WinRpcsrv.exe. It modifies the registry at the following location to load itself during the next startup.

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

It also alters Run value under WIN.INI file to load itself during next startup.

The worm tries to copy itself to shared folders on network any of the following names;

billgt.exe
Card.EXE
docs.exe
fun.exe
hamster.exe
humor.exe
images.exe
joke.exe
midsong.exe
news_doc.exe
pics.exe
PsPGame.exe
s3msong.exe
searchURL.exe
SETUP.EXE
tamagotxi.exe

The worm carries a backdoor component, which allows the remote user to access the infected computer.

This worm first appeared on 19th February 2003.

 Other names of W32/Lovgate worm:

This worm is also known as WORM_LOVGATE.B, Lovgate, W32.HLLW.Lovgate@mm