W32/Lovgate.C Worm

Subscribe to Virus Alert
Mailing List

Enter your Email
(Ex : john@company.com)

W32/Lovgate.C Worm

Information about the W32/Lovgate.C worm:

W32/Lovgate.C is an email worm. This worm is a variant of W32/Lovgate worm.This worm also has the backdoor characteristics. This worm will infect Windows systems. The worm spreads through email and shared network drives.

The worm arrives with the subject as reply to an email sent recently with a prefix RE:.

Subject: RE: <subject>

Message body:

"<victim machine>" wrote: ====

<Body of sent mail>

====

YAHOO.COM Mail auto-reply:

' I'll try to reply as soon as possible. Take a look to the attachment and send me your opinion! '

Get your FREE YAHOO.COM Mail now!

The name of the infected attachment of the worm will be same as the dropped file in the network shared drive.

When the worm is executed, it copies itself to the SYSTEM folder of Windows as rpcsrv.exe, syshelp.exe, WinGate.exe, winprc.exe and WinRpcsrv.exe. It modifies the registry at the following location to load itself during the next startup.

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

It also alters Run value under WIN.INI file to load itself during next startup.

The worm tries to copy itself to the shared folders on the network in any of the following names;

billgt.exe
Card.EXE
docs.exe
fun.exe
hamster.exe
humor.exe
images.exe
joke.exe
midsong.exe
news_doc.exe
pics.exe
PsPGame.exe
s3msong.exe
searchURL.exe
SETUP.EXE

The worm carries a backdoor component, which allows the remote user to access the infected computer.

This worm first appeared on 24th February 2003.

Other names of W32/Lovgate.C worm:

This worm is also known as WORM_LOVGATE.C, W32/Lovgate-B, W32.HLLW.Lovgate.C@mm

Click here to download a 30 day Evaluation Copy of
Protector Plus for your operating system

About Protector Plus Antivirus Software Packages:

Proland Software is the developer of Protector Plus range of antivirus software packages. Protector Plus is available for Windows Vista, Windows 95/98/Me, Windows XP, Windows NT/2000/2003 servers and workstations, MS-Exchange 2000/2003, MS-DOS and NetWare servers.

New:
SpamChoke Antispam Software
Download Now!

Protector Plus range of antivirus products offer on-line virus detection and removal. All the packages have the ability to detect and isolate all types of viruses, trojans, worms and other types of malware. Protector Plus antivirus software can detect and remove W32/Lovgate.C worm reliably. These products are updated on a continuous basis and the latest upgrades for all the platforms are made available for downloading from this site.

Click here to order
Protector Plus Antivirus software