W32/Lovgate.AB Worm

 Information about the W32/Lovgate.AB worm:

W32/Lovgate.AB is an email worm. This worm is a variant of W32/Lovgate worm.The worm also has the backdoor characteristics. The worm will infect Windows systems. The worm spreads through email and shared network drives. 

The from address of infected email is spoofed or the user name is taken from the list given below along with a <domain name>.

tom
ted
steve
stan
smith
serg
helen
george
fred
debby
david
dave
sandra
sam
mary
maria
linda
leo
kevin
robert
ray
peter
mike
michael
matt
julie
jose
john
joe
jimmy
jim
jerry
jane
james
jack
dan
claudia
brian
brent
brenda
bob
bill
anna
andrew
alice
alex
adam

The worm arrives with the subject as reply to an email sent recently with a prefix RE:.

Subject: RE: <subject>

The body of the mail will be any one of the following:

The name of the infected attachment will be any one of the following.

the hardcore game-.pif
Sex in Office.rm.scr
Deutsch BloodPatch!.exe
s3msong.MP3.pif
Me_nude.AVI.pif
How to Crack all gamez.exe
Macromedia Flash.scr
SETUP.EXE
Shakira.zip.exe
dreamweaver MX (crack).exe
StarWars2 - CloneAttack.rm.scr
Industry Giant II.exe
DSL Modem Uncapper.rar.exe
joke.pif
Britney spears nude.exe.txt.exe
I am For u.doc.exe

When the worm is executed, it copies itself to the Windows System folder as;

kernel66.dll
ravmond.exe
iexplore.exe

The following files dropped in Windows System folder are the backdoor component of the worm.

lmmib20.dll
msjdbc11.dll
mssign30.dll
odbc16.dll

It also drops systra.exe in Windows folder and command.exe in the root of C drive.

It modifies the registry at the following location to load itself during the next startup.

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

The worm tries to copy itself to the shared folders on the network in any of the following names;

3D Flash Animator.rar.bat
Adobe Photoshop6.0.zip.exe
CloneCD crack.exe
Download.exe
HyperSnap-DX v4.51.01.exe
SWF Browser2.93.txt.exe
Star Wars Downloader.exe
Swish2.00.pif
Thank you.doc.exe
WinZip v9.0 Beta Build 5480 crack.exe
You_Life.JPG.pif
HyperSnap-DX v5.20.01.exe
Panda Crack.zip.exe
Real-DRAW PRO v3.10.exe
WinRAR V3.2.0 Beta 2.exe

The backdoor component of the worm allows the remote user to access the infected computer.

The worm also tries to connect to the shares using its own set of usernames and passwords.

This worm first appeared on 17th May 2004.

 Other names of W32/Lovgate.AB worm:

This worm is also known as W32/Lovgate-AB, W32/Lovgate.ab@MM