W32/LovGate.AD Worm

 Information about the W32/LovGate.AD Worm:

W32/LovGate.AD is a worm. The worm will infect Windows systems and spreads through email.

The infected email carries a spoofed 'From' address picked up randomly from the infected system.

The subject of the infected mail will be any of the following;

hi
hello
Mail Delivery System
Mail Transaction Failed
Server Report
Status
Error

The body of the infected mail will be any of the following;

Mail failed. For further assistance, please contact!
The message contains Unicode characters and has been sent as a binary attachment.
It's the long-awaited film version of the Broadway hit. The message sent as a binary attachment.

The name of the infected attachment will be any of the following;

Britney spears nude.exe.txt.exe
How to Crack all gamez.exe
I am For u.doc.exe
the hardcore game-.pif
Sex in Office.rm.scr
Deutsch BloodPatch!.exe
s3msong.MP3.pif
Me_nude.AVI.pif
StarWars2 - CloneAttack.rm.scr
Macromedia Flash.scr
SETUP.EXE
Shakira.zip.exe
joke.pif
dreamweaver MX (crack).exe
Industry Giant II.exe
DSL Modem Uncapper.rar.exe

Upon execution, it copies as suchost.exe, SYSTRA.EXE in Windows folder, COMMAND.EXE, AUTORUN.INF in Root of windows installed folder and realsched.exe, vptray.exe, hxdef.exe, RAVMOND.exe, IEXPLORE.EXE, NetMeeting.exe, spollsv.exe in System folder.

It also copies as kernel66.dll, ODBC16.dll, msjdbc11.dll, MSSIGN30.DLL in System folder are backdoor component of the worm.

The worm modifies registry at the following location to load itself during each startup.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows

The backdoor component of the worm allows the remote user to access the infected computer.

The worm attempts to terminate some of the security related processes.

This worm first appeared on January 30, 2008.

 Other names of W32/LovGate.AD Worm:

This Worm is also known as W32/Lovgate.AD@mm, Win32.LovGate.AC@mm, W32.LovGate.AD, Win32.Lovgate.ad, Win32/Lovgate.AL, Worm.LovGate.ad, W32/Lovgate.AD@mm, W32/Lovgate.ac@MM, Win32/Lovgate.AK, W32/Lovgate.AO, W32/Lovgate-F, W32.Lovgate.X@mm.