Lovgate.W worm

Name: Lovgate.W worm

Type: Mass-mailing email and filesharing worm that contains backdoor capabilities

Discovered: August 2004

Email characteristics: Lovgate.W spreads via email, P2P filesharing, and network shares protected by weak passwords

System impact: Lovgate.W loads via the following registry keys:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
VFW Encoder/Decoder Settings = RUNDLL32.EXE MSSIGN30.DLL ondll_reg

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
Program In Windows = C:\WINDOWS\System32\IEXPLORE.EXE

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
Protected Storage = RUNDLL32.EXE MSSIGN30.DLL ondll_reg

HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices\
SystemTra = C:\WINDOWS\SysTra.EXE

Lovgate.W copies itself to network shares and P2P fileshares using the following filenames:

Are you looking for Love.doc.exe
The world of lovers.txt.exe
How To Hack Websites.exe
Panda Titanium Crack.zip.exe
Mafia Trainer!!!.exe
100 free essays school.pif
AN-YOU-SUCK-IT.txt.pif
Sex_For_You_Life.JPG.pif
CloneCD + crack.exe
Age of empires 2 crack.exe
MoviezChannelsInstaler.exe
Star Wars II Movie Full Downloader.exe

Manual removal: Use updated antivirus software to detect and remove this threat.