Internet threat level: 1
Home→Descriptions→Email-Worm.Win32.LovGate.w
Email-Worm.Win32.LovGate.w
| Detected | Apr 05 2004 16:11 GMT |
| Released | Jul 31 2004 09:50 GMT |
| Published | Apr 05 2004 16:11 GMT |
Technical Details
This worm spreads via the Internet as an attachment to infected messages. It is written in MFC.
The worm itself is approximately 125KB in size, packed using ASPack. The unpacked file is approximately 205KB in size.
Installation
Once launched, the worm copies itself under several different names to the Windows system and root directories:
%system%\Kernel66.dll %system%\IEXPLORE.exe %system%\hxdef.exe %system%\RAVMOND.exe %windir%\SYSTRA.exe c:\command.exe
It also saves its components in the following files:
%System%\NetMeeting.exe %system%\spoolsv.exe %SysDir%\msjdbc11.dll %SysDir%\MSSIGN30.DLL %SysDir%\ODBC16.dll %SysDir%\Lmmib20.dll
It also creates a file named AUTORUN.INF in the root directory of all accessible disks.
The worm creates several copies of itself in ZIP or RAR format. These copies are saved under random names in the root directories of all accessible disks.
It registers several copies of itself in the system registry. This ensures that these copies will be launched every time Windows is restarted.
[HKLM\Software\Microsoft\Windows\CurrentVersion\Run] "WinHelp"="%System%\WinHelp.exe" "Hardware Profile"=""="%system%\hxdef.exe" "Microsoft NetMeeting Associates, Inc."="NetMeeting.exe" "Program in Windows"="%System%\IEXPLORE.EXE" "Protected Storage"="RUNDLL32.EXE MSSIGN30.DLL ondll_reg" "VFW Encoder/Decoder Settings"="RUNDLL32.exe MSSIGN30.DLL ondll_reg"
[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows] "run"="RAVMOND.exe"
It also creates the following system registry value:
[HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices] "SystemTra"="%Windir%\Systra.exe"
It creates an additional registry value to flag its presence in the system:
HKLM\Software\Microsoft\Windows\CurrentVersion\ZMXLIB1
Propagation via local networks
It makes the Ó:\windows\Media folder accessible via the local network under the name \\Media.
It copies itself to all network disks under the following names:
autoexec.bat Cain.pif client.exe Documents and Settings.txt.exe findpass.exe i386.exe Internet Explorer.bat Microsoft Office.exe mmc.exe MSDN.ZIP.pif Support Tools.exe Windows Media Player.zip.exe WindowsUpdate.pif winhlp32.exe WinRAR.exe xcopy.exe
The worm attempts to copy itself to all local network machines by using the Adminstrator account. It uses the following passwords to attempt to gain access to the account:
!@#$ !@#$% !@#$%^ !@#$%^& !@#$%^&* 0 000000 00000000 007 1 110 111 111111 11111111 12 121212 123 123123 1234 12345 123456 1234567 12345678 123456789 123abc 123asd 2003 2004 2600 321 54321 | 654321 666666 888888 88888888 a aaa abc abc123 abcd abcdef abcdefg admin Admin admin123 administrator Administrator alpha asdf asdfgh computer database enable god godblessyou guest Guest home Internet Login login love | mypass mypass123 mypc mypc123 oracle owner pass passwd password Password pc pw pw123 pwd root secret server sex sql super sybase temp temp123 test test123 win xp xxx yxcv zxcv |
If the worm succeeds in establishing a connection, it copies itself to \admin$\system32\NetManager.exe and launches the file as 'Windows Management NetWork Service Extensions'.
Propagation via email
The worm sends itself to all addresses on emails in the Inbox. It also searches files with extensions listed below for email addresses to send itself to:
adb asp dbx htm htm php pl sht tbb wab
Infected messages
Infected messages contain the following text:
If you can keep your head when all about you Are losing theirs and blaming it on you; If you can trust yourself when all men doubt you, But make allowance for their doubting too; If you can wait and not be tired by waiting, Or, being lied about,don't deal in lies, Or, being hated, don't give way to hating, And yet don't look too good, nor talk too wise; ... ... more look to the attachment. < Get your FREE <sender's domain>now! <
Attachment name (chosen at random from the list below):
Britney spears nude.exe.txt.exe Deutsch BloodPatch!.exe dreamweaver MX (crack).exe DSL Modem Uncapper.rar.exe How to Crack all gamez.exe I am For u.doc.exe Industry Giant II.exe joke.pif Macromedia Flash.scr Me_nude.AVI.pif s3msong.MP3.pif SETUP.EXE Sex in Office.rm.scr Shakira.zip.exe StarWars2 - CloneAttack.rm.scr the hardcore game-.pif
The worm also sends itself using its own SMTP server.
Message header (chosen at random from the list below):
Error hi hello Mail Delivery System Mail Transaction Failed Server Report Status test
Message body (chosen from those listed below):
It's the long-awaited film version of the Broadway hit. The message sent as a binary attachment. The message contains Unicode characters and has been sent as a binary attachment. Mail failed. For further assistance, please contact!
Attachment name:
randomly generated, with one of the following extensions..exe .scr .pif .cmd .bat .zip .rar .
Other
It terminates processes containing the following text strings in their names:
Duba Gate KAV kill KV McAfee NAV RavMon.exe Rfw.exe rising SkyNet Symantec Rising Realtime Monitor Service Symantec Antivirus Server Symantec Client
The worm harvests information about the victim machine, saves it in a file named c:\Netlog.txt and sends this file to the worm's author via email.
It installs a backdoor on TCP port 6000 to receive commands.
It launches an FTP server without login or password on a random port.
The worm searches all accessible disks from C: to Z: for files with the extension .exe. It then renames them as *.zmx, ascribes the attribute 'hidden/ system' to these files, and copies itself to the original files under the original names (working in the same way as companion viruses do.)
Email-Worms spread via email. The worm sends a copy of itself as an attachment to an email message or a link to its file on a network resource (e.g. a URL to an infected file on a compromised website or a hacker-owned website).
In the first case, the worm code activates when the infected attachment is opened (launched). In the second case, the code is activated when the link to the infected file is opened. In both case, the result is the same: the worm code is activated.
Email-Worms use a range of methods to send infected emails. The most common are:
- using a direct connection to a SMTP server using the email directory built into the worm’s code
- using MS Outlook services
- using Windows MAPI functions.
Email-Worms use a number of different sources to find email addresses to which infected emails will be sent:
- the address book in MS Outlook
- a WAB address database
- .txt files stored on the hard drive: the worm can identify which strings in text files are email addresses
- emails in the inbox (some Email-Worms even “reply” to emails found in the inbox)
Many Email-Worms use more than one of the sources listed above. There are also other sources of email addresses, such as address books associated with web-based email services.
Email-Worm.
- I-Worm.
LovGate. w (Kaspersky Lab) - Virus:
W32/Lovgate. x@MM (McAfee) - Mal/Generic-L (Sophos)
- W32/Lovgate.
AB. worm (Panda) - W32/Lovgate.
gen (FPROT) - Worm:
Win32/Lovgate. V@mm (MS(OneCare)) - Win32.
HLLM. Lovgate. 9 (DrWeb) - Win32/Lovgate.
Z worm (Nod32) - Win32.
LovGate. W@mm (BitDef7) - I-Worm.
Lovgate. AP. Dam (VirusBuster) - Win32:
LovGate-CY [Wrm] (AVAST) - Backdoor.
Win32. SdBot (Ikarus) - Worm/Generic_r.
Z (AVG) - NseCheckFile2() returned 0x00010018 (Norman)
- I-Worm.
Lovgate. AP. Dam (VirusBusterBeta)
© 1997-2012 Kaspersky Lab ZAO. All Rights Reserved.
Industry-leading Antivirus Software.
Registered trademarks and service marks are the property of their respective owners.