W32/Lovgate.J Worm

 Information about the W32/Lovgate.J worm:

W32/Lovgate.J is an email worm. It is a variant of W32/Lovgate worm. This worm also has the backdoor characteristics. This worm will infect Windows systems. The worm spreads through email, shared network drives and email address present in files with extension starts with .ht. 

The worm arrives with a random subject. The subject is a combination of words randomly chosen by the worm.

The content of the mail is a combination of the messages randomly chosen by the worm.

The names of the infected attachments of the worm are randomly generated from the words contained in a list of its own. It tries to spread by replying to the unread messages in the Microsoft Outlook and Outlook Express. It removes the traces of the mail after replying.

When the worm is executed, it copies itself to the SYSTEM folder of Windows as iexplore.exe, Kernel66.dll, Ravmond.exe, WinDriver.exe, winexe.exe, WinGate.exe, Winhelp.exe and Winrpc.exe . It modifies the registry at the following location to load itself during the next startup.

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

It also tries to copy Backdoor component of the worm to the Windows System folder and executes it.

ily668.dll
Reg678.dll
Task688.dll
Win32vxd.dll

The Backdoor component of the worm will allow the remote user to access the infected computer. This will try to login as Administrator to the computers in the local network using the set of passwords in its list, which allows the remote user to access the infected computer. It uses port 10168 to achieve the same.

The worm tries to copy itself to shared folders on network any of the following names;

100 free essays school.pif
Age of empires 2 crack.exe
AN-YOU-SUCK-IT.txt.pif
Are you looking for Love.doc.exe
autoexec.bat
CloneCD + crack.exe
How To Hack Websites.exe
Mafia Trainer!!!.exe
MoviezChannelsInstaler.exe
MSN Password Hacker and Stealer.exe
Panda Titanium Crack.zip.exe
Sex_For_You_Life.JPG.pif
SIMS FullDownloader.zip.exe
Star Wars II Movie Full Downloader.exe
The world of lovers.txt.exe
Winrar + crack.exe

It infects all files with .exe extension in the local hard drive as well as in the network shared drive and it also tries to terminate few antivirus software.

This worm first appeared on 13th May 2003.

 Other names of W32/Lovgate.J worm:

This worm is also known as W32.HLLW.Lovgate.I@mm, W32/Lovgate-J ,WORM_LOVGATE.J