A new mass-mailing worm, W32.HLLW.Lovegate.C@mm, a variant of the W32.HLLW.Lovegate@mm, is categorised with a high level warning. It has spread very fast and, according to security specialist AveS Cyber Security, is also a nuisance to remove once it has found its way onto a network.
AVeS Cyber Security has received confirmed reports of the latest W32.HLLW.Lovegate.C@mm worm being detected on local intranets.
The virus is also spread via network shares and has back-door trojan capability. The Lovegate worm attempts to copy itself to all the computers on a local network, and then infect these computers. By default, the trojan component listens on port 10168 and if the infected computer is running Windows NT, 2000, or XP, the worm will attempt to disguise itself as the normal Windows process, "LSASS.EXE".
Johan Botha, software engineer at AVeS Cyber Security, says: "Three strains of this worm have been released in the last week. Both the W32.HLLW.Lovegate @mm and W32.HLLW.Lovegate.B @mm worms were discovered on 19 February and are very similar in functionality. The W32.HLLW.Lovegate.C @mm was discovered on 24 February and has similar functionality to its predecessors, but with an added twist or two. All three of these strains are reported as highly distributed."
Both McAfee and Symantec have released new virus definitions to detect this new strain of the worm. Symantec has released a standalone fix/removal tool for this worm, which is downloadable from www.sarc.com.
For more information and advice, contact AVeS Cyber Security at (011) 234 0630.
Share
