Lovgate Worm Comes Back to Life
A new variant of the Lovgate worm has been discovered infecting PCs globally, according to security bulletins by major security firms including Symantec and McAfee.
First discovered in February 2003, the Lovgate worm spreads by e-mailing itself to addresses found on infected PCs. Once inside a machine, the worm opens a "back door" to allow an attacker inside. In addition, Lovgate scans PCs for executables and replaces them with further copies of itself.
Considered a medium risk by both Symantec and McAfee, the new Lovgate variants--Lovgate.AE and Lovgate.AH--target Microsoft's Windows applications and will disable antivirus software and security applications on an infected system.
"What this worm does ... is it responds automatically to e-mail sent and attaches itself in the reply," explains Jeffrey Posluns, chief innovation officer at Toronto-based IT security provider WhiteHat. "It is a much more likely mechanism to have the recipient of the e-mail open the attachment. The inherent paranoia usually related to attachments is diminished because it is a reply to an e-mail sent."
