Alias:I-Worm.Supnot.a, Supnot.A
Type:Worm 
Size:84,992 Bytes 
Origin: 
Date:00-00-0000 
Damage:Sent by email. Backdoor Component.  
VDF Version:6.23.00.00 
Danger:Medium 
Distribution:High 

DistributionThe worm uses its own SMTP engine and sends itself to all email addresses it can find on the infected computer.
The backdoor component of Worm/Lovegate saves keylogging information and passwords in the following files:
win32pwd.sys
win32add.sys
and sends these information to the email addresses:
'hello_dll@163.com'
'hacker117@163.com'.

The infectious email sent by the worm looks like this:

Subject:
Documents
Roms
Pr0n!
Evaluation copy
Help
Beta
Do not release
Last Update
The patch
Cracks!

Body:
I'll try to reply as soon as possible.
Take a look to the attachment and send me your opinion!
Send me your comments...
Test this ROM! IT ROCKS!.
Adult content!!! Use with parental advisory.
Test it 30 days for free.
I'm going crazy... please try to find the bug!.
Send reply if you want to be official beta tester.
This is the pack ;)
This is the last cumulative update.
I think all will work fine.
Check our list and mail your requests!

Attachment:
Docs.exe
Roms.exe
Sex.exe
Setup.exe
Source.exe
_SetupB.exe
Pack.exe
LUPdate.exe
Patch.exe
CrkList.exe

Technical DetailsApart from its massmailer function, this worm can spread through Windows components and it steals passwords.
Lovgate copies itself in files named:
fun.exe
humor.exe
docs.exe
s3msong.exe
midsong.exe
billgt.exe
Card.EXE
SETUP.EXE
searchURL.exe
tamagotxi.exe
hamster.exe
news_doc.exe
PsPGame.exe
joke.exe
images.exe
pics.exe

It tests the following user names and passwords, if the netresource is protected:

User name:
guest
Administrator

Password:
"" (empty password)
"guest"
"123"
"321"
"123456"
"654321"
"administrator"
"admin"
"111111"
"666666"
"888888"
"abc"
"abcdef"
"abcdefg"
"12345678"
"abc123"

The worm copies itself in Windows system directory, with the following names:
C:\%WinDIR%\%SystemDIR%\WinGate.exe
C:\%WinDIR%\%SystemDIR%\WinRpcsrc.exe
C:\%WinDIR%\%SystemDIR%\SysHelp.exe
C:\%WinDIR%\%SystemDIR%\WinPrc.exe
C:\%WinDIR%\%SystemDIR%\RpcSrv.exe

and makes the following .dll files in Windows System:
C:\%WinDIR%\%SystemDIR%\1.DLL
C:\%WinDIR%\%SystemDIR%\ily.dll
C:\%WinDIR%\%SystemDIR%\reg.dll
C:\%WinDIR%\%SystemDIR%\Task.dll
C:\%WinDIR%\%SystemDIR%\win32vxd.dll

Worm/Lovegate makes the registry entries: [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]"syshelp"="C:\\WINDOWS\\SYSTEM\\syshelp.exe""WinGate initialize"="C:\\WINDOWS\\SYSTEM\\WinGate.exe -remoteshell""Module Call initialize"="RUNDLL32.EXE reg.dll ondll_reg [HKEY_CLASSES_ROOT\txtfile\shell\open\command]@="winrpc.exe %1"
Die Beschreibung wurde erstellt von Crony Walker am Dienstag, 15. Juni 2004

zurück . . . .