The Lovgate worm isn't as destructive as other worms, but it can still cause users frustration. This worm doesn't delete user's files (ex: word & excel documents). Instead it replaces executable files on the local hard drive with copies of itself. Eventually the user won't be able to run any of his/her applications.
The latest variant of the Lovgate worm scans PCs for executable files and then renames them, a tactic used by viruses from a much older generation, according to antivirus companies.
The Lovgate worm first appeared in February 2003 and has since mutated many times. The most recent versions of the worm--Lovgate.AE and Lovgate.AH--were discovered on Sunday. They spread by e-mailing themselves to addresses found on an infected machine and then open a "back door" to give control of the infected system to an attacker. Finally, the worms scan for vulnerable PCs connected to the infected system's local network--using the same Windows vulnerability exploited by the MSBlast worm almost a year ago.
The most important difference is the worm's destructive nature. Although the latest Lovgate worm does not delete any user data--such as documents or spreadsheets--it replaces executable files (with the .exe extension) on the local hard drive with further copies of itself. This process can leave an infected computer effectively useless because it is unable to run any applications. Carole Theriault, security consultant at antivirus firm Sophos, said the latest Lovgates are "ancient-style viruses" because they are so destructive.
News source: C|Net News.com
-1 Comments - Add comment