VIRUS ADVISORY - W32/Lovgate.ab@MM

[ZWarrior]

------------------------------------------------------------
     ** VIRUS ADVISORY - W32/Lovgate.ab@MM **
------------------------------------------------------------

W32/Lovgate.ab@MM is a Medium Risk mass-mailing worm inside an email attachment that when
run:

1. Drops a dangerous backdoor on an infected machine that can allow a remote hacker to steal information.
2. Infects executable programs.
3. Tries to disable anti-virus and security software.
4. Emails itself to a) stolen contacts or b) as replies to unread MS Outlook or Outlook Express messages on the infected machine, spoofing the "from: field".

Note: McAfee VirusScan proactively detects and blocks W32/Lovgate.ab@MM's backdoor component (BackDoor-AQJ).

------------------------------------------------------------
WHAT TO LOOK FOR:

FROM: Varies (forged addresses taken from infected system).

SUBJECT: Re: (original subject)

BODY: Varies.

ATTACHMENT: The worm may be attached with one of the following file extensions:
 
-EXE
-SCR
-PIF
-CMD
-BAT

When replying to unread Outlook or Outlook Express messages, the worm may be attached with a variety of filenames. Examples:

-the hardcore game-.pif
-Sex in Office.rm.scr
-Deutsch BloodPatch!.exe
------------------------------------------------------------  

Up-to-date McAfee VirusScan users with DAT 4361 are protected from this threat.
 
Learn More about W32/Lovgate.ab@MM:
==> http://us.mcafee.com/root/campaign.asp?cid=10244
 
Scan for W32/Lovgate.ab@MM:
==> http://us.mcafee.com/root/campaign.asp?cid=10245

[Edited on 5-19-2004 by ZWarrior]