Lovgate.B is mass mailing and network worm which also has a backdoor component. Apart form the mass mailing functionality this worm can spread through windows shares and steal users' passwords. It also has backdoor capabilities listening in the port 10168, allowing the attacker to perform different actions on the infected machine.
A False Positive is when a file is incorrectly detected as harmful, usually because its code or behavior resembles known harmful programs. A False Positive will usually be fixed in a subsequent database update without any action needed on your part. If you wish, you may also:
Check for the latest database updates
First check if your F-Secure security program is using the latest updates, then try scanning the file again.
Submit a sample
After checking, if you still believe the file is incorrectly detected, you can submit a sample of it for re-analysis.
Note: If the file was moved to quarantine, you need to collect the file from quarantine before you can submit it.
Exclude a file from further scanning
If you are certain that the file is safe and want to continue using it, you can exclude it from further scanning by the F-Secure security product.
Note: You need administrative rights to change the settings.
In all variants A, B and C, a dropped DLL sets another copy of thebackdoor on port 1192.
The worm's executable is packed with ASPack
F-Secure received reports about a new Lovgate variant known as Lovgate.N from Germany. F-Secure Anti-Virus detects this worm variant with the following updates: 2003-09-23_02
Three new Lovgate variants known as Lovgate.I, Lovgate.J and Lovgate.K have been found on May 13th, 2003. These are similar to old Lovgate variants, but in addition, they infect executable files. For more information see the bottom of the description.
F-Secure is upgrading Lovgate.F to level 2 because of the increased number of infections. Lovgate.F is an email and network worm with backdoor capabilities. It attempts to gain remote access using a longer list of passwords than previous variants.
A new variant of Lovgate worm, Lovgate.G has been found on 25th of March 2003. For more information see the bottom of the description.
A new variant of Lovgate worm, Lovgate.F has been found on 24th of March 2003. For more information see the bottom of the description.
A new variant of Lovgate worm, Lovgate.C has been found on 24th of February 2003. For more information see the bottom of the description.
Lovgate sends the private information to the following addresses:
The worm has its own SMTP engine and connects to the host smtp.163.com to deliver its messages. The domain 163.com seems to be a Chinese web portal.
Lovgate copies itself to shares and shares' sub-folders with names such as:
It tries the following usernames and passwords if the shares are password protected:
Usernames:
Passwords:
If it gains access, it will copy itself to file named "stg.exe" in the "System32" Windows folder and it will attempt to run it.
It has key-logging capabilities and stores information it gathers in the following files:
Lovgate.B copies itself in the Windows' system folder with the following filenames:
It creates different entries in different configuration files and windows register to run those copies:
For the registry key
it creates the following subkeys:
Where '%winsysdir%' stands for Windows' system directory.
It also sets the registry key
so the worm will execute each time the user double click on a text file. When run it also launches Notepad, so nothing can be noticed unless the default editor for text files was other than Notepad.
It sets the following entry under the 'Windows' section in the win.ini file:
Lovgate.B drops the same DLL under the following names:
This variant also drops the keylogger DLL as:
Among other things, those DLL's will be in charge of the keylogging process and sending data back to the worm's creator.
The worm sends email in two different ways. When it runs it launches a thread that will send replies to messages found from inbox using the MAPI Windows functions. The reply message will have the following body:
And, it searches for *.ht* files and sends messages to the addresses found inside. The message will be composed from the data in the following list:
Possible filenames of the email attachment are:
Possible subjects are:
Possible bodies are:
Lovgate.B is detected by F-Secure Anti-Virus with database: 2003-02-20_01
Variant: Lovgate.A
The main difference of A variant is the lack of the automatic reply to messages found from the inbox. Without that, its spreading depends on availability of writable network shares and *.ht* files where to find email addresses. Apart from that, most of its functionality is analogous to that of the other known variants.
Variant: Lovgate.C
Lovgate.C appears to have fixed some previous problems with the email spreading capabilities of the worm. It keeps the backdoor component running in the same port 10168. The B variant did drop 2 different DLLs, while this one only drops one (as A variant does). It has apparently removed the keylogging component present in B variant.
There are no major differences, it uses the same filenames when copying itself into the computer. Lovgate.C is detected by F-Secure Anti-Virus with database: 2003-02-24_02
Variant:Lovgate.D
This variant is more primitive than the previous. When infecting network shares, it doesn't try to guess passwords. And as the A variant, it only sends email to addresses it finds from *.ht* files on the infected computer. Lovgate.D is detected by F-Secure Anti-Virus with database: 2003-02-24_04
Variant:Lovgate.F
This variant is an improved version. It contains a longer list of passwords to try when attempting to gain access to shared resources:
It maintains the same basic functionality than previous versions, using the same SMTP server to send email to its author, as well as using the default Windows mail configuration.
It drops several DLLs into the system using different names than the previous variants.
It uses the following filenames when sending email through MAPI.
It uses the following filenames when copying itself to shared resources:
Lovgate.F is detected by F-Secure Anti-Virus with database: 2003-03-24_03
Variant:Lovgate.G
This variant is functionally identical to Lovgate.F. Lovgate.G is detected by F-Secure Anti-Virus with database: 2003-03-24_03
Variant: Lovgate.I, Lovgate.J, Lovgate.K & Lovgate.L
These new versions keep most of the functionality of the older ones, with several additions. In this versions, the infecting component s active, such component was present in the F variant but wasn't never activated.
The filenames used when spreading through shares, as well as password list, are identical as the ones included in the F variant.
It drops components under the following paths:
and the infecting part of the Logvate worm, which was not dropped by previous variants is dropped in:
Where '%winsysdir%' stands for Windows' system directory and '%windowsdir%' stands for Windows' directory.
The worm creates the following entries in the registry key
it creates the following subkeys:
"WinGate initialize" = "%winsysdir%\WinGate.exe -remoteshell""Remote Procedure Call Locator" = "rundll32.exe reg678.dll ondll_reg"
and under:
adds an entry for the component in charge of infecting other files as:
It also sets the registry key
so the worm will execute each time the user runs an executable file. This variants tries to terminate several Anti-Virus processes if found running in the system.
Detection of Lovgate.I, Lovgate.J and Lovgate.K was published in update: 2003-05-13_03
Detection of Lovgate.L was published in update: 2003-05-14_01
Variant: Lovgate.M
This variant retains the funtionality of the prevoius ones. The only changes lie in the mail composition, where messages are composed from the following elements:
Subjects are chosen from:
And message bodies from:
Attachment names from:
The list of passwords, message components (subjects, bodies) and filenames used when spreading through shares are all as in Lovgate.M.
Detection of Lovgate.M was published in update: 2003-06-18_03