Old-school worm loves Windows applications

The latest variant of the Lovgate worm scans PCs for executable files and then renames them, a tactic used by viruses from a much older generation, according to antivirus companies. The Lovgate worm first appeared in February 2003 and has since mutated many times. The most recent versions of the worm--Lovgate.AE and Lovgate.AH--were discovered on Sunday. They spread by e-mailing themselves to addresses found on an infected machine and then open a "back door" to give control of the infected system to an attacker. Finally, the worms scan for vulnerable PCs connected to the infected system's local network--using the same Windows vulnerability exploited by the MSBlast worm almost a year ago.

The most important difference is the worm's destructive nature. Although the latest Lovgate worm does not delete any user data--such as documents or spreadsheets--it replaces executable files (with the .exe extension) on the local hard drive with further copies of itself. This process can leave an infected computer effectively useless because it is unable to run any applications.

Read Full Story