Signature Detail

WORM: Lovegate Infected Host

This signature detects attempts to send e-mails messages to 54love@fescomail.net or hacker117@163.com. Attempted messages to these addresses indicate that the host is infected by the Lovegate Worm. An attacker can use the information from these messages to access the host and perform malicious actions.

Extended Description

Lovegate infects Microsoft Windows operating systems and propagates through e-mail attachments and shared folders. It also creates backdoors that allow attackers to control the affected host remotely. Once a system is successfully infected, it attempts to send e-mail notification of infection to a pair of email addresses.

References

• URL: http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM_LOVGATE.C
• URL: http://www.srnmicro.com/virusinfo/lovegatec.htm