Signature Detail

WORM: Lovgate.P File Propagation Over SMB/CIFS

This signature detects the P variant of the LovGate worm copying itself from one network share to another. Because these attempts indicate that the source host is infected and attempting to spread to open network shares on other hosts, you should take the appropriate security actions immediately.

Extended Description

WORM_LOVGATE.P is a worm with backdoor capabilities.

References

• URL: http://vil.nai.com/vil/content/v_101104.htm
• URL: http://www.sophos.com/virusinfo/analyses/w32lovgatep.html
• URL: http://secunia.com/virus_information/8295/lovgate.p/