Weekly Virus Report - Lovgate, Tang and Kingpdt Worms, Nzlog and Aileen Trojans
Posted on 21.02.2003
Bookmark and Share
Three worms -Lovgate.A, W32/Tang and Kingpdt- and two Trojans -Nzlog and Aileen- are the subjects of this week's report on malicious code.

Lovgate.A is a worm that spreads across local networks and via e-mail, and is also programmed to act as a backdoor Trojan. The actions carried out by this virus include the following:

- It creates a large number of copies of itself in shared network directories and subdirectories. These files will be accessible from the other computers in the same local network as the computer infected by Lovgate.A. If a file is run on one of these computers, it will also be infected by the Trojan.

- It opens a TCP communications port (usually 10168), leaving the computer vulnerable to remote attacks.

Today's second worm is W32/Tang, which is not only transmitted via e-mail, IRC Mirc, Pirch and Virc, but also uses the most popular file-sharing applications, such as Kazaa, BearShare, Edonkey and Morpheus to spread. This virus looks for files with the following extensions scr, pif, mp3, mp2, gif, bmp, dib, png, jpg, jpeg, jpe, tif, tiff, mpg, mpeg, mpe, avi, mov, tmp, txt, lnk, bat, mdb, ppt and pps, in the default shared directories of these applications. If it finds them, it replaces them with a copy of itself.

W32/Tang also infects Excel workbooks, Word's global template and Access files.

Like the worm mentioned above, Kingpdt also spreads rapidly via e-mail, IRC chat channels and peer-to-peer file-sharing programs, such as Kazaa, Edonkey and Morpheus. If it finds files with the following extensions on the affected computer, it overwrites them with its code: mp3, mp2, mpg, mpeg, mpe, avi, mov, dir, jpg, jpeg, png, gif, png, tif, tiff, pic, art and url.

The first Trojan we're looking at today is Nzlog, which goes memory resident and captures the keystrokes entered by the user of the affected computer. It logs this information, which can include the user name and password, in a file called NZLOG.TXT that this virus creates in the directory C:\Program Files.

We are going to finish today's report with Aileen. This Trojan goes memory resident and opens and closes the CD_ROM tray. When it is run, it sometimes creates a file called WINCOPY.EXE in the Windows system directory. Similarly, it creates a key in the Windows Registry in order to ensure that it is run every time the affected computer is started up.

For further information about these and other viruses, visit Panda Software's Virus Encyclopedia at: http://www.pandasoftware.com/virus_info/





Spotlight

Attackers use reflection techniques for larger DDoS attacks

Posted on 17 April 2014.  |  Instead of using a network of zombie computers, newer DDoS toolkits abuse Internet protocols that are available on open or vulnerable servers and devices. This approach can lead to the Internet becoming a ready-to-use botnet for malicious actors.


Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.
  



Daily digest

Receive a daily digest of the latest security news.
  

DON'T
MISS

Fri, Apr 18th
    COPYRIGHT 1998-2014 BY HELP NET SECURITY.   // READ OUR PRIVACY POLICY // ABOUT US // ADVERTISE //