Panda Software Reports the Appearance of Three New Worms
Posted on 26.02.2003
Three worms -Lovgate.A, W32/Tang and Kingpdt- and two Trojans -Nzlog and Aileen- are the subjects of this week's report on malicious code.

Lovgate.A is a worm that spreads across local networks and via e-mail, and is also programmed to act as a backdoor Trojan. The actions carried out by this virus include the following:

- It creates a large number of copies of itself in shared network directories and subdirectories. These files will be accessible from the other computers in the same local network as the computer infected by Lovgate.A. If a file is run on one of these computers, it will also be infected by the Trojan.

- It opens a TCP communications port (usually 10168), leaving the computer vulnerable to remote attacks.

The second worm is W32/Tang, which is not only transmitted via e-mail, IRC Mirc, Pirch and Virc, but also uses the most popular file-sharing applications, such as Kazaa, BearShare, Edonkey and Morpheus to spread. This virus looks for files with the following extensions: scr, pif, mp3, mp2, gif, bmp, dib, png, jpg, jpeg, jpe, tif, tiff, mpg, mpeg, mpe, avi, mov, tmp, txt, lnk, bat, mdb, ppt and pps, in the default shared directories of these applications. If it finds them, it replaces them with a copy of itself.

W32/Tang also infects Excel workbooks, Word's global template and Access files.

Like the worm mentioned above, Kingpdt also spreads rapidly via e-mail, IRC chat channels and peer-to-peer file-sharing programs, such as Kazaa, Edonkey and Morpheus. If it finds files with the following extensions on the affected computer, it overwrites them with its code: mp3, mp2, mpg, mpeg, mpe, avi, mov, dir, jpg, jpeg, png, gif, png, tif, tiff, pic, art and url.

The first Trojan we're looking at today is Nzlog, which goes memory resident and captures the keystrokes entered by the user of the affected computer. It logs this information, which can include the user name and password, in a file called NZLOG.TXT that this virus creates in the directory C:\Program Files.

Finally, Aileen. This Trojan goes memory resident and opens and closes the CD_ROM tray. When it is run, it sometimes creates a file called WINCOPY.EXE in the Windows system directory. Similarly, it creates a key in the Windows Registry in order to ensure that it is run every time the affected computer is started up.

For further information about these and other viruses, visit Panda Software's Virus Encyclopedia at:


eBook: Cybersecurity for Dummies

Posted on 16 December 2014.  |  APTs have changed the world of enterprise security and how networks and organizations are attacked. These threats, and the cybercriminals behind them, are experts at remaining hidden from traditional security while exhibiting an intelligence, resiliency, and patience that has never been seen before.

Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.

Daily digest

Receive a daily digest of the latest security news.

Thu, Dec 18th