Weekly Virus Report – Lovgate, Tang and Kingpdt Worms, Nzlog and Aileen Trojans
Three worms -Lovgate.A, W32/Tang and Kingpdt- and two Trojans -Nzlog and Aileen- are the subjects of this week’s report on malicious code.
Lovgate.A is a worm that spreads across local networks and via e-mail, and is also programmed to act as a backdoor Trojan. The actions carried out by this virus include the following:
– It creates a large number of copies of itself in shared network directories and subdirectories. These files will be accessible from the other computers in the same local network as the computer infected by Lovgate.A. If a file is run on one of these computers, it will also be infected by the Trojan.
– It opens a TCP communications port (usually 10168), leaving the computer vulnerable to remote attacks.
Today’s second worm is W32/Tang, which is not only transmitted via e-mail, IRC Mirc, Pirch and Virc, but also uses the most popular file-sharing applications, such as Kazaa, BearShare, Edonkey and Morpheus to spread. This virus looks for files with the following extensions scr, pif, mp3, mp2, gif, bmp, dib, png, jpg, jpeg, jpe, tif, tiff, mpg, mpeg, mpe, avi, mov, tmp, txt, lnk, bat, mdb, ppt and pps, in the default shared directories of these applications. If it finds them, it replaces them with a copy of itself.
W32/Tang also infects Excel workbooks, Word’s global template and Access files.
Like the worm mentioned above, Kingpdt also spreads rapidly via e-mail, IRC chat channels and peer-to-peer file-sharing programs, such as Kazaa, Edonkey and Morpheus. If it finds files with the following extensions on the affected computer, it overwrites them with its code: mp3, mp2, mpg, mpeg, mpe, avi, mov, dir, jpg, jpeg, png, gif, png, tif, tiff, pic, art and url.
The first Trojan we’re looking at today is Nzlog, which goes memory resident and captures the keystrokes entered by the user of the affected computer. It logs this information, which can include the user name and password, in a file called NZLOG.TXT that this virus creates in the directory C:\Program Files.
We are going to finish today’s report with Aileen. This Trojan goes memory resident and opens and closes the CD_ROM tray. When it is run, it sometimes creates a file called WINCOPY.EXE in the Windows system directory. Similarly, it creates a key in the Windows Registry in order to ensure that it is run every time the affected computer is started up.
For further information about these and other viruses, visit Panda Software’s Virus Encyclopedia at: http://www.pandasoftware.com/virus_info/