LovGate Worm Spreading

The W32/LovGate.C worm, a variant of last week's Lovgate, is a mass-mailer that has its own SMTP engine to spread via e-mail and also can spread via network shares. When it infects a system, it may try to reply to e-mails that it finds in the victim's in-box, according to MessageLabs, a provider of managed e-mail filtering services.

The worm has a backdoor component that can allow a system to be controlled remotely, antivirus vendors said.

MessageLabs said LovGate.C can arrive as an e-mail with various subject names since they reply to existing e-mails. The text may include, "I'll try to reply as soon as possible. Take a look to the attachment and send me your opinion."

The worm has spread in 18 countries, including the United States, United Kingdom, South Africa and China, MessageLabs said.

McAfee, a division of Network Associates, rated the worm as medium-on-watch. Symantec rated it as a moderate threat.