Three worms -Lovgate.A, W32/Tang and Kingpdt- and two Trojans -Nzlog and Aileen- are the subjects of this week’s report on malicious code. Lovgate.A is a worm that spreads across local networks and via e-mail, and is also programmed to act as a backdoor Trojan. The actions carried out by this virus include the following:

– It creates a large number of copies of itself in shared network directories and subdirectories. These files will be accessible from the other computers in the same local network as the computer infected by Lovgate.A. If a file is run on one of these computers, it will also be infected by the Trojan.

– It opens a TCP communications port (usually 10168), leaving the computer vulnerable to remote attacks. The second worm is W32/Tang, which is not only transmitted via e-mail, IRC Mirc, Pirch and Virc, but also uses the most popular file-sharing applications, such as Kazaa, BearShare, Edonkey and Morpheus to spread. This virus looks for files with the following extensions: scr, pif, mp3, mp2, gif, bmp, dib, png, jpg, jpeg, jpe, tif, tiff, mpg, mpeg, mpe, avi, mov, tmp, txt, lnk, bat, mdb, ppt and pps, in the default shared directories of these applications. If it finds them, it replaces them with a copy of itself. Full Story