Two new variants of the Lovgate worm were reported Wednesday by security companies.

W32/Lovgate-D is a worm and backdoor Trojan that spreads across the local network by copying itself into shared folders using a variety of filenames. W32/Lovgate-D also attempts to spread via email by sending itself to email addresses collected from *.ht* files.

For more information on the description of the emails, visit this Sophos Web page.

Panda Software is giving a low risk rating to the Lovgate.E worm that spreads across local networks and via e-mail. Lovgate.E also acts as a backdoor Trojan, opening a TCP port. By doing this, it leaves the affected computer vulnerable to possible attacks.

Lovgate.E also sends an e-mail message to the virus author containing confidential information on the affected computer, including the machine name, user name and IP address. And the worm creates a large number of copies of itself in the shared network drives that it manages to access. It also sends out a large number of e-mail messages to the contacts it finds in the Inbox and to the e-mail addresses it finds in a series of directories.

For more on Lovgate.E, visit this Panda Software Web page.

Two Backdoor Trojans Giving Hackers Unauthorized Access

Symantec is reporting the appearance of two backdoor Trojans. Backdoor.Redkod gives a hacker full control over a Windows NT/2000/XP computer. By default the backdoor listens on port 58666.

Technical details can be found here.

The other backdoor Trojan is Backdoor.Zdown, which gives a hacker unauthorized access to a computer. This backdoor also attempts to disable various antivirus and firewall programs by terminating active processes. Because a Trojan generator produced Backdoor.Zdown, its features are preprogrammed. More on Backdoor.Zdown can be found here.

Worm_FRETHEM.M a Low Risk

This nondestructive, memory-resident variant of Worm_FRETHEM.D arrives as an attachment to an email. On vulnerable systems, the file attachments automatically open when the worm email is previewed or opened in Microsoft Outlook or Outlook Express.

Read the details of the email and removal instructions here.

Compiled by Esther Shein.