Worm Becomes Part Of The Windows OS

BitDefender, an award-winning provider of security software and services, today released a free removal tool against the worm LovGate (its last version is Win32.LovGate.C@mm), which has widely spread in the wild in the last four days. The novelty brought by this worm is that it integrates in the Windows OS, becoming a part of the operating system process.

The worm author had access to an undocumented function of one of the Microsoft Windows operating system, so he was able to break into the “lsass” process and identified itself with this system process. “The virus is the more treacherous as it cannot be blocked until the process “lsass” is stopped, or the process’ stopping could mean also damaging the operating system”, stated Mihai Chiriac, Virus Researcher at BitDefender.

The worm comes by e-mail, without exploiting the famous I-Frame vulnerability, but bringing to table a series of well-defined, social engineering structures. “It’s all about sex, cracked software or human curiosity” says Mihai Chiriac. “Today’s software philosophy very much requires people’s trust and confidence. When patching, “pack-installing” and testing becomes a rule, no one should wonder why clicking on such attachments is so frequent”, Mihai added.