W32.Lovgate - s3msong.MP3.pif (GHIJKNOXYZAbAcAdAkAnAo)

tasklist.org		A comprehensive list of processes running in your computer
		tasklist \| attachlist

bookmark this website!		total tasks: 16297

AttachList is a list of email attachment files that viruses usually send in email. It contains the attached file names, typical subjects and messages, the name of the viruses that send them, and instruction on how to remove these viruses.

most requested

Browse attachlist by file name:

| a | b | c | d | e | f | g | h | i | j | k | l | m | n | o | p | q | r | s | t | u | v | w | x | y | z |

Name: W32.Lovgate

Sender:

(sender)@(domain.com) (Ao and others)
may be spoofed

Subject:

(blank) (Ao)
Attached one Gift for u.. (GHIJK)
Beta (CDEF)
Cracks! (CDEF)
Delivery Status Notification (Delay) (Ao)
Documents (CDEF)
Do not release (CDEF)
Error (NRWYZAbAcAdAkAo)
Evaluation copy (CDEF)
for you (GHIJK)
Great (GHIJK)
hello (NRWYZAbAcAdAk)
Help (CDEF)
hi (NRWYZAbAcAdAkAo)
Hi Dear (GHIJK)
I'm going craZAbAcy... please try to find the bug! (CDEF)
Last Update (CDEFGHIJK)
Let's Laugh (GHIJK)
Mail Delivery System (NRWYZAbAcAdAk)
Mail Transaction Failed (NRWYZAbAcAdAkAo)
Pr0n! (CDEF)
Re: (subject) (AdAnAo)
Reply to this! (GHIJK)
Roms (CDEF)
See the attachement(GHIJK)
Server Report (NRWYZAbAcAdAk)
Status (NRWYZAbAcAdAk)
Subject (AnAo)
test (NRWYZAbAcAdAkAo)
The patch (CDEF)

Message:

Adult content!!! Use with parental advisory. (CDEFGHIJK)
Check our list and mail your requests! (CDEF)
Copy of your message, including all the headers is attached. (GHIJK)
Delivery to the following recipient has failed: (Ao)
For further assistance, please contact! (GHIJK)
If you can keep your head when all AbAcout youAre losing theirs and
blaming it on you;If you can trust yourself when all men doubt
you,But make allowance for their doubting too;If you can wait and not
be tired by waiting,Or, being lied AbAcout,don't deal in lies,Or,
being hated, don't give way to hating,And yet don't look too good,
nor talk too wise;.. ... more look to the attachment. (NOXYZAbAcAk)
(original message body)(domain name) auto-reply:If you can keep your
head when all AbAcout youAre losing theirs and blaming it on you;If
you can trust yourself when all men doubt you,But make allowance for
their doubting too;If you can wait and not be tired by waiting,Or,
being lied AbAcout,don't deal in lies,Or, being hated, don't give way
to hating,And yet don't look too good, nor talk too wise;... ... more
look to the attachment.  (Ad)
I think all will work fine. (CDEF)
It's the long-awaited film version of the Broadway hit. Set in the
roaring 20's, this is thestory of Chicago chorus girl Roxie Hart
(ZAbAcellweger), who shoots her unfaithful lover
(West).(GHIJKRYZAbAcAk)
It's the long-awaited film version of the Broadway hit. The message
sent as a binaryattachment. (NWAdAo)
Mail failed. For further assistance, please contact!
(NRWYZAbAcAdAkAo)
pass (WYAk)
Patrick Ewing will give Knick fans something to cheer AbAcout Friday
night. (GHIJK)
Send me your comments... (CDEFGHIJK)
Send reply if you want to be official beta tester. (CDEFGHIJK)
'(sender)' wrote:====> (original message body)====(domain.com>
account auto-reply:... ... more details,look to the attachment.> Get
your FREE (domain.com) account now! < (AnAo)
Test it 30 days for free. (CDEF)
Test this ROM! IT ROCKS!. (CDEF)
The message contains Unicode characters and has been sent as a
binaryattachment. (NRWYZAbAcAdAkAo)
THIS IS A WARNING MESSAGE ONLY. (Ao)
This is an automatically generated Delivery Status Notification (Ao)
This is the last cumulative update. (CDEFGHIJK)
This is the pack ;) (CDEF)
This message was created automatically by mail delivery software
(Exim). (GHIJK)
Tiger Woods had two eagles Friday during his victory over Stephen
Leaney. (AP Photo/Denis Poroy) (GHIJK)
YOU DO NOT NEED TO RESEND YOUR MESSAGE. (Ao)

Attachment:

(random).bat (Ao)
(random).cmd (Ao)
(random).com (Ao)
(random).exe (Ao)
(random).pif (Ao)
(random).scr (Ao)
(random).zip (Ao)
_SetupB.exe (CDEF)
About_Me.txt.pif (GHIJK)
billgt.exe (BE)
Body.bat (Ao)
body.bat (NWYZAbAcAk)
Body.cmd (Ao)
body.cmd (NWYZAbAcAk)
Body.com (Ao)
Body.exe (Ao)
body.exe (NWYZAbAcAk)
Body.pif (Ao)
body.pif (NWYZAbAcAk)
Body.scr (Ao)
body.scr (NWYZAbAc)
Body.zip (Ao)
Britney spears nude.exe.txt.exe (GHIJKNOXYZAbAcAdAk)
Butterfly Garden.scr (AnAo)
card.exe (BE)
CrkList.exe (CDEF)
data.bat (Ao)
data.bat (NWYZAbAcAk)
data.cmd (Ao)
data.cmd (NWYZAbAcAk)
data.com (Ao)
data.exe (Ao)
data.exe (NWYZAbAcAk)
data.pif (Ao)
data.pif (NWYZAbAcAk)
data.scr (Ao)
data.scr (NWYZAbAcAk)
data.zip (Ao)
Deutsch BloodPatch!.exe (GHIJKNOXYZAbAcAdAk)
Doc.bat (Ao)
doc.bat (NWYZAbAcAk)
Doc.cmd (Ao)
doc.cmd (NWYZAbAcAk)
Doc.com (Ao)
Doc.exe (Ao)
doc.exe (NWYZAbAcAk)
Doc.pif (Ao)
doc.pif (NWYZAbAcAk)
Doc.scr (Ao)
doc.scr (NWYZAbAcAk)
Doc.zip (Ao)
docs.exe (BE)
Docs.exe (CDEF)
Document.bat (Ao)
document.bat (NWYZAbAcAk)
Document.cmd (Ao)
document.cmd (NWYZAbAcAk)
Document.com (Ao)
Document.exe (Ao)
document.exe (NWYZAbAcAk)
Document.pif (Ao)
document.pif (NWYZAbAcAk)
Document.scr (Ao)
document.scr (NWYZAbAcAk)
Document.zip (Ao)
Doom3 Preview!!!.exe (GHIJK)
dreamweaver MX (crack).exe (GHIJKNOXYZAbAcAdAkAnAo)
driver.exe (GHIJK)
DSL Modem Uncapper.rar.exe (GHIJKNOXYZAbAcAdAk)
enjoy.exe (GHIJK)
File.bat (Ao)
file.bat (NWYZAbAcAk)
File.cmd (Ao)
file.cmd (NWYZAbAcAk)
File.com (Ao)
File.exe (Ao)
file.exe (NWYZAbAcAk)
File.pif (Ao)
file.pif (NWYZAbAcAk)
File.scr (Ao)
file.scr (NWYZAbAcAk)
File.zip (Ao)
FlashFXP.exe (AnAo)
fun.exe (BE)
hamster.exe (BE)
How to Crack all gameZAbAc.exe (GHIJKNOXYZAbAcAdAk)
humor.exe (BE)
HyperSnap-DX v5.rar.exe (AnAo)
I am For u.doc.exe (GHIJKNOXYZAbAcAdAk)
images.exe (BE)
images.pif (GHIJK)
Industry Giant II.exe (GHIJKNOXYZAbAcAdAkAnAo)
Interesting.exe (GHIJK)
joke.exe (BEAnAo)
joke.pif (GHIJKNOXYZAbAcAdAk)
LUPdate.exe (CDEF)
Macromedia Flash.scr (GHIJKNOXYZAbAcAdAkAnAo)
MacroMedia.pif (AnAo)
Matrix Reloaded 3D.exe (AnAo)
Me_nude.AVI.pif (GHIJKNOXYZAbAcAdAk)
Message.bat (Ao)
message.bat (NWYZAbAcAk)
Message.cmd (Ao)
message.cmd (NWYZAbAcAk)
Message.com (Ao)
Message.exe (Ao)
message.exe (NWYZAbAcAk)
Message.pif (Ao)
message.pif (NWYZAbAcAk)
Message.scr (Ao)
message.scr (NWYZAbAcAk)
Message.zip (Ao)
midsong.exe (BE)
MSN Messenger.exe (AnAo)
MyIE.AVI.pif (AnAo)
news_doc.exe (BE)
Pack.exe (CDEF)
Patch.exe (CDEF)
Photoshop.EXE (AnAo)
pics.exe (BE)
Pics.ZAbAcIP.scr(GHIJK)
pspgame.exe (BE)
Readme.bat (Ao)
readme.bat (NWYZAbAcAk)
Readme.cmd (Ao)
readme.cmd (NWYZAbAcAk)
Readme.com (Ao)
Readme.exe (Ao)
readme.exe (NWYZAbAcAk)
Readme.pif (Ao)
readme.pif (NWYZAbAcAk)
Readme.scr (Ao)
readme.scr (NWYZAbAcAk)
README.TXT.pif (GHIJK)
Readme.zip (Ao)
Roms.exe (CDEF)
s3msong.exe (BE)
s3msong.MP3.pif (GHIJKNOXYZAbAcAdAkAnAo)
searchurl.exe (BE)
setup.exe (BE)
Setup.exe (CDEF)
SETUP.EXE (GHIJKNOXYZAbAcAk)
Sex in Office.rm.scr (GHIJKNOXYZAbAcAdAk)
Sex.exe (CDEF)
Shakira.Zip.exe (GHIJKNOXYZAbAcAdAkAnAo)
Source.exe (CDEFGHIJK)
StarWars2 - CloneAttack.rm.scr (GHIJKNOXYZAbAcAdAkAnAo)
tamagotxi.exe (BE)
Test.bat (Ao)
test.bat (NWYZAbAcAk)
Test.cmd (Ao)
test.cmd (NWYZAbAcAk)
Test.com (Ao)
Test.exe (Ao)
test.exe (NWYZAbAcAk)
Test.pif (Ao)
test.pif (NWYZAbAcAk)
Test.scr (Ao)
test.scr (NWYZAbAcAk)
Test.zip (Ao)
Text.bat (Ao)
text.bat (NWYZAbAcAk)
Text.cmd (Ao)
text.cmd (NWYZAbAcAk)
Text.com (Ao)
Text.exe (Ao)
text.exe (NWYZAbAcAk)
Text.pif (Ao)
text.pif (NWYZAbAcAk)
Text.scr (Ao)
text.scr (NWYZAbAcAk)
Text.zip (Ao)
the hardcore game-.pif (GHIJKNOXYZAbAcAdAk)
WindowsXP Creak.exe (AnAo)
YOU_are_FAT!.TXT.pif (GHIJKAk)

Comments: A mass mailing worm that attempts to email itself to all the email addresses that it findsin files with a file extension that starts with "ht". Also attempts to copy itself to allthe computers on a local network, and then infect these computers. The worm also has abackdoor Trojan capability. Some variants propagate through open network shares and byusing the Microsoft Windows DCOM RPC Interface Buffer Overrun Vulnerability.

Symptoms:


 Creates the following registry key:
HKEY_LOCAL_MACHINESoftwareKittyXP.sqlInstall 
 If the infected computer runs Windows 95, 98, or ME, it adds the
following line: run=rpcsrv.exe to the [windows] section in the
Win.ini file.

Recommended Cleanup Software: We found that Easy SpyRemover is the most effective tool for removing this file.

Manual Removal Instructions: Reverse the changes that the worm made to the registry.
Remove the text from the Windows 95, 98, Me Win.ini file (Windows 95, 98, ME only)
Restart the computer.
Update the virus definitions.
Run a full system scan and delete all the files detected as W32.HLLW.Lovgate@mm orBackdoor.Trojan.