Thank you for being a valued part of the CNET community. As of December 1, 2020, the forums are in read-only format. In early 2021, CNET Forums will no longer be available. We are grateful for the participation and advice you have provided to one another over the years.

Thanks,

CNET Support

General discussion

Win32.Lovmus

Feb 18, 2004 2:41PM PST

Alias: QReg-9 (McAfee),
Win32/BruteCode
Category: Win32
Type: Trojan
Published Date: 2/17/2004
Last Modified: 2/18/2004

CHARACTERISTICS
Win32.Lovmus is a trojan that alters the user's Internet Explorer start page and Recycle Bin icon text.

Method of Installation
When executed, this trojan copies itself to the %System% directory as BCFolder.exe and modifies the registry:

HKEY_CLASSES_ROOT\Folder\shell\open = "%System%\BCfolder.exe explorer.exe /idlist,%I,%L"

Note: '%System%' is a variable location. The worm determines the location of the current System folder by querying the operating system. The default installation location for the System directory for Windows 2000 and NT is C:\Winnt\System32; for 95,98 and ME is C:\Windows\System; and for XP is C:\Windows\System32.


More: http://www3.ca.com/virusinfo/virus.aspx?ID=38324

Discussion is locked