W32.HLLW.Lovgate.C@mm

NOTE: As of February 28, 2003, due to a decreased rate of submissions, Symantec Security Response has downgraded this threat from a Category 3 to a Category 2.

W32.HLLW.Lovgate.C@mm is a variant of W32.HLLW.Lovgate@mm. This worm contains mass-mailing and backdoor functionalities.

To spread itself, the worm attempts to reply to incoming messages when they arrive in the mailbox of certain MAPI-compliant email clients, including Microsoft Outlook. W32.HLLW.Lovgate.C@mm does this in an effort to emulate the auto-reply function of the email client, as well as to lure those who sent the original messages to the infected computer into opening the returned messages.

There are no major functionality differences between this variant and W32.HLLW.Lovgate@mm. This particular variant appears to have been recompiled with a different compiler, and then packed with the same run-time compression utility as W32.HLLW.Lovgate@mm.

NOTE: Definitions dated February 23, 2003 detect this threat as W32.HLLW.Lovgate@mm. Definitions dated February 24, 2003 or later will detect this threat as W32.HLLW.Lovgate.C@mm.