Lokkest is a complex Internet worm that spreads by e-mail through messages with infected attachments that can be screensavers, archives, images or text documents. Once the user opens such an attachment, the parasite secretly installs itself to the system and runs a spreading routine. The worm uses own mail engine to send bogus e-mails to addresses it gathers from local program, text and web files. Lokkest can also propagate through instant messages using Yahoo! Messenger, ICQ, AIM and MSN Messenger programs. Furthermore, it is able to spread to computers running MS SQL Server and network shares protected by weak passwords. The parasite can infect computers running unpatched Symantec, Microsoft and RealVNC software. Lokkest carries a dangerous payload. It terminates running antiviruses, firewalls and anti-spyware programs. It attempts to open a back door providing the attacker with unauthorized remote access to the compromised computer. The intruder can download and execute files, log user keystrokes, steal MSN Messenger passwords, intercept network traffic and run a hidden proxy server. The worm is able to change some system settings and modify essential system files. Lokkest runs as a service on every Windows startup.