W32/Nomvar Worm

 Information about the W32/Nomvar Worm:

W32/Nomvar is a worm. The worm will infect Windows systems and copies itself to the root of all drives, including removable and shared drives.

Upon execution, the worm creates RavMon.exe and Autorun.inf in the root of all drives.

It also creates svchost.exe in the Windows folder.

It modifies the registry at the following location to ensure its automatic execution at every Windows startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

It also modifies the registry at the following locations:

HKEY_CURRENT_USER\software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ Advanced\Folder\Hidden\SHOWALL

The worm attempts to download an update to itself from the following URL:

http://www.chacent.cn/upd[Blocked]

It also attempts to download malicious files from the following URL:

http://www.chacent.cn/down[Blocked]

This worm first appeared on May 28, 2007.

 Other names of W32/Nomvar Worm:

This Worm is also known as W32.Nomvar.