W32/Nuwar.AI Worm

 Information about the W32/Nuwar.AI Worm:

W32/Nuwar.AI is a worm. The worm will infect Windows systems and spreads through email.

The subject of the infected mail will be any of the following;.

Send Love On Valentines
A Valentine Love Song
For My Valentine
Be My Valentine
Valentine's Night
Fly Away Valentine
Valentine Sweetie
Happy Valentine's Day
Valentines Day Dance
My Lucky Valentine
Valentine's Love
My Valentine
My Valentine Heart
Valentine Love Song
My Valentine Sunshine
The Valentine Love Bug
Your Love on Valentine's
The Valentines Angel
Valentine Letter
Valentines Day is here again

The body of the infected mail will be [blank].

The name of the infected attachment will be any of the following;

Greeting Postcard.exe
Flash Postcard.exe
Postcard.exe
Greeting Card.exe

Upon execution, the worm copies itself as wincom32.sys in Windows System folder.

The worm modifies registry at the following location to load itself during each startup.

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run

To propogate itself the worm collects email address from Windows Address Book and mails itself to these addresses using its own SMTP engine.

The worm also terminates some of the security related processes.

This worm first appeared on February 13, 2007.

 Other names of W32/Nuwar.AI Worm:

This Worm is also known as WORM_NUWAR.AAI.