W32/Nuwar.AY Worm

 Information about the W32/Nuwar.AY Worm:

W32/Nuwar.AY is a worm. The worm will infect Windows systems and spreads through email.

The worm uses any one the following names as from address, along with a spoofed domain name.

Amorita
Alysia
Anita
Aldora
April
Barbra
Bella
Aretina
Bettina
Briana
Blenda
Becky
Camille
Caitlin
Carla
Bridget
Carmen
Clarissa
Danielle
Chelsea
Daria
Donna
Diana
Damita
Eliza
Ebony
Emily
Doris
Erika
Faith
Gloria
Evelyn
Haley
Holly
Helga
Gilda
Ivana
Isabel
Ivory
Idona
Janet
Joanna
Juliet
Jewel
Katrina
Kassia
Julie
Kacey
Melody
Laura
Lolita
Linda
Olivia
Naomi
Nadia
Natalie
Peggy
Nicole
Pamela
Queen
Valda
Rachel
Silver
Sharon
Vivian
Vanessa
Valora
Vicky
Willa
Violet
Wendy
Xandra
Zilya
Xenia
Xylia
Zenia

The subject of the infected email will be;

Happy New Year!

The body of the infected email will be blank.

The name of the infected attachment will be;

postcard.exe

Upon execution, the worm copies itself as ppl.exe in Windows System folder. It also drops the following files in the same folder.

google.png.exe
winsub.xml
zlbw.dll
se.exe

The worm modifies registry at the following location to load itself during each startup.

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

To propagate itself, the worm gathers email address from Windows Address Book and mails itself to these addresses using its own SMTP engine.

It also tries to terminate some of the security related processes.

This worm first appeared on December 28, 2006.

 Other names of W32/Nuwar.AY Worm:

This Worm is also known as WORM_NUWAR.AY.