W32/Nuwar.LO Worm

 Information about the W32/Nuwar.LO Worm:

W32/Nuwar.LO is a worm. The worm will infect Windows systems and spreads through email.

The subject of the infected email will be any one of the following;

Incredible news!
ATTN TO EVERYBODY!
NEWS!
READ AND RESEND ASAP!
White house news!
URGENT NEWS!

The body of the infected mail will be any one of the following;

For read this news open file
Full news included in attached file
Read more in attach...
Open file to get complete news.
Read more in attached file...
Full news in attached file
Full news in attach

The name of the infected attachment will be any one of the following;

CNN news reader.exe
CNN latest news.exe
cnn.exe
cnn agent.exe
WWW-CNN-COM.exe
news agent.exe
cnn site explorer.exe
read me.exe
news reader.exe
webnews agent.exe

Upon execution, the worm copies itself as nordsys.exe in Windows System folder.

It also drops the following files in Windows System folder.

svcp.csv
winsub.xml

The worm modifies registry at the following location to load itself during each startup.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run

This worm first appeared on December 9, 2006.

 Other names of W32/Nuwar.LO Worm:

This Worm is also known as WORM_NUWAR.LO.