Worm.Win32.Nuf
| Alert Level : | Medium |
| Discovered: | Nov 16 2006 |
| Tag: | Internet Worms |
| Discoverer and Source: | http://www.kaspersky.com/ |
Malware Behavior and Technical Description
This worm infects computers running under Windows. It spreads via poorly protected network resources.
The worm itself is a PE EXE file. It is written in Microsof Visual C . The file is approximately 37KB in size. It is not packed in any way.
InstallationOnce launched, the worm copies itself to the Windows system directory as "MSSHVC.exe":
%System%\MSSHVC.exeThe worm then registers itself in the system registry:
[HKLM\Software\Microsoft\Windows\CurrentVersion\Run]"MSSHVC" = "%System%\MSSHVC.exe"
This ensures that the worm will be launched each time Windows is booted on the victim machine.
PropagationThe worm uses a separate thread to search for accessible network resources in an unending cycle. It attempts to connect to computers on which the network resources are located.
The worm uses the following user names and passwords:
User name: adminsystem
guest
guestguest Password: 12345
11111
The worm then copies itself to accessible resources as "fun.exe” and terminates the connection.
Removal instructions0
Removal Worm.Win32.Nuf instructions:
- Terminate the process called
Need help? Live computer support via remote at SupportSpace
.Help with printer problems, windows, hardware, software, spyware removal and more. - Go Now!
