WORM_NUWAR.ARC
WORM_NUWAR.ARC is a worm that was dropped by another threat. This worm can spread via email messages with electronic greeting cards (eCards) which includes a link pointing to malicious web site. Infected browsers will be redirected to “The Laughing Psycho Kitty Cat” website. WORM_NUWAR.ARC also spreads via peer-to-peer networks.
Aliases: Email-Worm.Win32.Zhelatin.ki, W32/Nuwar@MM, Trojan.Peacomm.C, TR/Rootkit.Gen, Troj/Dorf-X, Backdoor:WinNT/Nuwar.B!sys
Damage Level: Medium
Systems Affected: Windows 9x, 2000, XP, Windows Vista
Technical Details and Additional Information:
What can WORM_NUWAR.ARC do to infected system?
- Harvest email address from infected PC.
- Terminates any process that belongs to anti-virus applications.
- The worm can connect to a remote server to update itself.
Malicious Files Added by WORM_NUWAR.ARC
%System%\spooldr.sys
%Windows%\spooldr.exe
WORM_NUWAR.ARC – Removal
Removing WORM_NUWAR.ARC Manually:
1. If using Windows ME or XP, System Restore must be disabled to prevent the threat from restoring itself. [Windows XP System Restore]
2. Update the virus definitions.
3. Reboot Windows in SafeMode [how to]
4. Run a full system scan and clean/delete all infected file(s)
5. Restart Windows.
Anti-virus Tools
Online Virus Scanner:
Online virus scanner can provide scan and clean functions just like any anti-virus software without the need to install additional AV product. Perform a thorough scan with free Online Virus Scanner that can be found here or on web sites of legitimate security software provider.
Scan with Norton Power Eraser:
Norton Power Eraser is a virus removal tool created by Norton Antivirus to remove unfamiliar threats without using the traditional AV signatures. Download the tool from this location and start scanning the computer for viruses.infected autorun.inf and other worm-related files.