Follow:

 

Virus:Win32/Nuwar.A


Virus:Win32/Nuwar.A is a file modifying virus. This virus modifies device drivers on an infected system, specifically files named kbdclass.sys and tcpip.sys. The modified drivers load Nuwar into memory on system startup, and in some cases, the virus may block system file checker from displaying notifications of these system file modifications.
 
Related Malware


What to do now

To detect and remove this threat and other malicious software that may be installed in your computer, run a full-system scan with an up-to-date antivirus product such as the following:
 
 
For more information on antivirus software, see http://www.microsoft.com/windows/antivirus-partners/.

Threat behavior

Virus:Win32/Nuwar.A is a file modifying virus. This virus modifies device drivers on an infected system, specifically files named kbdclass.sys and tcpip.sys. The modified drivers load Nuwar into memory on system startup, and in some cases, the virus may block system file checker from displaying notifications of these system file modifications.
 
Related Malware

Symptoms

Nuwar uses advanced stealth techniques in order to hide its files and associated registry modifications. Hence, it is unlikely that users could easily ascertain the presence of the Trojan on the infected computer.

Prevention


Alert level: Severe
First detected by definition: 1.45.287.0
Latest detected by definition: 1.71.240.0 and higher
First detected on: Oct 07, 2008
This entry was first published on: Sep 05, 2007
This entry was updated on: Apr 17, 2011

This threat is also detected as:
  • Win32/VMalum.BSA (CA)
  • Trojan.Win32.Patched.ad (Kaspersky)
  • TROJ/Dorf-M (Sophos)
  • Trojan.Patched.X (Sunbelt Software)
  • Trojan.Peacomm!inf (Symantec)