TrojanDropper:Win32/Nuwar

TrojanDropper:Win32/Nuwar is a generic detection for the dropper or loader component for members of the Win32/Nuwar family.

 

Win32/Nuwar is a detection for a family of trojans that receive commands indirectly from a remote attacker via a connection to a malicious peer-to-peer (P2P) network.

 

Components of the Win32/Nuwar trojan family are used to relay spam e-mails. Win32/Nuwar contacts remote web sites to receive compressed e-mail configuration information, which includes email body content and recipients. The information is then decompressed and interpreted, and the infected machine becomes a spam relay. E-mail messages are sent in various formats, commonly containing a hyperlink to a remote web site hosting Win32/Nuwar trojan files. Several variants drop a kernel-mode driver into the Windows system folder, which is used to prevent removal of the spammer component.