Win32/Nuwar.N@MM

Win32/Nuwar.N@MM!CME-711 is a mass-mailing email worm that sends a trojan via email. When the trojan attachment is opened, it downloads a copy of the email worm component. The email component is encrypted. It drops and installs wincom32.sys which loads and infects a dll into the memory process of services.exe. The dll contains the functionality to scan ports on UDP port 4000 to create a P2P network with other infected computers for the purpose of downloading and updating. Known other components downloaded are other Win32/Nuwar variants.

 

The email composed by Win32/Nuwar.N@MM!CME-711 has the following characteristics:

 

Subject: may be one of the following:

 

 

Message body: blank