Skip to main content
Skip to main content
Microsoft Security Intelligence
Cart 0 items in shopping cart
Sign in
Published Mar 23, 2007 | Updated Sep 15, 2017

Worm:Win32/Nuwar.IR

Detected by Microsoft Defender Antivirus

Aliases: Email-Worm.Win32.Zhelatin.bg (Kaspersky) Spam-Mespam (McAfee) Trojan.Mespam (Symantec) WORM_ZHELATIN.BG (Trend Micro)

Summary

Worm:Win32/Nuwar.IR registers itself as a Licensed Service Provider (LSP) on the compromised system. The worm receives messages from a remote Web site which it then appends to outgoing Web-based communications. The message includes a link that points to a copy of the worm file. These messages may be appended to outgoing instant messaging chats, Web-based e-mail, as well as blog comments and forum posts.
Manual removal is not recommended for this threat. To detect and remove this threat and other malicious software that may have been installed, run a full-system scan with an up-to-date antivirus product such as Microsoft Security Essentials, or the Microsoft Safety Scanner. For more information about using antivirus software, see http://www.microsoft.com/security/antivirus/av.aspx.
Follow us