Published Jun 25, 2010 | Updated Sep 15, 2017


Detected with Windows Defender Antivirus

Aliases: (Kaspersky) Worm/NeKav.CV (Avira)


Worm:Win32/Nekav.A is a worm that can spread via removable drives. It may pose as an annoyance and interfere with normal operations by displaying a splash image that waits for the user to send a code to supposedly resume back with normal work.
It terminates and deletes certain files, most of which are related to security and antivirus programs. It also modifies certain system settings.
Manual removal is not recommended for this threat. To detect and remove this threat and other malicious software that may have been installed, run a full-system scan with an up-to-date antivirus product such as Microsoft Security Essentials, or the Microsoft Safety Scanner. For more information about using antivirus software, see
Enabling registry editor
This threat may modify the computer to prevent Registry Editor from running. To enable Registry Editor in your computer, please do the following:
  1. Run a command prompt. Click Start>Run and type cmd.
  2. In the command prompt, type the following as is and press Enter:
    reg.exe add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 0 /f
  3. Type exit at the command prompt.
Additional remediation instructions for Worm:Win32/Nekav.A
This threat may make lasting changes to a computer’s configuration that are NOT restored by detecting and removing this threat. For more information on returning an infected computer to its pre-infected state, please see the following article/s: 
Follow us