W32/Nuwar.BH is a worm. The worm will infect Windows systems and spreads through email.

The worm uses any one the following names as from address, along with a spoofed domain name.

Zilya
Zenia
Xylia
Xenia
Xandra
Willa
Wendy
Vivian
Violet
Vicky
Vanessa
Valora
Valda
Silver
Sharon
Rachel
Queen
Peggy
Pamela
Olivia
Nicole
Natalie
Naomi
Nadia
Melody
Lolita
Linda
Laura
Katrina
Kassia
Kacey
Juliet
Julie
Joanna
Jewel
Janet
Ivory
Ivana
Isabel
Idona
Holly
Helga
Haley
Gloria
Gilda
Faith
Evelyn
Erika
Emily
Eliza
Ebony
Doris
Donna
Diana
Daria
Danielle
Damita
Clarissa
Chelsea
Carmen
Carla
Camille
Caitlin
Bridget
Briana
Blenda
Bettina
Bella
Becky
Barbra
Aretina
April
Anita
Amorita
Alysia
Aldora

The subject of the infected email will be;

Happy New Year!

The body of the infected email will be blank.

The name of the infected attachment will be;

postcard.exe

Upon execution, the worm copies itself as alsys.exe in Windows System folder.
The worm modifies registry at the following location to load itself during each startup.

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

To propagate itself, the worm gathers email address from Windows Address Book and mails itself to these addresses using its own SMTP engine.

It also tries to terminate some of the security related processes.

This worm first appeared on December 30, 2006.

 Other names of W32/Nuwar.BH Worm:

This Worm is also known as WORM_NUWAR.BH.