W32/Nuwar.YH is a worm. The worm will infect Windows systems.

The worm may be downloaded from remote site by other malware or dropped by other malware.

Upon execution, the worm drops msvupdater.exe and msvupdater.config in the Windows folder.

The worm modifies registry at the following location to load itself during each startup;

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run

It also modifies registry at the following locations;

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\ITStorage\Finders
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Epoch
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\Parameters

The worm disables console tracing in a command prompt window on Routing and Remote Access Service by modifying registry at the following locations:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\FWCFGConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\FWCFGEnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\FWCFGEnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\FWCFGFileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\FWCFGFileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\FWCFGMaxFileSize

The worm disables Windows Firewall Settings by modifying registry at the following location:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\
SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List

The worm propagates by sending email messages with links that redirect browsers to Web sites that contain a downloadable copy of itself. As a results, routines of the downloaded copies are also exhibited on the affected system.

This worm first appeared on June 24, 2008.

 Other names of W32/Nuwar.YH Worm:

This Worm is also known as WORM_NUWAR.YH, W32/Nuwar@MM.