W32/Nugosh-A

Please follow the instructions for removing worms.

Change any passwords that may have become compromised.

Renaming the registry editor

• Using Windows explorer, browse to the Windows folder (usually C:\Windows or C:\Winnt) right-click Regedit.exe and make a copy of it.
• Rename the copy of Regedit.exe to Regedit.com.
• At the taskbar, click Start|Run. Type 'Regedit' and press Return. The registry editor opens.

You will also need to edit the following registry entry, if it is present. Please read the warning about editing the registry.

At the taskbar, click Start|Run. Type 'Regedit' and press Return. The registry editor opens.

Before you edit the registry, you should make a backup. On the 'Registry' menu, click 'Export Registry File'. In the 'Export range' panel, click 'All', then save your registry as Backup.

Locate the HKEY_LOCAL_MACHINE entry:

HKLM\Software\Microsoft\Windows\CurrentVersion\load32

and delete it if it exists.

Close the registry editor.

Editing other configuration files

At the taskbar, right-click Start and select Explore.

Search for System.ini in the Windows folder and open it in Notepad. Search in the shell parameter in the [Boot] section for any references to the files you deleted. Delete the references.

Search for Win.ini in the Windows folder and open it in Notepad. Search in the run parameter in the [Windows] section for any references to the files you deleted. Delete the references.

W32/Nugosh-A is a mass mailing worm that spreads to email addresses found in files on the local hard drive. The message sent has the following characteristics:

Subject line: Use this patch immediately !
Attached File: patch.exe
From: "Microsoft" <security@microsoft.com>
Message text: Dear friend , use this Internet Explorer patch now!
There are dangerous virus in the Internet now!
More than 500.000 already infected!

W32/Nugosh-A copies itself as dllreg.exe to the Windows folder, as load32.exe and vxdmgr.exe to the Windows system folder, and as rundllw.exe to the StartUp folder.

The worm creates the following registry key to run itself on system start:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\load32

The worm also changes the run parameter in the [Windows] section of win.ini and the shell parameter in the [Boot] section of system.ini.

W32/Nugosh-A drops a keylogging component as guid32.dll, an IRC-based distributed denial-of-service Trojan as windrive.exe and a hacked utility to export Outlook Express and Internet Explorer passwords as winimg.exe, all to the Windows system folder. These are all detected as W32/Nugosh-A.

The worm will kill off the following processes if they are running:

AGENTSVR.EXE
ANTS.EXE
APLICA32.EXE
APVXDWIN.EXE
ATCON.EXE
ATUPDATER.EXE
ATWATCH.EXE
AVSYNMGR.EXE
BLACKD.EXE
BLACKICE.EXE
CFIADMIN.EXE
CFIAUDIT.EXE
CFINET.EXE
CFINET32.EXE
DEFWATCH.EXE
DRWATSON.EXE
FAST.EXE
FRW.EXE
GUARD.EXE
IAMAPP.EXE
IAMSERV.EXE
ICLOAD95.EXE
ICLOADNT.EXE
ICMON.EXE
ICSUPP95.EXE
ICSUPPNT.EXE
LOCKDOWN.EXE
LOCKDOWN2000.EXE
LUALL.EXE
LUCOMSERVER.EXE
MCAGENT.EXE
MCUPDATE.EXE
MGUI.EXE
MINILOG.EXE
MOOLIVE.EXE
MSCONFIG.EXE
MSSMMC32.EXE
NDD32.EXE
NETSTAT.EXE
NISSERV.EXE
NISUM.EXE
NMAIN.EXE
NPROTECT.EXE
NSCHED32.EXE
NVARCH16.EXE
PAVPROXY.EXE
PCCIOMON.EXE
PCFWALLICON.EXE
PERSFW.EXE
POPROXY.EXE
PVIEW95.EXE
REGEDIT.EXE
RTVSCN95.EXE
SAFEWEB.EXE
SPHINX.EXE
SPYXX.EXE
SS3EDIT.EXE
SYSEDIT.EXE
TAUMON.EXE
TC.EXE
TCA.EXE
TCM.EXE
TDS2-98.EXE
TDS2-NT.EXE
TDS-3.EXE
UPDATE.EXE
VPC42.EXE
VPTRAY.EXE
VSECOMR.EXE
VSHWIN32.EXE
VSMAIN.EXE
VSMON.EXE
VSSTAT.EXE
WATCHDOG.EXE
WEBSCANX.EXE
WGFE95.EXE
WRADMIN.EXE
WRCTRL.EXE
WRCTRL.EXE
ZAPRO.EXE
ZATUTOR.EXE
ZAUINST.EXE
ZONEALARM.EXE