Nuwar.A is a worm that ends processes with a name containing certain text strings, if they are active. These processes belong to several security tools, such as antivirus programs and firewalls, among others. Additionally, it drops a file into the affected computer that is used to update and configure Nuwar.A. In Windows XP computers, Mytob.ML disables the Internet Connection Firewall (ICF) and the Internet Connection Sharing (ICS). Nuwar.A spreads via email in a message with variable characteristics. |