Nurech.A
Threat LevelDamageDistribution

Effects 

Nurech.A carries out the following actions:

• It ends the processes that contain any of the following text strings:
  anti
  avg
  avp
  blackice
  firewall
  f-pro
  hijack
  lockdown
  mcafee
  msconfig
  nav
  nod32
  rav
  reged
  spybot
  taskmgr
  troja
  viru
  vsmon
  zonea
  These processes mostly belong to security tools, such as antivirus programs and firewalls, among others.
• It has rootkit functionalities, which allow it to hide its own processes.

Infection strategy 

Nurech.A creates the following files:

• A random file with an EXE extension in the Desktop. This file is a copy of the worm.
• WINCOM32.SYS, in the Windows system directory. This file belongs to the rootkit Nurech.A.

Nurech.A creates the following entry in the Windows Registry:

• HKEY_LOCAL_MACHINE\ SYSTEM\ CurrentControlSet\ Services\ SharedAccess
  Start

Means of transmission 

Nurech.A spreads via email. It follows the routine below:

• It reaches the computer in an email message with the following characteristics:
  Sender:
  Nurech.A spoofs the email address from which it is sent. This false address consists of one of the names below followed by a domain:
  Aldora, Alysia, Amorita, Anita, April, Aretina, Barbra, Becky, Bella, Bettina, Blenda, Briana, Bridget, Caitlin, Camille, Carla, Carmen, Chelsea, Clarissa, Damita, Danielle, Daria, Diana, Donna, Doris, Ebony, Eliza, Emily, Erika, Evelyn, Faith, Gilda, Gloria, Haley, Helga, Holly, Idona, Isabel, Ivana, Ivory, Janet, Jewel, Joanna, Julie, Juliet, Kacey, Kassia, Katrina, Laura, Linda, Lolita, Melody, Nadia, Naomi, Natalie, Nicole, Olivia, Pamela, Peggy, Queen, Rachel, Sharon, Silver, Valda, Valora, Vanessa, Vicky, Violet, Vivian, Wendy, Willa, Xandra, Xenia, Xylia, Zenia, Zilya.
  
  Subject: it is variable and can be one of the following:
  1234567890
  5 Reasons I Love You.
  
  A
  A Bouquet of Love, A Day in Bed Coupon Feeling Horny?, A Kiss So Gentle, A Little (sex) Card A Kiss for You, A Monkey Rose for You, A Red Hot Kiss, A Relaxing Coupon, A Romantic Place, A Song to You, A Special Kiss, A Sweet Love, Against All Odds, All For You For Better of For Worse To New Spouse, All That Matters, Awaiting Your Love.
  
  B
  Baby, Back Together, Between Us, Brand New Love, Breakfast in Bed Coupon Romantic Picnic Coupon, Bubble Bath Coupon.
  
  C
  Cuddle Up, Cyber Love.
  
  D
  Dancing, Dinner Coupon, Dream Date Coupon.
  
  E
  Emptiness Inside Me Our Love Everyday, Eternity of Your Love, Evening Romance Doing It for You, Every Inch of Your Body Ourlove is torn by miles, Everyone Needs Someone.
  
  F
  Falling In Love with You, Fields Of Love, For You Wish Upon a Star, For You....My Love, Forever in Love Full Heart.
  
  H
  Hand in Hand, He Blessed Our Lives, Heart is Breaking, Hold Me (distant love), Hold On You and I, How Much I Love You A, Hug & Roses, Hugging My Pillow, Hugs & Roses.
  
  I
  I Always Knew, I am Complete, I Am Lost In You, I Believe, I Can't Function, I Dream of you Dream Girl, I Give to You, I'll Be There Rose for my Love, I look at you You are out of this world, I Love Thee I'll Be Your Man, I Love You Mower, I Love You So, I Love You Soo Much Wrapped in Your Arms, I Love You with All I Am, I Luv U Crazy way to say I Luv U, I Still Love You, I Think of You, I Win with You, I wish Together Again You're so Far Away, I Woof You, I Would Do Anything You + Me, I Would Give you Anything, If I Could, If I Knew, In Love Love You Deeply The Long Haul, In My Heart From this day forward, Inside, Internet Love, It's Your Move.
  
  J
  Just You, Just You & Me.
  
  K
  Kisses.
  
  L
  Last Night was Hot! When, Let's Get Frisky, Love Birds, Love for Granted, Love is in the Air, Love Remains.
  
  M
  Massage Coupon, Memories, Miracle of Love A Token of My Love, Moonlit, My Heart belongs to you, My Heart is Thinking, My Heart The Miracle of Love Our Love is Strong, My Invitation, My Love Our Love is Free.
  
  N
  Now and Forever Without Your Love, Now I Know The Kiss.
  
  O
  Old Together, Only You, Our Love, Our Love Nest, Our Love Will Last, Our Two Hearts, Our Wedding Day Hey Cutie.
  
  P
  P.M.S, Passionate Kiss Kiss Coupon, Peek-A-Boo, Pockets of Love Live With Me.
  
  R
  Red Rose.
  
  S
  Safe With You, Search for One, Sending Kiss, Sending You My Love Magic of Flowers, So in Love, So Unique, Solitary Beauty Cuddle Me Please, Someone at Last Made for Each Other Safe and Sound, Soul Mates, Soul Partners, Steamy Dream, Steamy Sex Coupon, Summer Love A Weekend Getaway.
  
  T
  Take My Hand, Teddy Bear & Roses, Tender Whispers With This Ring, Thanks...Love, That Special Love, The Candle's Light, The Dance of Love, The Letter Bewitching Moonlight, The Love Bugs, The Mood for Love, The Sweet Taste of Love A Special Flower for You, The Time for Love, Thinking about you, Thinking of You Longing for You Twice Blest Forever and Ever, This Day Forward, This Feeling, Til the End of Time Heart of Mine, Till Morning's Light, Till Morninig's Light, Times Are Hard, Together You and I, Touched by Love Most Beautiful Girl Wrapped Up, Trunk Full Of Love, Twilight Paradise, Two of a Kind.
  
  U
  Unique Love My Eye on You, Unmatchable Beauty, Until the Day.
  
  V
  Vacation Love.
  
  W
  Waiting for You My Perfect Love True Love, Want to Meet?, Want You to Know, Waterfall, We Are Different, We Have Walked, We're a Perfect Fit, When I'm With You, When You Fall in Love, Why I Love You, Wild Nights--Wild Nights, Will You?, Window of Beauty, Wine and Roses, Wish I Could Tell You, With All My Love, With All of My Heart, With You, Won't you dance with me, Words I Write, Worthy of You.
  
  Y
  You and I Forever, You Are My Guiding Star Puppy Love, You Asked Me Why, You Brighten My Day Love at First Sight, You Lucky Duck!, You Rock Me!, You Were Worth the Wait Showers Of Love Can't Wait to See You!, Your Love Has Opened, Your Silly Smile, You're My Hero, You're Soo kissable Angel of Love, You're the One.
  
  Message: it is empty.
  
  Attachments: one of the following:
  FLASH POSTCARD.EXE
  GREETING CARD.EXE
  GREETING POSTCARD.EXE
  POSTCARD.EXE
• The computer is affected when the attached file is run.
• Nurech.A searches for email addresses in files located in the affected computer.
• Nurech.A sends itself out to the addresses it has gathered.
• However, it does not send itself to those addresses that contain any of the following domains:
  GOV
  MIL

Further Details  

Nurech.A is between 30 and 52 Kb in size and it is compressed with UPX.