Internet Security Threats

Trojan-Downloader.Win32.Nurech.at

RISK LEVEL:2

This Trojan downloads files via the Internet without the knowledge or consentof the user. It is a Windows PE EXE file. The file is approximately 28KB insize. It is packed using UPX. The unpacked file is approximately 77KB in size.

This Trojan was originally mass mailed.

Once launched, the Trojan downloads files from the following URLs:

http://www.coldspread.de/data/links***http://marketing-know-how.com/products***http://www.eurowing.us/images***http://81.95.147.138/tomtom***http://www.thaitradeshow.com/images***http://tncmhg.com/images/lopsi***

(At the moment of writing, these links were not working.)

The Trojan will save the files it has downloaded to the Windows system directoryunder the following names:

%System%\ws25.exe%System%\ws26.exe%System%\ws27.exe%System%\ws28.exe%System%\ws35.exe%System%\ws36.exe

The files will then be launched for execution and the Trojan will cease running.

If your computer does not have an up-to-date antivirus, or does not have anantivirus solution at all, follow the instructions below to delete the maliciousprogram:

1. Use Task Manager to terminate the Trojan processes.
2. Delete the original Trojan file (the location will depend onhow the program originally penetrated the victim machine).
3. Delete the files which were downloaded to the Windows systemdirectory:

   %System%\ws25.exe%System%\ws26.exe%System%\ws27.exe%System%\ws28.exe%System%\ws35.exe%System%\ws36.exe

4. Update your antivirus databases and perform a full scan of thecomputer (download a trial version of Kaspersky Anti-Virus).