WORM_NUQEL.DU

October 09, 2012

Analysis by: Kathleen Notario

ALIASES:

Worm:Win32/Nuqel.AC (Microsoft)

PLATFORM:

Windows 2000, Windows XP, Windows Server 2003

OVERALL RISK RATING:

DAMAGE POTENTIAL:

DISTRIBUTION POTENTIAL:

REPORTED INFECTION:

Threat Type: Worm
Destructiveness: No
Encrypted: No
In the wild: Yes

OVERVIEW

This worm arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

TECHNICAL DETAILS

File Size:

351,232 bytes

File Type:

EXE

Memory Resident:

Yes

Initial Samples Received Date:

26 Aug 2011

Arrival Details

This worm arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This worm drops the following files:

%User Profile%\Application Data\Java\Desktop.ini
%Windows%\ntbtlog.txt

(Note: %User Profile% is the current user's profile folder, which is usually C:\Windows\Profiles\{user name} on Windows 98 and ME, C:\WINNT\Profiles\{user name} on Windows NT, and C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003.. %Windows% is the Windows folder, which is usually C:\Windows or C:\WINNT.)

It drops the following copies of itself into the affected system:

%User Profile%\Application Data\Java\?shimgvw?.exe
%User Profile%\Application Data\Java\?Jview?.exe

It creates the following folders:

%User Profile%\Application Data\Java

Autostart Technique

This worm adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
{username}? = "%User Profile%\Application Data\Java\?shimgvw?.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
jre? = "%User Profile%\Application Data\Java\?Jview?.exe"

Other System Modifications

This worm adds the following registry entries:

HKEY_CLASSES_ROOT\exefile
NeverShowExt = ""

HKEY_CLASSES_ROOT\jpegfile
NeverShowExt = ""

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
System
EnableLUA = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
AntiVirusOverride = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
AntiVirusDisableNotify = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
FirewallDisableNotify = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
FirewallOverride = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
UpdatesDisableNotify = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
UacDisableNotify = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
FirstRunDisabled = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center\Svc
AntiVirusOverride = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center\Svc
AntiVirusDisableNotify = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center\Svc
FirewallDisableNotify = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center\Svc
FirewallOverride = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center\Svc
UpdatesDisableNotify = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center\Svc
UacDisableNotify = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center\Svc
FirstRunDisabled = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\policies\
system
EnableLUA = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
ansavgd
Debugger = "cmd.exe /c del /f /q"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
attrib.exe
Debugger = "rundll32.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
autorunme.exe
Debugger = "cmd.exe /c del /f /q"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
blastclnn.exe
Debugger = "cmd.exe /c del /f /q"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
blastclnnn.exe
Debugger = "cmd.exe /c del /f /q"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
cscript.exe
Debugger = "rundll32.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
egui.exe
Debugger = "cmd.exe /c del /f /q"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
ekrn.exe
Debugger = "cmd.exe /c del /f /q"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
ise32.exe
Debugger = "cmd.exe /c del /f /q"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
MSASCui.exe
Debugger = "rundll32.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
Nbrowser.exe
Debugger = "cmd.exe /c del /f /q"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
New Folder.exe
Debugger = "cmd.exe /c del /f /q"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
Njeeves.exe
Debugger = "cmd.exe /c del /f /q"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
nod32.exe
Debugger = "cmd.exe /c del /f /q"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
nod32krn.exe
Debugger = "cmd.exe /c del /f /q"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
nod32kui.exe
Debugger = "cmd.exe /c del /f /q"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
npcsvc32.exe
Debugger = "cmd.exe /c del /f /q"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
npc_login.exe
Debugger = "cmd.exe /c del /f /q"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
npc_tray.exe
Debugger = "cmd.exe /c del /f /q"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
npflgutl.exe
Debugger = "cmd.exe /c del /f /q"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
npfports.exe
Debugger = "cmd.exe /c del /f /q"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
npfrules.exe
Debugger = "cmd.exe /c del /f /q"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
npfsvc32.exe
Debugger = "cmd.exe /c del /f /q"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
npfuser.exe
Debugger = "cmd.exe /c del /f /q"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
npfwiz.exe
Debugger = "cmd.exe /c del /f /q"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
nprosec.exe
Debugger = "cmd.exe /c del /f /q"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
nuaa.exe
Debugger = "cmd.exe /c del /f /q"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
Nvcoa.exe
Debugger = "cmd.exe /c del /f /q"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
nvcsched.exe
Debugger = "cmd.exe /c del /f /q"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
nvoy.exe
Debugger = "cmd.exe /c del /f /q"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
reg32.exe
Debugger = "cmd.exe /c del /f /q"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
rtpsvc.exe
Debugger = "cmd.exe /c del /f /q"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
scsaver.exe
Debugger = "cmd.exe /c del /f /q"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
SSCVIHOST.exe
Debugger = "cmd.exe /c del /f /q"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
wscript.exe
Debugger = "rundll32.exe"

It modifies the following registry entries:

HKEY_CLASSES_ROOT\jpegfile\DefaultIcon
(default) = "%User Profile%\Application Data\Java\?shimgvw?.exe,0"

(Note: The default value data of the said registry entry is shimgvw.dll,3.)

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced
HideFileExt = "1"

(Note: The default value data of the said registry entry is 0.)

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced
SuperHidden = "0"

(Note: The default value data of the said registry entry is 1.)

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced
ShowSuperHidden = "0"

(Note: The default value data of the said registry entry is 1.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced\Folder\HideFileExt
UncheckedValue = "1"

(Note: The default value data of the said registry entry is 0.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced\Folder\SuperHidden
UncheckedValue = "0"

(Note: The default value data of the said registry entry is 1.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\SystemRestore
DisableSR = "1"

(Note: The default value data of the said registry entry is 0.)

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
jpegfile\DefaultIcon
(default) = "%User Profile%\Application Data\Java\?shimgvw?.exe,0"

(Note: The default value data of the said registry entry is shimgvw.dll,3.)

SOLUTION

Minimum Scan Engine:

9.200

FIRST VSAPI PATTERN FILE:

8.380.11

FIRST VSAPI PATTERN DATE:

26 Aug 2011

Step 1

For Windows XP and Windows Server 2003 users, before doing any scans, please make sure you disable System Restore to allow full scanning of your computer.

Step 2

Restart in Safe Mode

[ Learn More ]

Step 3

Delete this registry value

[ Learn More ]

Important: Editing the Windows Registry incorrectly can lead to irreversible system malfunction. Please do this step only if you know how or you can ask assistance from your system administrator. Else, check this Microsoft article first before modifying your computer's registry.

In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
- {username}? = "%User Profile%\Application Data\Java\?shimgvw?.exe"
In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
- jre? = "%User Profile%\Application Data\Java\?Jview?.exe"
In HKEY_CLASSES_ROOT\exefile
- NeverShowExt = ""
In HKEY_CLASSES_ROOT\jpegfile
- NeverShowExt = ""
In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System
- EnableLUA = "0"
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center
- AntiVirusOverride = "1"
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center
- AntiVirusDisableNotify = "1"
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center
- FirewallDisableNotify = "1"
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center
- FirewallOverride = "1"
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center
- UpdatesDisableNotify = "1"
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center
- UacDisableNotify = "1"
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center
- FirstRunDisabled = "1"
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc
- AntiVirusOverride = "1"
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc
- AntiVirusDisableNotify = "1"
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc
- FirewallDisableNotify = "1"
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc
- FirewallOverride = "1"
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc
- UpdatesDisableNotify = "1"
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc
- UacDisableNotify = "1"
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc
- FirstRunDisabled = "1"
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system
- EnableLUA = "0"
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ansavgd
- Debugger = "cmd.exe /c del /f /q"
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\attrib.exe
- Debugger = "rundll32.exe"
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\autorunme.exe
- Debugger = "cmd.exe /c del /f /q"
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\blastclnn.exe
- Debugger = "cmd.exe /c del /f /q"
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\blastclnnn.exe
- Debugger = "cmd.exe /c del /f /q"
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe
- Debugger = "rundll32.exe"
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\egui.exe
- Debugger = "cmd.exe /c del /f /q"
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ekrn.exe
- Debugger = "cmd.exe /c del /f /q"
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ise32.exe
- Debugger = "cmd.exe /c del /f /q"
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSASCui.exe
- Debugger = "rundll32.exe"
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Nbrowser.exe
- Debugger = "cmd.exe /c del /f /q"
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\New Folder.exe
- Debugger = "cmd.exe /c del /f /q"
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Njeeves.exe
- Debugger = "cmd.exe /c del /f /q"
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nod32.exe
- Debugger = "cmd.exe /c del /f /q"
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nod32krn.exe
- Debugger = "cmd.exe /c del /f /q"
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nod32kui.exe
- Debugger = "cmd.exe /c del /f /q"
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\npcsvc32.exe
- Debugger = "cmd.exe /c del /f /q"
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\npc_login.exe
- Debugger = "cmd.exe /c del /f /q"
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\npc_tray.exe
- Debugger = "cmd.exe /c del /f /q"
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\npflgutl.exe
- Debugger = "cmd.exe /c del /f /q"
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\npfports.exe
- Debugger = "cmd.exe /c del /f /q"
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\npfrules.exe
- Debugger = "cmd.exe /c del /f /q"
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\npfsvc32.exe
- Debugger = "cmd.exe /c del /f /q"
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\npfuser.exe
- Debugger = "cmd.exe /c del /f /q"
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\npfwiz.exe
- Debugger = "cmd.exe /c del /f /q"
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nprosec.exe
- Debugger = "cmd.exe /c del /f /q"
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nuaa.exe
- Debugger = "cmd.exe /c del /f /q"
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Nvcoa.exe
- Debugger = "cmd.exe /c del /f /q"
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nvcsched.exe
- Debugger = "cmd.exe /c del /f /q"
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nvoy.exe
- Debugger = "cmd.exe /c del /f /q"
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\reg32.exe
- Debugger = "cmd.exe /c del /f /q"
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rtpsvc.exe
- Debugger = "cmd.exe /c del /f /q"
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scsaver.exe
- Debugger = "cmd.exe /c del /f /q"
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SSCVIHOST.exe
- Debugger = "cmd.exe /c del /f /q"
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe
- Debugger = "rundll32.exe"

To delete the registry value this malware created:

Open Registry Editor. To do this, click Start>Run, type regedit in the text box provided, then press Enter.
In the left panel of the Registry Editor window, double-click the following:
HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Run
In the right panel, locate and delete the entry:
{username}? = "%User Profile%\Application Data\Java\?shimgvw?.exe"
Again In the right panel, locate and delete the entry:
jre? = "%User Profile%\Application Data\Java\?Jview?.exe"
In the left panel of the Registry Editor window, double-click the following:
HKEY_CLASSES_ROOT>exefile
In the right panel, locate and delete the entry:
NeverShowExt = ""
In the left panel of the Registry Editor window, double-click the following:
HKEY_CLASSES_ROOT>jpegfile
In the right panel, locate and delete the entry:
NeverShowExt = ""
In the left panel of the Registry Editor window, double-click the following:
HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Policies>System
In the right panel, locate and delete the entry:
EnableLUA = "0"
In the left panel of the Registry Editor window, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Security Center
In the right panel, locate and delete the entry:
AntiVirusOverride = "1"
Again In the right panel, locate and delete the entry:
AntiVirusDisableNotify = "1"
Again In the right panel, locate and delete the entry:
FirewallDisableNotify = "1"
Again In the right panel, locate and delete the entry:
FirewallOverride = "1"
Again In the right panel, locate and delete the entry:
UpdatesDisableNotify = "1"
Again In the right panel, locate and delete the entry:
UacDisableNotify = "1"
Again In the right panel, locate and delete the entry:
FirstRunDisabled = "1"
In the left panel of the Registry Editor window, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Security Center>Svc
In the right panel, locate and delete the entry:
AntiVirusOverride = "1"
Again In the right panel, locate and delete the entry:
AntiVirusDisableNotify = "1"
Again In the right panel, locate and delete the entry:
FirewallDisableNotify = "1"
Again In the right panel, locate and delete the entry:
FirewallOverride = "1"
Again In the right panel, locate and delete the entry:
UpdatesDisableNotify = "1"
Again In the right panel, locate and delete the entry:
UacDisableNotify = "1"
Again In the right panel, locate and delete the entry:
FirstRunDisabled = "1"
In the left panel of the Registry Editor window, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>policies>system
In the right panel, locate and delete the entry:
EnableLUA = "0"
In the left panel of the Registry Editor window, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>ansavgd
In the right panel, locate and delete the entry:
Debugger = "cmd.exe /c del /f /q"
In the left panel of the Registry Editor window, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>attrib.exe
In the right panel, locate and delete the entry:
Debugger = "rundll32.exe"
In the left panel of the Registry Editor window, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>autorunme.exe
In the right panel, locate and delete the entry:
Debugger = "cmd.exe /c del /f /q"
In the left panel of the Registry Editor window, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>blastclnn.exe
In the right panel, locate and delete the entry:
Debugger = "cmd.exe /c del /f /q"
In the left panel of the Registry Editor window, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>blastclnnn.exe
In the right panel, locate and delete the entry:
Debugger = "cmd.exe /c del /f /q"
In the left panel of the Registry Editor window, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>cscript.exe
In the right panel, locate and delete the entry:
Debugger = "rundll32.exe"
In the left panel of the Registry Editor window, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>egui.exe
In the right panel, locate and delete the entry:
Debugger = "cmd.exe /c del /f /q"
In the left panel of the Registry Editor window, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>ekrn.exe
In the right panel, locate and delete the entry:
Debugger = "cmd.exe /c del /f /q"
In the left panel of the Registry Editor window, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>ise32.exe
In the right panel, locate and delete the entry:
Debugger = "cmd.exe /c del /f /q"
In the left panel of the Registry Editor window, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>MSASCui.exe
In the right panel, locate and delete the entry:
Debugger = "rundll32.exe"
In the left panel of the Registry Editor window, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>Nbrowser.exe
In the right panel, locate and delete the entry:
Debugger = "cmd.exe /c del /f /q"
In the left panel of the Registry Editor window, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>New Folder.exe
In the right panel, locate and delete the entry:
Debugger = "cmd.exe /c del /f /q"
In the left panel of the Registry Editor window, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>Njeeves.exe
In the right panel, locate and delete the entry:
Debugger = "cmd.exe /c del /f /q"
In the left panel of the Registry Editor window, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>nod32.exe
In the right panel, locate and delete the entry:
Debugger = "cmd.exe /c del /f /q"
In the left panel of the Registry Editor window, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>nod32krn.exe
In the right panel, locate and delete the entry:
Debugger = "cmd.exe /c del /f /q"
In the left panel of the Registry Editor window, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>nod32kui.exe
In the right panel, locate and delete the entry:
Debugger = "cmd.exe /c del /f /q"
In the left panel of the Registry Editor window, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>npcsvc32.exe
In the right panel, locate and delete the entry:
Debugger = "cmd.exe /c del /f /q"
In the left panel of the Registry Editor window, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>npc_login.exe
In the right panel, locate and delete the entry:
Debugger = "cmd.exe /c del /f /q"
In the left panel of the Registry Editor window, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>npc_tray.exe
In the right panel, locate and delete the entry:
Debugger = "cmd.exe /c del /f /q"
In the left panel of the Registry Editor window, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>npflgutl.exe
In the right panel, locate and delete the entry:
Debugger = "cmd.exe /c del /f /q"
In the left panel of the Registry Editor window, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>npfports.exe
In the right panel, locate and delete the entry:
Debugger = "cmd.exe /c del /f /q"
In the left panel of the Registry Editor window, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>npfrules.exe
In the right panel, locate and delete the entry:
Debugger = "cmd.exe /c del /f /q"
In the left panel of the Registry Editor window, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>npfsvc32.exe
In the right panel, locate and delete the entry:
Debugger = "cmd.exe /c del /f /q"
In the left panel of the Registry Editor window, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>npfuser.exe
In the right panel, locate and delete the entry:
Debugger = "cmd.exe /c del /f /q"
In the left panel of the Registry Editor window, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>npfwiz.exe
In the right panel, locate and delete the entry:
Debugger = "cmd.exe /c del /f /q"
In the left panel of the Registry Editor window, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>nprosec.exe
In the right panel, locate and delete the entry:
Debugger = "cmd.exe /c del /f /q"
In the left panel of the Registry Editor window, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>nuaa.exe
In the right panel, locate and delete the entry:
Debugger = "cmd.exe /c del /f /q"
In the left panel of the Registry Editor window, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>Nvcoa.exe
In the right panel, locate and delete the entry:
Debugger = "cmd.exe /c del /f /q"
In the left panel of the Registry Editor window, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>nvcsched.exe
In the right panel, locate and delete the entry:
Debugger = "cmd.exe /c del /f /q"
In the left panel of the Registry Editor window, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>nvoy.exe
In the right panel, locate and delete the entry:
Debugger = "cmd.exe /c del /f /q"
In the left panel of the Registry Editor window, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>reg32.exe
In the right panel, locate and delete the entry:
Debugger = "cmd.exe /c del /f /q"
In the left panel of the Registry Editor window, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>rtpsvc.exe
In the right panel, locate and delete the entry:
Debugger = "cmd.exe /c del /f /q"
In the left panel of the Registry Editor window, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>scsaver.exe
In the right panel, locate and delete the entry:
Debugger = "cmd.exe /c del /f /q"
In the left panel of the Registry Editor window, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>SSCVIHOST.exe
In the right panel, locate and delete the entry:
Debugger = "cmd.exe /c del /f /q"
In the left panel of the Registry Editor window, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>wscript.exe
In the right panel, locate and delete the entry:
Debugger = "rundll32.exe"
Close Registry Editor.

Step 4

Restore this modified registry value

[ Learn More ]

In HKEY_CLASSES_ROOT\jpegfile\DefaultIcon
- From: (default) = "%User Profile%\Application Data\Java\?shimgvw?.exe,0"
  To: (default) = "shimgvw.dll,3"
In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
- From: HideFileExt = 1
  To: HideFileExt = "0"
In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
- From: SuperHidden = "0"
  To: SuperHidden = "1"
In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
- From: ShowSuperHidden = "0"
  To: ShowSuperHidden = "1"
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\HideFileExt
- From: UncheckedValue = "1"
  To: UncheckedValue = "0"
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden
- From: UncheckedValue = "0"
  To: UncheckedValue = "1"
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore
- From: DisableSR = "1"
  To: DisableSR = "0"
In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\jpegfile\DefaultIcon
- From: (default) = "%User Profile%\Application Data\Java\?shimgvw?.exe,0"
  To: (default) = "shimgvw.dll,3"

To restore the registry value this malware/grayware modified:

Open Registry Editor. Click Start>Run, type REGEDIT in the text box provided, and then press Enter.
In the left panel, double-click the following:
HKEY_CLASSES_ROOT>jpegfile>DefaultIcon
In the right panel, locate the registry value:
(default) = "%User Profile%\Application Data\Java\?shimgvw?.exe,0"
Right-click on the value name and choose Modify. Change the value data of this entry to:
(default) = "shimgvw.dll,3"
In the left panel, double-click the following:
HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Explorer>Advanced
In the right panel, locate the registry value:
HideFileExt = "1"
Right-click on the value name and choose Modify. Change the value data of this entry to:
HideFileExt = "0"
Again In the right panel, locate the registry value:
SuperHidden = "0"
Right-click on the value name and choose Modify. Change the value data of this entry to:
SuperHidden = "1"
Again In the right panel, locate the registry value:
ShowSuperHidden = "0"
Right-click on the value name and choose Modify. Change the value data of this entry to:
ShowSuperHidden = "1"
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Explorer>Advanced>Folder>HideFileExt
In the right panel, locate the registry value:
UncheckedValue = "1"
Right-click on the value name and choose Modify. Change the value data of this entry to:
UncheckedValue = "0"
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Explorer>Advanced>Folder>SuperHidden
In the right panel, locate the registry value:
UncheckedValue = "0"
Right-click on the value name and choose Modify. Change the value data of this entry to:
UncheckedValue = "1"
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>SystemRestore
In the right panel, locate the registry value:
DisableSR = "1"
Right-click on the value name and choose Modify. Change the value data of this entry to:
DisableSR = "0"
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Classes>jpegfile>DefaultIcon
In the right panel, locate the registry value:
(default) = "%User Profile%\Application Data\Java\?shimgvw?.exe,0"
Right-click on the value name and choose Modify. Change the value data of this entry to:
(default) = "shimgvw.dll,3"
Close Registry Editor.

Step 5

Search and delete this folder

[ Learn More ]

Please make sure you check the Search Hidden Files and Folders checkbox in the More advanced options option to include all hidden folders in the search result.

%User Profile%\Application Data\Java

Step 6

Search and delete these files

[ Learn More ]

There may be some component files that are hidden. Please make sure you check the Search Hidden Files and Folders checkbox in the More advanced options option to include all hidden files and folders in the search result.

%User Profile%\Application Data\Java\Desktop.ini
%Windows%\ntbtlog.txt

Step 7

Restart in normal mode and scan your computer with your Trend Micro product for files detected as WORM_NUQEL.DU. If the detected files have already been cleaned, deleted, or quarantined by your Trend Micro product, no further step is required. You may opt to simply delete the quarantined files. Please check this Knowledge Base page for more information.

Did this description help? Tell us how we did.

WORM_NUQEL.DU

OVERVIEW

TECHNICAL DETAILS

SOLUTION

Resources

Support

About Trend

Country Headquarters

WORM_NUQEL.DU

OVERVIEW

TECHNICAL DETAILS

SOLUTION

Resources

Support

About Trend

Country Headquarters

The Americas

Middle East & Africa

Europe

Asia & Pacific