This worm reaches computers by e-mail, in a message with variable subjects such as Together You and I, Everyone Needs Someone or Cyber Love. The sender field also varies, although it always contains a woman's name. The file that contains the worm is an executable file with names such as flash postcard.exe or greeting postcard.exe.
When users run the attached file, Nurech.A installs on the computer. The worm is designed to terminate processes belonging to security tools and to look for addresses to spread to on the affected computer. This worm is particularly dangerous bearing in mind its rootkit features, aimed at hiding processes and making detection more difficult for security tools.
According to Luis Corrons, technical director of PandaLabs, "The objective is to trick users into opening the attached file by using an enticing subject, related in this case to romantic relationships, probably due to the proximity of Valentine's Day. This type of trick is usually quite successful, so we advise users not to open any attachment that they have not requested or run any files, regardless of what they seem to contain."
All signs seem to indicate that the authors of this worm are mass-mailing it to as many computers as possible, before the media can raise the alarm and users can protect themselves.
