Win32/Nomkesh [Threat Name] go to Threat

Win32/Nomkesh.C [Threat Variant Name]

Category worm
Size 490496 B
Detection created Apr 04, 2013
Detection database version 10054
Aliases Trojan.Win32.Agentb.acsk (Kaspersky)
  Worm:Win32/Dorkbot.AM (Microsoft)
Short description

Win32/Nomkesh.C is a worm that spreads via removable media and IM networks.


When executed, the worm copies itself into the following location:

  • %appdata%\­%variable%.exe

A string with variable content is used instead of %variable% .

In order to be executed on every system start, the worm sets the following Registry entries:

  • [HKEY_LOCAL_MACHINE\­Software\­Microsoft\­Windows\­CurrentVersion\­Run]
    • "%variable%.exe" = "%appdata%\­%variable%.exe"
  • [HKEY_CURRENT_USER\­Software\­Microsoft\­Windows\­CurrentVersion\­Run]
    • "%variable%.exe" = "%appdata%\­%variable%.exe"

After the installation is complete, the worm deletes the original executable file.


The worm may create copies of itself on removable or remote drives.

The following filename is used:

  • %drive%\­snkb0pt\­snkb0pt.exe

The worm creates the following files:

  • %drive%\­snkb0pt\­Desktop.ini
  • %drive%\­autorun.inf

The AUTORUN.INF file contains the path to the malware executable.

Thus, the worm ensures it is started each time infected media is inserted into the computer.

The worm creates the following file:

  • %drive%\­%variable%.lnk

The file is a shortcut to a malicious file.

A string with variable content is used instead of %variable% .

The name of the file may be based on the name of an existing file or folder.

Spreading via IM networks

Win32/Nomkesh.C is a worm that spreads via IM networks.

The following programs are affected:

  • Digsby
  • GoogleTalk
  • QIP
  • Skype
  • Windows Live Messenger
  • Windows Messenger

The message depends entirely on data the worm downloads from the Internet.

Information stealing

Win32/Nomkesh.C is a worm that steals sensitive information.

The worm collects the following information:

  • operating system version
  • information about the operating system and system settings

The worm can send the information to a remote machine.

Other information

The worm acquires data and commands from a remote computer or the Internet.

The worm contains a list of (10) URLs. The IRC protocol is used.

It can execute the following operations:

  • download files from a remote computer and/or the Internet
  • run executable files
  • update itself to a newer version
  • stop itself for a certain time period
  • spread via IM networks
  • perform DoS/DDoS attacks
  • uninstall itself

Please enable Javascript to ensure correct displaying of this content and refresh this page.