Because your browser does not support JavaScript you are missing out on on some great image optimizations allowing this page to load faster.

Microsoft Security Intelligence

Microsoft Security Intelligence

Cart

Sign in

We're gradually updating threat actor names in our reports to align with the new weather-themed taxonomy. Learn about Microsoft threat actor names

Published Jun 25, 2010 | Updated Sep 15, 2017

Learn about other threats

Worm:Win32/Nekav.A

Detected by Microsoft Defender Antivirus

Aliases: Worm.Win32.NeKav.cv (Kaspersky) Worm/NeKav.CV (Avira)

Summary

Worm:Win32/Nekav.A is a worm that can spread via removable drives. It may pose as an annoyance and interfere with normal operations by displaying a splash image that waits for the user to send a code to supposedly resume back with normal work.

It terminates and deletes certain files, most of which are related to security and antivirus programs. It also modifies certain system settings.

Manual removal is not recommended for this threat. To detect and remove this threat and other malicious software that may have been installed, run a full-system scan with an up-to-date antivirus product such as Microsoft Security Essentials, or the Microsoft Safety Scanner. For more information about using antivirus software, see http://www.microsoft.com/security/antivirus/av.aspx.

Enabling registry editor

This threat may modify the computer to prevent Registry Editor from running. To enable Registry Editor in your computer, please do the following:

Run a command prompt. Click Start>Run and type cmd.
In the command prompt, type the following as is and press Enter:
reg.exe add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 0 /f
Type exit at the command prompt.

Additional remediation instructions for Worm:Win32/Nekav.A

This threat may make lasting changes to a computer’s configuration that are NOT restored by detecting and removing this threat. For more information on returning an infected computer to its pre-infected state, please see the following article/s:

Restoring your System Registry:

For Windows 7: http://windows.microsoft.com/en-us/windows7/Back-up-the-registry
For Windows Vista: http://windows.microsoft.com/en-US/windows-vista/Back-up-the-registry
For Windows XP: http://support.microsoft.com/kb/322756/

Viewing hidden and/or system files:

For Windows 7: http://windows.microsoft.com/en-US/windows7/Show-hidden-files
For Windows Vista: http://windows.microsoft.com/en-US/windows-vista/Show-hidden-files
For Windows XP: http://www.microsoft.com/resources/documentation/windows/xp/all/proddocs/en-us/win_fcab_show_file_extensions.mspx?mfr=true

Enabling Task Manager:

For Windows Vista: http://windows.microsoft.com/en-us/windows-vista/Troubleshoot-Task-Manager-problems
For Windows XP: http://support.microsoft.com/kb/913623/

Enabling System Restore:

For Windows 7: http://windows.microsoft.com/en-us/windows7/What-is-System-Restore
For Windows Vista: http://windows.microsoft.com/en-us/windows-vista/What-is-System-Restore
For Windows XP: http://support.microsoft.com/kb/310405

Correctly disabling Autorun in Windows: http://support.microsoft.com/kb/953252
Using the system's recovery options:

For Windows XP: Installing and using the Recovery Console in Windows XP
For Windows Vista: System Recovery Options in Windows Vista
For Windows 7: System Recovery Options in Windows 7

For other support and help related articles, go to:

Windows 7: http://support.microsoft.com/gp/windows7
Windows Vista: http://support.microsoft.com/ph/11732

Windows XP: http://support.microsoft.com/ph/1173

Microsoft Security TechNet Center: http://technet.microsoft.com/security/default.aspx