Threat description




Navidad is an Internet worm. It spreads itself as NAVIDAD.EXE attachment to e-mail messages sent from an infected computer.


Automatic action

Depending on the settings of your F-Secure security product, it will either automatically delete, quarantine or rename the suspect file, or ask you for a desired action.

More scanning & removal options

More information on the scanning and removal options available in your F-Secure product can be found in the Help Center.

You may also refer to the Knowledge Base on the F-Secure Community site for more information.

Contact Support

F-Secure customers can request support online via the Request support or the Chat forms on our Home - Global site.

Technical Details

The icon of the worm's executable file looks like:

The original worm sample that we received has a bug that makes an infected system inoperable after infection - no EXE files could be started.


When run, the NAVIDAD.EXE file installs itself as WINSVRC.VXD into \Windows\System directory and modifies several Registry keys. It changes the default EXE file startup key

  • [HKEY_CLASSES_ROOT\exefile\shell\open\command]

to make sure it starts with every EXE file. The worm also makes sure it is always run on each Windows startup by creating another startup key in:

  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run].

The worm also creates 'Navidad' key in the following section:

  • [HKEY_CURRENT_USER\Software]

But there's a bug in the worm's code - the Registry keys are created for WINSVRC.EXE file while the worm installs itself as WINSVRC.VXD file. As a result no EXE files can be started in a system after infection. Also the worm doesn't get activated on next Windows startup.


During installation the worm displays a fake error message:

After a user presses 'OK', an 'eye' icon appears in Windows taskbar:

This is the major sign that indicates Navidad worm infection in a system. When a user clicks on that icon the following dialog box with 'Nunca presionar este boton' text is displayed:

and when the only button in the above dialog box is clicked, another messagebox with 'Lamentablemente cayo en la tentacion y perdio si computadora' text appears:

When the worm is activated it connects to MAPI-compatible e-mail browser using MAPI32.DLL library, enumerates all unread e-mails, gets e-mail addresses from them and sends itself out to these addresses.


This variant of Navidad worm is a patched version of the original Navidad. But unlike the original Navidad worm, it spreads itself as EMANUEL.EXE and installs itself as WINTASK.EXE to Windows System directory. It also modifies EXE file startup key (now correctly) to be run when any EXE program is launched by a user.

When run, Navidad.b displays a messagebox:

Then it installs itself to memory and shows an ICQ-like (green flower with yellow middle) icon in System tray:

When a cursor is placed on that icon, a message is displayed - "Come on lets party!!!". When a user clicks the icon, Navidad.b displays its original dialog with a button:

If a user clicks [X] to close the dialog, the worm displays the following messagebox and exits:

Otherwise, if a user clicks 'Nunca presionar este boton' button, the worm displays the following messagebox:

Submit a Sample

Suspect a file or URL was wrongly detected? Send it to our Labs for further analysis

Submit a Sample

Give And Get Advice

Give advice. Get advice. Share the knowledge on our free discussion forum.

More Info