Newrug is an Internet worm that spreads by e-mail through messages with infected attachments. Once the user opens such an attachment, the parasite secretly installs itself to the system and runs a spreading routine. It gathers e-mail addresses and uses own mail engine to send out bogus letters. Then Newrug runs a payload. It drops a trojan and downloads more malicious code from the Internet. It also disables the Windows Firewall. The worm automatically runs on every Windows startup.