WORM_KELVIR.N is a non-destructive worm that propagates via MSN Messenger. It send a message to all contacts listed in the affected user's MSN Messenger Contacts, with a link. When clicked, this link downloads a file. This worm is currently spreading in-the-wild and infecting computers running Windows 95, 98, ME, NT, 2000, and XP. Upon arrival, this worm drops, extracts, and executes the following files: * UNCANNY.EXE – a copy of the worm * ADVBOT.EXE – Trend Micro detects this as WORM_SDBOT.BLL This worm sends a message to all contacts in MSN Messenger with the following details: Once the recipient clicks the link, the file ADVBOT.EXE is downloaded, which Trend detects as WORM_SDBOT.BLL. If you would like to scan your computer for WORM_KELVIR.N or thousands of other worms, viruses, Trojans and malicious code, visit HouseCall, Trend Micro's free, online virus scanner at: http://housecall.trendmicro.com/ WORM_KELVIR.N is detected and cleaned by Trend Micro pattern file #2.566.00 and above.