TrendMicro: WORM_KELVIR.N

WORM_KELVIR.N is a non-destructive worm that propagates via MSN Messenger. It send a message to all contacts listed in the affected user's MSN Messenger Contacts, with a link. When clicked, this link downloads a file. This worm is currently spreading in-the-wild and infecting computers running Windows 95, 98, ME, NT, 2000, and XP.

Upon arrival, this worm drops, extracts, and executes the following files:

* UNCANNY.EXE – a copy of the worm
* ADVBOT.EXE – Trend Micro detects this as WORM_SDBOT.BLL

This worm sends a message to all contacts in MSN Messenger with the following details:

Once the recipient clicks the link, the file ADVBOT.EXE is downloaded, which Trend detects as WORM_SDBOT.BLL.

If you would like to scan your computer for WORM_KELVIR.N or thousands of other worms, viruses, Trojans and malicious code, visit HouseCall, Trend Micro's free, online virus scanner at: http://housecall.trendmicro.com/

WORM_KELVIR.N is detected and cleaned by Trend Micro pattern file #2.566.00 and above.