Virus:Worm/Kelvir.DT.1
Date discovered:12/08/2005
Type:Worm
In the wild:Yes
Reported Infections:Low
Distribution Potential:Low to medium
Damage Potential:Low to medium
Static file:Yes
File size:123.904 Bytes
MD5 checksum:45815b95ab4e1648e48db9b215e4b655
VDF version:6.31.1.78

 General Method of propagation:
   • Messenger


Aliases:
   •  Mcafee: W32.Kelvir
   •  Kaspersky: IM-Worm.Win32.Kelvir.dt
   •  TrendMicro: WORM_KELVIR.CH
   •  VirusBuster: Worm.Kelvir.AN


Platforms / OS:
   • Windows 95
   • Windows 98
   • Windows 98 SE
   • Windows NT
   • Windows ME
   • Windows 2000
   • Windows XP
   • Windows 2003


Side effects:
   • Downloads malicious files
   • Registry modification

 Registry The following registry keys are added:

– [HKCR\.key]
   • @="regfile"

– [HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache]
   • "%malware execution directory%\%executed file%.exe"="%executed file%"

 Messenger It is spreading via Messenger. The characteristics are described below:

– Windows Live Messenger


To:
All online contacts in the contact list.


Propagation via URL
It sends the following link:
   • www.**********/img005837.com

 File details Programming language:
 The malware program was written in Visual Basic.


Runtime packer:
In order to aggravate detection and reduce size of the file it is packed with the following runtime packer:
   • ASProtect 1.2x

Description inserted by Catalin Jora on Monday, August 15, 2005
Description updated by Catalin Jora on Wednesday, September 7, 2005

Back . . . .