Find a Partner
This window is encrypted for your security.
Need help? Ask the community or hire an expert.
Go to Avira Answers
Sent by email.
The worm sends itself by email to all addresses found in Outlook. The email looks like this:
Happy birthday ELVA forever.
This I made birthday card for you,
Please open it and I hope you like.
The virus creates the file FS.VBE in C:\
\ and then copies it in C:\
It generates the following registry entries:
The virus is loaded by every system start.
Sets the Word 9 security level to "low".
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1201 "0"
The current user can run ActiveX control items, which are not secure, on the local computer.
HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1201 "0"
Unsecure ActiveX control items can be run on the local computer.
Here the current day is saved.
The complete virus code is saved here.
The file CARD.HTA is attached and sent to all entries in MS Outlook Address Book.
The Internet address "http://www.jasonnet.cc/elva" is sent to Favourites, as "Elva's Page".
The worm searches for all VBS files and replaces their code with its own.
Then, it links to Windows scripting host all the files of type: *.JS; *.JSE; *.GIF; *.JPG; *.MP3; *.WSH; *.WSF; *.WSC; *.SHS; *.SCT. These files will then be treated as VBS files.
The virus infects the Word templates. A small programming error prevent the infection of all Word documents. But it is to be expected that newer versions of the virus will correct this error.
A window will show the following message:
Three days after the virus is activated, it scans the harddisk. It will overwrite its virus code in the files with extension: *.JS; *.JSE; *.GIF; *.JPG; *.MP3; *.WSH; *.WSF; *.WSC; *.SHS; *.SCT.
On August, 24th. of any year, the following message appears on the screen:
I love ELVA 4 ever
Description inserted by Crony Walker on Tuesday, June 15, 2004