Find a Partner
This window is encrypted for your security.
Need help? Ask the community or hire an expert.
Go to Avira Answers
Win32.Elkern.a, W32/Elkern.cav, W95/Elkern.A, W32.ElKern.gen
Spreads over local networks.
The Virus can spread over local networks.
When an infected file is opened on Win98/ME system, the worm copies the file in \
\%SYSTEMDIR% directory, as WQK.EXE hidden file. This file has variable size and content.
Then, the virus makes a registry entry, for automatic start of WQK.EXE. By restart, the virus infects .exe files. When an infected file is opened on WinNT/2000/XP system, the worm copies the file WQK.DLL in %SYSTEMdir% and makes the registry entry:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ Windows\AppInit_DLLs=Wqk.dll
The virus has a payload, which overwrites all files with nulls.
Description inserted by Crony Walker on Tuesday, June 15, 2004