Alias:Win32.Elkern.a, W32/Elkern.cav, W95/Elkern.A, W32.ElKern.gen
Type:Worm 
Size: 
Origin: 
Date:00-00-0000 
Damage:Spreads over local networks. 
VDF Version:  
Danger:Low 
Distribution:Low 

DistributionThe Virus can spread over local networks.

Technical DetailsWhen an infected file is opened on Win98/ME system, the worm copies the file in \%WINDIR%\%SYSTEMDIR% directory, as WQK.EXE hidden file. This file has variable size and content.
Then, the virus makes a registry entry, for automatic start of WQK.EXE. By restart, the virus infects .exe files. When an infected file is opened on WinNT/2000/XP system, the worm copies the file WQK.DLL in %SYSTEMdir% and makes the registry entry:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ Windows\AppInit_DLLs=Wqk.dll

The virus has a payload, which overwrites all files with nulls.
Description inserted by Crony Walker on Tuesday, June 15, 2004

Back . . . .