Malware type: Worm

Aliases: IM-Worm.Win32.Kelvir.b (Kaspersky), W32/Kelvir.worm.c (McAfee), W32.Kelvir.B (Symantec), Worm/MSN.Kelvir.B (Avira), W32/Kelvir-C (Sophos), Worm:Win32/Kelvir.B (Microsoft)

In the wild: Yes

Destructive: No

Language: English

Platform: Windows 95, 98, ME, NT, 2000, XP

Encrypted: No

Description: 

As of March 7, 2005 3:05 AM (PST/GMT -8:00), TrendLabs has declared a Medium Risk alert to control the spread of this new KELVIR variant that is currently spreading in Korea and the United States.

To get a one-glance comprehensive view of the behavior of this worm, refer to the Behavior Diagram shown below.

Malware Overview

WORM_KELVIR.B, like its precedent WORM_KELVIR.A, spreads via MSN instant messengers (IM). It would seem at first that this worm is a variant of BROPIA family, as worms from this family also send instant messages to online contacts of the affected user.

However, BROPIA variants send copies of itself via instant messages and then drops them on the affected machine, while WORM_KELVIR.B only sends a URL via the messenger, and downloads malicious files from the Internet when the user clicks on the link.

The following is a screenshot of a sample instant message that this worm sends:

The downloaded file, ME.JPG, is detected by Trend Micro as WORM_SDBOT.AUK.The worm saves this file to system's root folder (C:\) using the filename DUMPREP.EXE and then executes it. Please see the description for WORM_SDBOT.AUK for the other system changes.

The other downloaded file, FILE.EXE, is also saved in the system's root folder as FILE.EXE. Currently, this file is not available for download from the Web site.

MSN Messenger worms such as MENGER (the first to propagate via MSN Messenger), FUNNER, BROPIA , FATSO, and now KELVIR, are fast becoming the malware of choice among worm creators.

This can also be attributed to the fact that the code for MSN propagation has already been posted in virus-writers' forums. This also gave way to worms that propagated via AOL instant messengers (IM), particularly AIMDES worms.

Incidentally, WORM_KELVIR.B and WORM_FATSO.A have been declared as Medium Risk (Yellow) Alert malware simultaneously.

For additional information about this threat, see:
Solution
Technical Details

Description created: Mar. 7, 2005 2:46:01 AM GMT -0800
Description updated: Mar. 8, 2005 12:42:37 AM GMT -0800

Search a new malware

Tell us how we did. Take our quick survey.