Full
Name: |
Kelvir.EB |
| Type: |
Worm |
| Also Known As: |
W32/SpotFace.worm (McAfee) |
| Danger Level: |
6 |
| Category Description: |
Virus-like program that spreads automatically to other computers by sending itself out by email or by any other means. A program that propagates itself by attacking other machines and copying itself to the affected machine.
Worms have self-replicating code that travels from machine to machine by various means. A worms first objective is merely propagation. Worms can be destructive depending on what payload they have been given. Worms may replace files, but do not insert themselves into files. |
| Comment: |
Kelvir.EB is a worm that spreads via Windows Live Messenger and MSN Messenger. This worm spreads by sending a malicious link to the list of contacts(for first 45 members) in the Messenger.
This worm is dropped by Rinbot trojan.
Once infected, this worm checks the infected machine for already running instance of this worm.
If so, this worm kills it and start a new process.
Deletes all files with .exe as extension in C:\
Waits for Windows Live Messenger window and sorts the Contacts list by Status, when becomes active.
Then this worm sends the pre-configured message containing a malicious link to each in contacts list.
Also kills the Task Manager, if exist during the message sending process.
|
| |
|
| Properties: |
|
Back to the list of products removed by X-Cleaner
|
