|
Tuesday, 28 June 2005 |
W32.Kelvir.DR is a worm that spreads through MSN Messenger.
Type: Worm
Infection Length: 20,480 bytes
Systems Affected: Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows Server 2003, Windows XP
When W32.Kelvir.DR is executed, it performs the following actions:
Sends one of the following URLs to all the MSN Messenger contacts on the compromised computer:
[http://]69.64.36.110/[REMOVED]/msn.php?email=[EMAIL ADDRESS]
[http://]lookingat.lo.funpic.org/[REMOVED]/views.php?dir=pics§ion=hot&clip=14
Note: [EMAIL ADDRESS] is the address of the recipient from their MSN profile.
May potentially redirect a user to a Web site that contains malicious content, when the user clicks on the link. |
