Virus/Worm Update (Kelvir.a and Kelvir.b)

Information Week has an article up about the latest virus attack.  You can read it here.

In the article they refer to the worm as Kelvir.a and Kelvir.b:

The new worms, tagged as Kelvir.a and Kelvir.b, appeared over the weekend and on Monday, respectively, anti-virus vendors said. Both use the same mechanism to attract users and infect Windows-based PCs: they include a link in the instant message. That link, in turn, downloads a malicious file — the actual worm, a variant of the long-running Spybot — which opens a backdoor to the compromised machine.

Kelvir spreads by sending itself to all the MSN/Windows Messenger contacts on the infected PC, and poses as cryptic messages such as "lol! see it! u’ll like it!" and "omg this is funny!" The link opens a .pif-formatted file.

See my previous comments about PIF files here.

Posted by Jeff Wilkes.

This entry was posted in MSN Messenger. Bookmark the permalink.

Leave a Reply

Please log in using one of these methods to post your comment: Logo

You are commenting using your account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s