W32/Kelvir.EL is an email worm. This worm is a variant of W32/Kelvir.A. The worm will infect Windows systems and spreads through MSN Messenger.

The worm sends the following message to all online contacts of an affected system via MSN Messenger.

mira esta animacion de bush
http://{BLOCKED}deosgratis.gratishost.com/bush.exe

The message is in spanish and it uses a known political figure to force users to click on the link.

A copy of this worm is downloaded into the recipient's computer, when the recipient clicks on the link included in the message.

Upon execution, the worm drops a copy of itself as strad.exe and zser.exe in the Windows folder and xeyu.exe and xsfr.exe in the system folder.

The worm modifies registry at the following location to load itself during each startup.

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run

This worm first appeared on May 12, 2007.

 Other names of W32/Kelvir.EL Worm:

This Worm is also known as WORM_KELVIR.EL.